commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c Author: Linus Torvalds Date: Sun Feb 19 14:24:22 2023 -0800 Linux 6.2 commit 925cf0457d7e62ce08878ffb789189ac08ca8677 Merge: 0097c18e459c5 f9f57da2c2d11 Author: Linus Torvalds Date: Sat Feb 18 17:57:16 2023 -0800 Merge tag 'x86-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Thomas Gleixner: "A single fix for x86. Revert the recent change to the MTRR code which aimed to support SEV-SNP guests on Hyper-V. It caused a regression on XEN Dom0 kernels. The underlying issue of MTTR (mis)handling in the x86 code needs some deeper investigation and is definitely not 6.2 material" * tag 'x86-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case") commit 0097c18e459c5ca5d169750eaed99fd272606c1a Merge: a33d946cbb870 d125d1349abeb Author: Linus Torvalds Date: Sat Feb 18 17:46:50 2023 -0800 Merge tag 'timers-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A fix for a long standing issue in the alarmtimer code. Posix-timers armed with a short interval with an ignored signal result in an unpriviledged DoS. Due to the ignored signal the timer switches into self rearm mode. This issue had been "fixed" before but a rework of the alarmtimer code 5 years ago lost that workaround. There is no real good solution for this issue, which is also worked around in the core posix-timer code in the same way, but it certainly moved way up on the ever growing todo list" * tag 'timers-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: alarmtimer: Prevent starvation by small intervals and SIG_IGN commit a33d946cbb8709339a856d7da406a7a670e86a60 Merge: 5e725d112e1a5 2b129f0b24ab5 Author: Linus Torvalds Date: Sat Feb 18 17:38:18 2023 -0800 Merge tag 'irq-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single build fix for the PCI/MSI infrastructure. The addition of the new alloc/free interfaces in this cycle forgot to add stub functions for pci_msix_alloc_irq_at() and pci_msix_free_irq() for the CONFIG_PCI_MSI=n case" * tag 'irq-urgent-2023-02-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: PCI/MSI: Provide missing stubs for CONFIG_PCI_MSI=n commit 5e725d112e1a54c2611d5dffd124a79415d0f0de Merge: 0c2822b116e30 2c10b61421a28 Author: Linus Torvalds Date: Sat Feb 18 11:07:32 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm/x86 fixes from Paolo Bonzini: - zero all padding for KVM_GET_DEBUGREGS - fix rST warning - disable vPMU support on hybrid CPUs * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: initialize all of the kvm_debugregs structure before sending it to userspace perf/x86: Refuse to export capabilities for hybrid PMUs KVM: x86/pmu: Disable vPMU support on hybrid CPUs (host PMUs) Documentation/hw-vuln: Fix rST warning commit 0c2822b116e300ca6e3b7f98623deb760a93a1d2 Merge: 0e9fd589e61da 853e2dac25c15 Author: Linus Torvalds Date: Sat Feb 18 10:10:49 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 regression fix from Will Deacon: "Apologies for the _extremely_ late pull request here, but we had a 'perf' (i.e. CPU PMU) regression on the Apple M1 reported on Wednesday [1] which was introduced by bd2756811766 ("perf: Rewrite core context handling") during the merge window. Mark and I looked into this and noticed an additional problem caused by the same patch, where the 'CHAIN' event (used to combine two adjacent 32-bit counters into a single 64-bit counter) was not being filtered correctly. Mark posted a series on Thursday [2] which addresses both of these regressions and I queued it the same day. The changes are small, self-contained and have been confirmed to fix the original regression. Summary: - Fix 'perf' regression for non-standard CPU PMU hardware (i.e. Apple M1)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: perf: reject CHAIN events at creation time arm_pmu: fix event CPU filtering commit 0e9fd589e61dace0dcc9848fbf6eb38f16d25f08 Merge: 38f8ccde04a3f 1250421697312 Author: Linus Torvalds Date: Sat Feb 18 09:56:58 2023 -0800 Merge tag 'block-6.2-2023-02-17' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "I guess this is what can happen when you prep things early for going away, something else comes in last minute. This one fixes another regression in 6.2 for NVMe, from this release, and hence we should probably get it submitted for 6.2. Still waiting for the original reporter (see bugzilla linked in the commit) to test this, but Keith managed to setup and recreate the issue and tested the patch that way" * tag 'block-6.2-2023-02-17' of git://git.kernel.dk/linux: nvme-pci: refresh visible attrs for cmb attributes commit 38f8ccde04a3fa317b51b05e63c3cb57e1641931 Merge: dbeed98d89ea9 99b9402a36f07 Author: Linus Torvalds Date: Fri Feb 17 17:51:40 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-02-17-15-16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Six hotfixes. Five are cc:stable: four for MM, one for nilfs2. Also a MAINTAINERS update" * tag 'mm-hotfixes-stable-2023-02-17-15-16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: nilfs2: fix underflow in second superblock position calculations hugetlb: check for undefined shift on 32 bit architectures mm/migrate: fix wrongly apply write bit after mkdirty on sparc64 MAINTAINERS: update FPU EMULATOR web page mm/MADV_COLLAPSE: set EAGAIN on unexpected page refcount mm/filemap: fix page end in filemap_get_read_batch commit 99b9402a36f0799f25feee4465bfa4b8dfa74b4d Author: Ryusuke Konishi Date: Wed Feb 15 07:40:43 2023 +0900 nilfs2: fix underflow in second superblock position calculations Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second superblock, underflows when the argument device size is less than 4096 bytes. Therefore, when using this macro, it is necessary to check in advance that the device size is not less than a lower limit, or at least that underflow does not occur. The current nilfs2 implementation lacks this check, causing out-of-bound block access when mounting devices smaller than 4096 bytes: I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 NILFS (loop0): unable to read secondary superblock (blocksize = 1024) In addition, when trying to resize the filesystem to a size below 4096 bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number of segments to nilfs_sufile_resize(), corrupting parameters such as the number of segments in superblocks. This causes excessive loop iterations in nilfs_sufile_resize() during a subsequent resize ioctl, causing semaphore ns_segctor_sem to block for a long time and hang the writer thread: INFO: task segctord:5067 blocked for more than 143 seconds. Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:segctord state:D stack:23456 pid:5067 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5293 [inline] __schedule+0x1409/0x43f0 kernel/sched/core.c:6606 schedule+0xc3/0x190 kernel/sched/core.c:6682 rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190 nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline] nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570 kthread+0x270/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 ... Call Trace: folio_mark_accessed+0x51c/0xf00 mm/swap.c:515 __nilfs_get_page_block fs/nilfs2/page.c:42 [inline] nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61 nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121 nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176 nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251 nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline] nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline] nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777 nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422 nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline] nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301 ... This fixes these issues by inserting appropriate minimum device size checks or anti-underflow checks, depending on where the macro is used. Link: https://lkml.kernel.org/r/0000000000004e1dfa05f4a48e6b@google.com Link: https://lkml.kernel.org/r/20230214224043.24141-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit ec4288fe63966b26d53907212ecd05dfa81dd2cc Author: Mike Kravetz Date: Wed Feb 15 17:35:42 2023 -0800 hugetlb: check for undefined shift on 32 bit architectures Users can specify the hugetlb page size in the mmap, shmget and memfd_create system calls. This is done by using 6 bits within the flags argument to encode the base-2 logarithm of the desired page size. The routine hstate_sizelog() uses the log2 value to find the corresponding hugetlb hstate structure. Converting the log2 value (page_size_log) to potential hugetlb page size is the simple statement: 1UL << page_size_log Because only 6 bits are used for page_size_log, the left shift can not be greater than 63. This is fine on 64 bit architectures where a long is 64 bits. However, if a value greater than 31 is passed on a 32 bit architecture (where long is 32 bits) the shift will result in undefined behavior. This was generally not an issue as the result of the undefined shift had to exactly match hugetlb page size to proceed. Recent improvements in runtime checking have resulted in this undefined behavior throwing errors such as reported below. Fix by comparing page_size_log to BITS_PER_LONG before doing shift. Link: https://lkml.kernel.org/r/20230216013542.138708-1-mike.kravetz@oracle.com Link: https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=PB7kT0=yv4MiPgVg@mail.gmail.com/ Fixes: 42d7395feb56 ("mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB") Signed-off-by: Mike Kravetz Reported-by: Naresh Kamboju Reviewed-by: Jesper Juhl Acked-by: Muchun Song Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Cc: Anders Roxell Cc: Andi Kleen Cc: Sasha Levin Cc: Signed-off-by: Andrew Morton commit 96a9c287e25d690fd9623b5133703b8e310fbed1 Author: Peter Xu Date: Thu Feb 16 10:30:59 2023 -0500 mm/migrate: fix wrongly apply write bit after mkdirty on sparc64 Nick Bowler reported another sparc64 breakage after the young/dirty persistent work for page migration (per "Link:" below). That's after a similar report [2]. It turns out page migration was overlooked, and it wasn't failing before because page migration was not enabled in the initial report test environment. David proposed another way [2] to fix this from sparc64 side, but that patch didn't land somehow. Neither did I check whether there's any other arch that has similar issues. Let's fix it for now as simple as moving the write bit handling to be after dirty, like what we did before. Note: this is based on mm-unstable, because the breakage was since 6.1 and we're at a very late stage of 6.2 (-rc8), so I assume for this specific case we should target this at 6.3. [1] https://lore.kernel.org/all/20221021160603.GA23307@u164.east.ru/ [2] https://lore.kernel.org/all/20221212130213.136267-1-david@redhat.com/ Link: https://lkml.kernel.org/r/20230216153059.256739-1-peterx@redhat.com Fixes: 2e3468778dbe ("mm: remember young/dirty bit for page migrations") Link: https://lore.kernel.org/all/CADyTPExpEqaJiMGoV+Z6xVgL50ZoMJg49B10LcZ=8eg19u34BA@mail.gmail.com/ Signed-off-by: Peter Xu Reported-by: Nick Bowler Acked-by: David Hildenbrand Tested-by: Nick Bowler Cc: Cc: Signed-off-by: Andrew Morton commit dbeed98d89ea91ae68ff6dce6060671726292e85 Merge: 75cc9c4716a7a 4302abc628fc0 Author: Linus Torvalds Date: Fri Feb 17 14:53:37 2023 -0800 Merge tag 'powerpc-6.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Prevent fallthrough to hash TLB flush when using radix Thanks to Benjamin Gray and Erhard Furtner. * tag 'powerpc-6.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s: Prevent fallthrough to hash TLB flush when using radix commit 75cc9c4716a7a398139805e62ccc3e0d14d00540 Merge: 03dad2f0c7814 896e090eefede Author: Linus Torvalds Date: Fri Feb 17 14:49:11 2023 -0800 Merge tag 'nfs-for-6.2-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fix from Trond Myklebust: "Unfortunately, we found another bug in the NFSv4.2 READ_PLUS code. Since it has not been possible to fix the bug in time for the 6.2 release, let's just revert the Kconfig change that enables it: - Revert 'NFSv4.2: Change the default KConfig value for READ_PLUS'" * tag 'nfs-for-6.2-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: Revert "NFSv4.2: Change the default KConfig value for READ_PLUS" commit 03dad2f0c781443558a510316a5c22fdd2aa312b Merge: 4b89ca5a780f5 e97fc9cffbb9f Author: Linus Torvalds Date: Fri Feb 17 14:44:31 2023 -0800 Merge tag 'sound-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few last-minute fixes. The significant ones are two ASoC SOF regression fixes while the rest are trivial HD-audio quirks. All are small / one-liners and should be pretty safe to take" * tag 'sound-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP Laptops ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform. ALSA: hda/realtek - fixed wrong gpio assigned ALSA: hda: Fix codec device field initializan ALSA: hda/conexant: add a new hda codec SN6180 ASoC: SOF: ops: refine parameters order in function snd_sof_dsp_update8 commit 4b89ca5a780f59f8762e22d2fbcfa64b95c8891d Merge: 6d2e62e162e14 79eeab1d85e0f Author: Linus Torvalds Date: Fri Feb 17 13:58:20 2023 -0800 Merge tag 'gpio-fixes-for-v6.2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - fix a memory leak in gpio-sim that was triggered every time libgpiod tests are run in user-space * tag 'gpio-fixes-for-v6.2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sim: fix a memory leak commit 6d2e62e162e143330f8543e88bc298c77ca34e03 Merge: bda6cfae33a54 1aff53b2fd903 Author: Linus Torvalds Date: Fri Feb 17 13:53:09 2023 -0800 Merge tag 'ata-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fixes from Damien Le Moal: "Three small fixes for 6.2 final: - Disable READ LOG DMA EXT for Samsung MZ7LH drives as these drives choke on that command, from Patrick. - Add Intel Tiger Lake UP{3,4} to the list of supported AHCI controllers (this is not technically a bug fix, but it is trivial enough that I add it here), from Simon. - Fix code comments in the pata_octeon_cf driver as incorrect formatting was causing warnings from kernel-doc, from Randy" * tag 'ata-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_octeon_cf: drop kernel-doc notation ata: ahci: Add Tiger Lake UP{3,4} AHCI controller ata: libata-core: Disable READ LOG DMA EXT for Samsung MZ7LH commit bda6cfae33a541230970bad853c01a4e5bdeedde Merge: 64e0253df67d5 3f18c5046e633 Author: Linus Torvalds Date: Fri Feb 17 13:48:54 2023 -0800 Merge tag 'mmc-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix potential resource leaks in SDIO card detection error path MMC host: - jz4740: Decrease maximum clock rate to workaround bug on JZ4760(B) - meson-gx: Fix SDIO support to get some WiFi modules to work again - mmc_spi: Fix error handling in ->probe()" * tag 'mmc-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: jz4740: Work around bug on JZ4760(B) mmc: mmc_spi: fix error handling in mmc_spi_probe() mmc: sdio: fix possible resource leaks in some error paths mmc: meson-gx: fix SDIO mode if cap_sdio_irq isn't set commit 64e0253df67d5e1557e82b923c78f1bad185eb9a Merge: ec35307e18ba8 c2dbe32d5db5c Author: Linus Torvalds Date: Fri Feb 17 13:45:09 2023 -0800 Merge tag 'sched-urgent-2023-02-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix user-after-free bug in call_usermodehelper_exec() - Fix missing user_cpus_ptr update in __set_cpus_allowed_ptr_locked() - Fix PSI use-after-free bug in ep_remove_wait_queue() * tag 'sched-urgent-2023-02-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/psi: Fix use-after-free in ep_remove_wait_queue() sched/core: Fix a missed update of user_cpus_ptr freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL commit 1250421697312a7f2f13213a71b430402f2ae8f1 Merge: 9a28b92cc21e8 e917a849c3fc3 Author: Jens Axboe Date: Fri Feb 17 09:07:00 2023 -0700 Merge tag 'nvme-6.2-2022-02-17' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fix from Christoph: "nvme fix for Linux 6.2 - fix visibility of the CMB sysfs attributes (Keith Busch)" * tag 'nvme-6.2-2022-02-17' of git://git.infradead.org/nvme: nvme-pci: refresh visible attrs for cmb attributes commit 896e090eefedeb8a715ea19938a2791c32679cc9 Author: Anna Schumaker Date: Wed Feb 15 16:49:22 2023 -0500 Revert "NFSv4.2: Change the default KConfig value for READ_PLUS" This reverts commit 7fd461c47c6cfab4ca4d003790ec276209e52978. Unfortunately, it has come to our attention that there is still a bug somewhere in the READ_PLUS code that can result in nfsroot systems on ARM to crash during boot. Let's do the right thing and revert this change so we don't break people's nfsroot setups. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 79eeab1d85e0fee4c0bc36f3b6ddf3920f39f74b Author: Bartosz Golaszewski Date: Fri Feb 17 12:02:26 2023 +0100 gpio: sim: fix a memory leak Fix an inverted logic bug in gpio_sim_remove_hogs() that leads to GPIO hog structures never being freed. Fixes: cb8c474e79be ("gpio: sim: new testing module") Reported-by: Mirsad Goran Todorovac Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko commit e97fc9cffbb9f372b53b42c36cd7b20aab44a554 Merge: 82f1627cb6339 1f810d2b6b2fb Author: Takashi Iwai Date: Fri Feb 17 08:56:33 2023 +0100 Merge tag 'asoc-fix-v6.2-rc8-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: One more fix for v6.2 One more fix from Peter which he'd very much like to get into v6.2. commit e917a849c3fc317c4a5f82bb18726000173d39e6 Author: Keith Busch Date: Thu Feb 16 08:44:03 2023 -0800 nvme-pci: refresh visible attrs for cmb attributes The sysfs group containing the cmb attributes is registered before the driver knows if they need to be visible or not. Update the group when cmb attributes are known to exist so the visibility setting is correct. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217037 Fixes: 86adbf0cdb9ec65 ("nvme: simplify transport specific device attribute handling") Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit ec35307e18ba8174e2a3f701956059f6a36f22fb Merge: 3ac88fa4605ec f7597e3c58eeb Author: Linus Torvalds Date: Thu Feb 16 20:23:32 2023 -0800 Merge tag 'drm-fixes-2023-02-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Just a final collection of misc fixes, the biggest disables the recently added dynamic debugging support, it has a regression that needs some bigger fixes. Otherwise a bunch of fixes across the board, vc4, amdgpu and vmwgfx mostly, with some smaller i915 and ast fixes. drm: - dynamic debug disable for now fbdev: - deferred i/o device close fix amdgpu: - Fix GC11.x suspend warning - Fix display warning vc4: - YUV planes fix - hdmi display fix - crtc reduced blanking fix ast: - fix start address computation vmwgfx: - fix bo/handle races i915: - gen11 WA fix" * tag 'drm-fixes-2023-02-17' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Fail atomic_check early on normalize_zpos error drm/amd/amdgpu: fix warning during suspend drm/vmwgfx: Do not drop the reference to the handle too soon drm/vmwgfx: Stop accessing buffer objects which failed init drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list drm: Disable dynamic debug as broken drm/ast: Fix start address computation fbdev: Fix invalid page access after closing deferred I/O devices drm/vc4: crtc: Increase setup cost in core clock calculation to handle extreme reduced blanking drm/vc4: hdmi: Always enable GCP with AVMUTE cleared drm/vc4: Fix YUV plane handling when planes are in different buffers commit 5c7388bcd59df59fe527246526bbdf8b9dedf8cc Author: Randy Dunlap Date: Tue Feb 14 09:02:08 2023 -0800 MAINTAINERS: update FPU EMULATOR web page The web page entry for the FPU EMULATOR no longer works. I notified Bill of this and he asked me to update it to this new entry. Link: https://lkml.kernel.org/r/20230214170208.17287-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Acked-by: Bill Metzenthen Signed-off-by: Andrew Morton commit ae63c898f4004bbc7d212f4adcb3bb14852c30d6 Author: Zach O'Keefe Date: Tue Jan 24 17:57:37 2023 -0800 mm/MADV_COLLAPSE: set EAGAIN on unexpected page refcount During collapse, in a few places we check to see if a given small page has any unaccounted references. If the refcount on the page doesn't match our expectations, it must be there is an unknown user concurrently interested in the page, and so it's not safe to move the contents elsewhere. However, the unaccounted pins are likely an ephemeral state. In this situation, MADV_COLLAPSE returns -EINVAL when it should return -EAGAIN. This could cause userspace to conclude that the syscall failed, when it in fact could succeed by retrying. Link: https://lkml.kernel.org/r/20230125015738.912924-1-zokeefe@google.com Fixes: 7d8faaf15545 ("mm/madvise: introduce MADV_COLLAPSE sync hugepage collapse") Signed-off-by: Zach O'Keefe Reported-by: Hugh Dickins Acked-by: Hugh Dickins Reviewed-by: Yang Shi Cc: Signed-off-by: Andrew Morton commit 5956592ce337330cdff0399a6f8b6a5aea397a8e Author: Qian Yingjin Date: Wed Feb 8 10:24:00 2023 +0800 mm/filemap: fix page end in filemap_get_read_batch I was running traces of the read code against an RAID storage system to understand why read requests were being misaligned against the underlying RAID strips. I found that the page end offset calculation in filemap_get_read_batch() was off by one. When a read is submitted with end offset 1048575, then it calculates the end page for read of 256 when it should be 255. "last_index" is the index of the page beyond the end of the read and it should be skipped when get a batch of pages for read in @filemap_get_read_batch(). The below simple patch fixes the problem. This code was introduced in kernel 5.12. Link: https://lkml.kernel.org/r/20230208022400.28962-1-coolqyj@163.com Fixes: cbd59c48ae2b ("mm/filemap: use head pages in generic_file_buffered_read") Signed-off-by: Qian Yingjin Reviewed-by: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 4302abc628fc0dc08e5855f21bbfaed407a72bc3 Author: Benjamin Gray Date: Fri Feb 17 12:14:34 2023 +1100 powerpc/64s: Prevent fallthrough to hash TLB flush when using radix In the fix reconnecting hash__tlb_flush() to tlb_flush() the void return on radix__tlb_flush() was not restored and subsequently falls through to the restored hash__tlb_flush(). Guard hash__tlb_flush() under an else to prevent this. Fixes: 1665c027afb2 ("powerpc/64s: Reconnect tlb_flush() to hash__tlb_flush()") Reported-by: "Erhard F." Suggested-by: Christophe Leroy Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230217011434.115554-1-bgray@linux.ibm.com commit f7597e3c58eeb9ce534993f53c982f2e91e6dd4d Merge: a2a04b515562b d5a1224aa68c8 Author: Dave Airlie Date: Fri Feb 17 09:49:12 2023 +1000 Merge tag 'drm-intel-fixes-2023-02-16' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Moving gen11 hw wa to the right place. (Matt) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y+47eUvwbafER35/@intel.com commit a2a04b515562bbb040e8ae3decae8c1e9ef05327 Merge: caa068c9bb2bc a950b989ea29a Author: Dave Airlie Date: Fri Feb 17 09:23:43 2023 +1000 Merge tag 'drm-misc-fixes-2023-02-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Multiple fixes in vc4 to address issues with YUV planes, HDMI and CRTC; an invalid page access fix for fbdev, mark dynamic debug as broken, a double free and refcounting fix for vmwgfx. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230216091905.i5wswy4dd74x4br5@houat commit caa068c9bb2bc86e6da2caf8508f3fda24d4dea0 Merge: ceaa837f96adb 2a00299e74473 Author: Dave Airlie Date: Fri Feb 17 07:34:58 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-02-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-02-15: amdgpu: - Fix GC11.x suspend warning - Fix display warning Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230216041122.7714-1-alexander.deucher@amd.com commit 853e2dac25c15f7431dfe59805de1bada34c96e9 Author: Mark Rutland Date: Thu Feb 16 14:12:39 2023 +0000 arm64: perf: reject CHAIN events at creation time Currently it's possible for a user to open CHAIN events arbitrarily, which we previously tried to rule out in commit: ca2b497253ad01c8 ("arm64: perf: Reject stand-alone CHAIN events for PMUv3") Which allowed the events to be opened, but prevented them from being scheduled by by using an arm_pmu::filter_match hook to reject the relevant events. The CHAIN event filtering in the arm_pmu::filter_match hook was silently removed in commit: bd27568117664b8b ("perf: Rewrite core context handling") As a result, it's now possible for users to open CHAIN events, and for these to be installed arbitrarily. Fix this by rejecting CHAIN events at creation time. This avoids the creation of events which will never count, and doesn't require using the dynamic filtering. Attempting to open a CHAIN event (0x1e) will now be rejected: | # ./perf stat -e armv8_pmuv3/config=0x1e/ ls | perf | | Performance counter stats for 'ls': | | armv8_pmuv3/config=0x1e/ | | 0.002197470 seconds time elapsed | | 0.000000000 seconds user | 0.002294000 seconds sys Other events (e.g. CPU_CYCLES / 0x11) will open as usual: | # ./perf stat -e armv8_pmuv3/config=0x11/ ls | perf | | Performance counter stats for 'ls': | | 2538761 armv8_pmuv3/config=0x11/ | | 0.002227330 seconds time elapsed | | 0.002369000 seconds user | 0.000000000 seconds sys Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Mark Rutland Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Will Deacon Link: https://lore.kernel.org/r/20230216141240.3833272-3-mark.rutland@arm.com Signed-off-by: Will Deacon commit 61d03862734360aad470019f160d484403a3923e Author: Mark Rutland Date: Thu Feb 16 14:12:38 2023 +0000 arm_pmu: fix event CPU filtering Janne reports that perf has been broken on Apple M1 as of commit: bd27568117664b8b ("perf: Rewrite core context handling") That commit replaced the pmu::filter_match() callback with pmu::filter(), whose return value has the opposite polarity, with true implying events should be ignored rather than scheduled. While an attempt was made to update the logic in armv8pmu_filter() and armpmu_filter() accordingly, the return value remains inverted in a couple of cases: * If the arm_pmu does not have an arm_pmu::filter() callback, armpmu_filter() will always return whether the CPU is supported rather than whether the CPU is not supported. As a result, the perf core will not schedule events on supported CPUs, resulting in a loss of events. Additionally, the perf core will attempt to schedule events on unsupported CPUs, but this will be rejected by armpmu_add(), which may result in a loss of events from other PMUs on those unsupported CPUs. * If the arm_pmu does have an arm_pmu::filter() callback, and armpmu_filter() is called on a CPU which is not supported by the arm_pmu, armpmu_filter() will return false rather than true. As a result, the perf core will attempt to schedule events on unsupported CPUs, but this will be rejected by armpmu_add(), which may result in a loss of events from other PMUs on those unsupported CPUs. This means a loss of events can be seen with any arm_pmu driver, but with the ARMv8 PMUv3 driver (which is the only arm_pmu driver with an arm_pmu::filter() callback) the event loss will be more limited and may go unnoticed, which is how this issue evaded testing so far. Fix the CPU filtering by performing this consistently in armpmu_filter(), and remove the redundant arm_pmu::filter() callback and armv8pmu_filter() implementation. Commit bd2756811766 also silently removed the CHAIN event filtering from armv8pmu_filter(), which will be addressed by a separate patch without using the filter callback. Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: Janne Grunau Link: https://lore.kernel.org/asahi/20230215-arm_pmu_m1_regression-v1-1-f5a266577c8d@jannau.net/ Signed-off-by: Mark Rutland Cc: Will Deacon Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Asahi Lina Cc: Eric Curtin Tested-by: Janne Grunau Link: https://lore.kernel.org/r/20230216141240.3833272-2-mark.rutland@arm.com Signed-off-by: Will Deacon commit 3ac88fa4605ec98e545fb3ad0154f575fda2de5f Merge: d3d6f0eb086d3 b20b8aec6ffc0 Author: Linus Torvalds Date: Thu Feb 16 12:13:58 2023 -0800 Merge tag 'net-6.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Fixes from the main networking tree only, probably because all sub-trees have backed off and haven't submitted their changes. None of the fixes here are particularly scary and no outstanding regressions. In an ideal world the "current release" sections would be empty at this stage but that never happens. Current release - regressions: - fix unwanted sign extension in netdev_stats_to_stats64() Current release - new code bugs: - initialize net->notrefcnt_tracker earlier - devlink: fix netdev notifier chain corruption - nfp: make sure mbox accesses in IPsec code are atomic - ice: fix check for weight and priority of a scheduling node Previous releases - regressions: - ice: xsk: fix cleaning of XDP_TX frame, prevent inf loop - igb: fix I2C bit banging config with external thermal sensor Previous releases - always broken: - sched: tcindex: update imperfect hash filters respecting rcu - mpls: fix stale pointer if allocation fails during device rename - dccp/tcp: avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions - remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues() - af_key: fix heap information leak - ipv6: fix socket connection with DSCP (correct interpretation of the tclass field vs fib rule matching) - tipc: fix kernel warning when sending SYN message - vmxnet3: read RSS information from the correct descriptor (eop)" * tag 'net-6.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (35 commits) devlink: Fix netdev notifier chain corruption igb: conditionalize I2C bit banging on external thermal sensor support net: mpls: fix stale pointer if allocation fails during device rename net/sched: tcindex: search key must be 16 bits tipc: fix kernel warning when sending SYN message igb: Fix PPS input and output using 3rd and 4th SDP net: use a bounce buffer for copying skb->mark ixgbe: add double of VLAN header when computing the max MTU i40e: add double of VLAN header when computing the max MTU ixgbe: allow to increase MTU to 3K with XDP enabled net: stmmac: Restrict warning on disabling DMA store and fwd mode net/sched: act_ctinfo: use percpu stats net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence ice: fix lost multicast packets in promisc mode ice: Fix check for weight and priority of a scheduling node bnxt_en: Fix mqprio and XDP ring checking logic net: Fix unwanted sign extension in netdev_stats_to_stats64() net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() af_key: Fix heap information leak ... commit d3d6f0eb086d3d68960ded479e846e7dcfcec2bb Merge: b5596f1d54589 9a28b92cc21e8 Author: Linus Torvalds Date: Thu Feb 16 12:05:33 2023 -0800 Merge tag 'block-6.2-2023-02-16' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Just a few NVMe fixes that should go into the 6.2 release, adding a quirk and fixing two issues introduced in this release: - NVMe fixes via Christoph: - Always return an ERR_PTR from nvme_pci_alloc_dev (Irvin Cote) - Add bogus ID quirk for ADATA SX6000PNP (Daniel Wagner) - Set the DMA mask earlier (Christoph Hellwig)" * tag 'block-6.2-2023-02-16' of git://git.kernel.dk/linux: nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev nvme-pci: set the DMA mask earlier nvme-pci: add bogus ID quirk for ADATA SX6000PNP commit b5596f1d545898de6d5cebe99692e6a205b61c92 Merge: 18902059e05bd f276aacf5d2f7 Author: Linus Torvalds Date: Thu Feb 16 12:01:46 2023 -0800 Merge tag 'spi-v6.2-rc8-abi' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One more last minute patch for v6.2 updating the parsing of the newly added spi-cs-setup-delay-ns. It's been pointed out that due to the way DT parsing works the change in property size is ABI visible so let's not let a release go out without it being fixed. The change got split from some earlier ABI related fixes to the property since the first version sent had a build error" * tag 'spi-v6.2-rc8-abi' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Use a 32-bit DT property for spi-cs-setup-delay-ns commit 18902059e05bd22edaf70ab5819291d0618c93dc Merge: 88d355832e09f b8b3b0bfb742f Author: Linus Torvalds Date: Thu Feb 16 11:57:43 2023 -0800 Merge tag 'gpio-fixes-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a potential Kconfig issue with gpio-mlxbf2 not selecting GPIOLIB_IRQCHIP - another immutable irqchip conversion, this time for gpio-vf610 - fix a wakeup issue on Clevo NH5xAx * tag 'gpio-fixes-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mlxbf2: select GPIOLIB_IRQCHIP gpiolib: acpi: Add a ignore wakeup quirk for Clevo NH5xAx gpio: vf610: make irq_chip immutable gpiolib: acpi: remove redundant declaration commit 88d355832e09f5dd30d2df4c22c4e8129c3cce3c Author: Christoph Hellwig Date: Thu Feb 16 07:31:10 2023 +0100 stop mainaining UUID The uuid code is very low maintainance now that the major overhaul has completed, and doesn't need it's own tree. All the recent work has been done by Andy who'd like to stay on as a reviewer without an explicit tree. Signed-off-by: Christoph Hellwig Acked-by: Andy Shevchenko Signed-off-by: Linus Torvalds commit a8cd2990b694ed2c0ef0e8fc80686c664b4ebbe5 Author: Christoph Hellwig Date: Thu Feb 16 07:29:22 2023 +0100 orphan sysvfs This code has been stale for years and I have no way to test it. Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit 2c10b61421a28e95a46ab489fd56c0f442ff6952 Author: Greg Kroah-Hartman Date: Tue Feb 14 11:33:04 2023 +0100 kvm: initialize all of the kvm_debugregs structure before sending it to userspace When calling the KVM_GET_DEBUGREGS ioctl, on some configurations, there might be some unitialized portions of the kvm_debugregs structure that could be copied to userspace. Prevent this as is done in the other kvm ioctls, by setting the whole structure to 0 before copying anything into it. Bonus is that this reduces the lines of code as the explicit flag setting and reserved space zeroing out can be removed. Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: Cc: "H. Peter Anvin" Cc: stable Reported-by: Xingyuan Mo Signed-off-by: Greg Kroah-Hartman Message-Id: <20230214103304.3689213-1-gregkh@linuxfoundation.org> Tested-by: Xingyuan Mo Signed-off-by: Paolo Bonzini commit 1f810d2b6b2fbdc5279644d8b2c140b1f7c9d43d Author: Pierre-Louis Bossart Date: Thu Feb 16 18:23:40 2023 +0200 ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak The HDaudio stream allocation is done first, and in a second step the LOSIDV parameter is programmed for the multi-link used by a codec. This leads to a possible stream_tag leak, e.g. if a DisplayAudio link is not used. This would happen when a non-Intel graphics card is used and userspace unconditionally uses the Intel Display Audio PCMs without checking if they are connected to a receiver with jack controls. We should first check that there is a valid multi-link entry to configure before allocating a stream_tag. This change aligns the dma_assign and dma_cleanup phases. Complements: b0cd60f3e9f5 ("ALSA/ASoC: hda: clarify bus_get_link() and bus_link_get() helpers") Link: https://github.com/thesofproject/linux/issues/4151 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Rander Wang Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230216162340.19480-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 82f1627cb6339ee32db22c89c750c0e359e5c72e Merge: 9251584af0928 5afc7eefe4164 Author: Takashi Iwai Date: Thu Feb 16 14:29:54 2023 +0100 Merge tag 'asoc-fix-v6.2-rc8' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for v6.2 One non-urgent fix for v6.2, this could possibly wait till the merge window. commit b8b3b0bfb742f0cbb006c66b10216b724ce42e25 Merge: 2f43f6020cde9 a69982c37cd05 Author: Bartosz Golaszewski Date: Thu Feb 16 13:31:42 2023 +0100 Merge tag 'intel-gpio-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio for v6.2-2 * Ignore spurious wakeup by touchpad on Clevo NH5xAx * Miscellaneous fix(es) commit b20b8aec6ffc07bb547966b356780cd344f20f5b Author: Ido Schimmel Date: Wed Feb 15 09:31:39 2023 +0200 devlink: Fix netdev notifier chain corruption Cited commit changed devlink to register its netdev notifier block on the global netdev notifier chain instead of on the per network namespace one. However, when changing the network namespace of the devlink instance, devlink still tries to unregister its notifier block from the chain of the old namespace and register it on the chain of the new namespace. This results in corruption of the notifier chains, as the same notifier block is registered on two different chains: The global one and the per network namespace one. In turn, this causes other problems such as the inability to dismantle namespaces due to netdev reference count issues. Fix by preventing devlink from moving its notifier block between namespaces. Reproducer: # echo "10 1" > /sys/bus/netdevsim/new_device # ip netns add test123 # devlink dev reload netdevsim/netdevsim10 netns test123 # ip netns del test123 [ 71.935619] unregister_netdevice: waiting for lo to become free. Usage count = 2 [ 71.938348] leaked reference. Fixes: 565b4824c39f ("devlink: change port event netdev notifier from per-net to global") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Reviewed-by: Jacob Keller Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230215073139.1360108-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 5d54cb1767e06025819daa6769e0f18dcbc60936 Author: Corinna Vinschen Date: Tue Feb 14 10:55:48 2023 -0800 igb: conditionalize I2C bit banging on external thermal sensor support Commit a97f8783a937 ("igb: unbreak I2C bit-banging on i350") introduced code to change I2C settings to bit banging unconditionally. However, this patch introduced a regression: On an Intel S2600CWR Server Board with three NICs: - 1x dual-port copper Intel I350 Gigabit Network Connection [8086:1521] (rev 01) fw 1.63, 0x80000dda - 2x quad-port SFP+ with copper SFP Avago ABCU-5700RZ Intel I350 Gigabit Fiber Network Connection [8086:1522] (rev 01) fw 1.52.0 the SFP NICs no longer get link at all. Reverting commit a97f8783a937 or switching to the Intel out-of-tree driver both fix the problem. Per the igb out-of-tree driver, I2C bit banging on i350 depends on support for an external thermal sensor (ETS). However, commit a97f8783a937 added bit banging unconditionally. Additionally, the out-of-tree driver always calls init_thermal_sensor_thresh on probe, while our driver only calls init_thermal_sensor_thresh only in igb_reset(), and only if an ETS is present, ignoring the internal thermal sensor. The affected SFPs don't provide an ETS. Per Intel, the behaviour is a result of i350 firmware requirements. This patch fixes the problem by aligning the behaviour to the out-of-tree driver: - split igb_init_i2c() into two functions: - igb_init_i2c() only performs the basic I2C initialization. - igb_set_i2c_bb() makes sure that E1000_CTRL_I2C_ENA is set and enables bit-banging. - igb_probe() only calls igb_set_i2c_bb() if an ETS is present. - igb_probe() calls init_thermal_sensor_thresh() unconditionally. - igb_reset() aligns its behaviour to igb_probe(), i. e., call igb_set_i2c_bb() if an ETS is present and call init_thermal_sensor_thresh() unconditionally. Fixes: a97f8783a937 ("igb: unbreak I2C bit-banging on i350") Tested-by: Mateusz Palczewski Co-developed-by: Jamie Bainbridge Signed-off-by: Jamie Bainbridge Signed-off-by: Corinna Vinschen Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230214185549.1306522-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 2a00299e7447395d0898e7c6214817c06a61a8e8 Author: Leo Li Date: Thu Feb 9 12:15:21 2023 -0500 drm/amd/display: Fail atomic_check early on normalize_zpos error [Why] drm_atomic_normalize_zpos() can return an error code when there's modeset lock contention. This was being ignored. [How] Bail out of atomic check if normalize_zpos() returns an error. Fixes: b261509952bc ("drm/amd/display: Fix double cursor on non-video RGB MPO") Signed-off-by: Leo Li Tested-by: Mikhail Gavrilov Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8f32378986218812083b127da5ba42d48297d7c4 Author: Jack Xiao Date: Fri Feb 10 10:31:32 2023 +0800 drm/amd/amdgpu: fix warning during suspend Freeing memory was warned during suspend. Move the self test out of suspend. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2151825 Cc: jfalempe@redhat.com Signed-off-by: Jack Xiao Reviewed-by: Christian König Reviewed-by: Feifei Xu Reviewed-and-tested-by: Evan Quan Tested-by: Jocelyn Falempe Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit dee4bf7167cfcae642e0cf04bef81dca49cc286f Merge: fda6c89fe3d9a 0967bf837784a Author: Jakub Kicinski Date: Wed Feb 15 19:20:58 2023 -0800 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-02-14 (ixgbe, i40e) This series contains updates to ixgbe and i40e drivers. Jason Xing corrects comparison of frame sizes for setting MTU with XDP on ixgbe and adjusts frame size to account for a second VLAN header on ixgbe and i40e. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: add double of VLAN header when computing the max MTU i40e: add double of VLAN header when computing the max MTU ixgbe: allow to increase MTU to 3K with XDP enabled ==================== Link: https://lore.kernel.org/r/20230214185146.1305819-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 033c40a89f55525139fd5b6342281b09b97d05bf Merge: 3402351a5a8f3 cbb13e12a5d3e Author: Linus Torvalds Date: Wed Feb 15 14:53:08 2023 -0800 Merge tag 'apparmor-v6.2-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor fix from John Johansen: "Regression fix for getattr mediation of old policy" * tag 'apparmor-v6.2-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: Fix regression in compat permissions for getattr commit 9a28b92cc21e8445c25b18e46f41634539938a91 Merge: 38c33ece23201 dc785d69d753a Author: Jens Axboe Date: Wed Feb 15 13:47:27 2023 -0700 Merge tag 'nvme-6.2-2023-02-15' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - always return an ERR_PTR from nvme_pci_alloc_dev (Irvin Cote) - add bogus ID quirk for ADATA SX6000PNP (Daniel Wagner) - set the DMA mask earlier (Christoph Hellwig)" * tag 'nvme-6.2-2023-02-15' of git://git.infradead.org/nvme: nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev nvme-pci: set the DMA mask earlier nvme-pci: add bogus ID quirk for ADATA SX6000PNP commit 3402351a5a8f3bcb1488877f85072a0141c97939 Merge: ca5ca227757d7 4102db175b5d8 Author: Linus Torvalds Date: Wed Feb 15 11:48:56 2023 -0800 Merge tag 'nfsd-6.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix a teardown bug in the new nfs4_file hashtable * tag 'nfsd-6.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: don't destroy global nfs4_file table in per-net shutdown commit ca5ca227757d7da7f19092bce662b80c74dea507 Merge: e1c04510f521e 70b5339caf847 Author: Linus Torvalds Date: Wed Feb 15 11:31:34 2023 -0800 Merge tag 'trace-v6.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixlet from Steven Rostedt: "Make trace_define_field_ext() static. Just after the fix to TASK_COMM_LEN not converted to its value in trace_events was pulled, the kernel test robot reported that the helper function trace_define_field_ext() added to that change was only used in the file it was defined in but was not declared static. Make it a local function" * tag 'trace-v6.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Make trace_define_field_ext() static commit cbb13e12a5d3ecef400716ea7d12a9268b0f37ca Author: John Johansen Date: Tue Feb 14 20:21:17 2023 -0800 apparmor: Fix regression in compat permissions for getattr This fixes a regression in mediation of getattr when old policy built under an older ABI is loaded and mapped to internal permissions. The regression does not occur for all getattr permission requests, only appearing if state zero is the final state in the permission lookup. This is because despite the first state (index 0) being guaranteed to not have permissions in both newer and older permission formats, it may have to carry permissions that were not mediated as part of an older policy. These backward compat permissions are mapped here to avoid special casing the mediation code paths. Since the mapping code already takes into account backwards compat permission from older formats it can be applied to state 0 to fix the regression. Fixes: 408d53e923bd ("apparmor: compute file permissions on profile load") Reported-by: Philip Meulengracht Signed-off-by: John Johansen commit 2f43f6020cde9f5024d26f17e9fd9f9b5581c2f9 Author: Linus Walleij Date: Wed Feb 15 15:52:06 2023 +0100 gpio: mlxbf2: select GPIOLIB_IRQCHIP This driver uncondictionally uses the GPIOLIB_IRQCHIP so select it. Signed-off-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit a69982c37cd0586e6832268155349301b87f2e35 Author: Werner Sembach Date: Wed Feb 15 15:39:41 2023 +0100 gpiolib: acpi: Add a ignore wakeup quirk for Clevo NH5xAx The commit 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") changed the policy such that I2C touchpads may be able to wake up the system by default if the system is configured as such. However for some devices there is a bug, that is causing the touchpad to instantly wake up the device again once it gets deactivated. The root cause is still under investigation (see Link tag). To workaround this problem for the time being, introduce a quirk for this model that will prevent the wakeup capability for being set for GPIO 16. Fixes: 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") Link: https://lore.kernel.org/linux-acpi/20230210164636.628462-1-wse@tuxedocomputers.com/ Signed-off-by: Werner Sembach Cc: # v6.1+ Signed-off-by: Andy Shevchenko commit e6ef4f8ede09f4af7cde000717b349b50bc62576 Author: Alexander Stein Date: Wed Feb 15 10:52:49 2023 +0100 gpio: vf610: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Alexander Stein Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit b61494d0f82e7298ddef7b1ced0946ccdc1c7d88 Author: Raag Jadav Date: Wed Feb 15 17:30:04 2023 +0530 gpiolib: acpi: remove redundant declaration Remove acpi_device declaration, as it is no longer needed. Signed-off-by: Raag Jadav Reviewed-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 4b4191b8ae1278bde3642acaaef8f92810ed111a Author: Sean Christopherson Date: Wed Feb 8 20:42:30 2023 +0000 perf/x86: Refuse to export capabilities for hybrid PMUs Now that KVM disables vPMU support on hybrid CPUs, WARN and return zeros if perf_get_x86_pmu_capability() is invoked on a hybrid CPU. The helper doesn't provide an accurate accounting of the PMU capabilities for hybrid CPUs and needs to be enhanced if KVM, or anything else outside of perf, wants to act on the PMU capabilities. Cc: stable@vger.kernel.org Cc: Andrew Cooper Cc: Peter Zijlstra Cc: Kan Liang Cc: Andi Kleen Link: https://lore.kernel.org/all/20220818181530.2355034-1-kan.liang@linux.intel.com Signed-off-by: Sean Christopherson Message-Id: <20230208204230.1360502-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4d7404e5ee0066e9a9e8268675de8a273b568b08 Author: Sean Christopherson Date: Wed Feb 8 20:42:29 2023 +0000 KVM: x86/pmu: Disable vPMU support on hybrid CPUs (host PMUs) Disable KVM support for virtualizing PMUs on hosts with hybrid PMUs until KVM gains a sane way to enumeration the hybrid vPMU to userspace and/or gains a mechanism to let userspace opt-in to the dangers of exposing a hybrid vPMU to KVM guests. Virtualizing a hybrid PMU, or at least part of a hybrid PMU, is possible, but it requires careful, deliberate configuration from userspace. E.g. to expose full functionality, vCPUs need to be pinned to pCPUs to prevent migrating a vCPU between a big core and a little core, userspace must enumerate a reasonable topology to the guest, and guest CPUID must be curated per vCPU to enumerate accurate vPMU capabilities. The last point is especially problematic, as KVM doesn't control which pCPU it runs on when enumerating KVM's vPMU capabilities to userspace, i.e. userspace can't rely on KVM_GET_SUPPORTED_CPUID in it's current form. Alternatively, userspace could enable vPMU support by enumerating the set of features that are common and coherent across all cores, e.g. by filtering PMU events and restricting guest capabilities. But again, that requires userspace to take action far beyond reflecting KVM's supported feature set into the guest. For now, simply disable vPMU support on hybrid CPUs to avoid inducing seemingly random #GPs in guests, and punt support for hybrid CPUs to a future enabling effort. Reported-by: Jianfeng Gao Cc: stable@vger.kernel.org Cc: Andrew Cooper Cc: Peter Zijlstra Cc: Kan Liang Cc: Andi Kleen Link: https://lore.kernel.org/all/20220818181530.2355034-1-kan.liang@linux.intel.com Signed-off-by: Sean Christopherson Message-Id: <20230208204230.1360502-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c2dbe32d5db5c4ead121cf86dabd5ab691fb47fe Author: Munehisa Kamata Date: Tue Feb 14 13:27:05 2023 -0800 sched/psi: Fix use-after-free in ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, the polling waitqueue gets freed in the following path: do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy However, the polling thread still has a reference to the pressure file and will access the freed waitqueue when the file is closed or upon exit: fput ep_eventpoll_release ep_free ep_remove_wait_queue remove_wait_queue This results in use-after-free as pasted below. The fundamental problem here is that cgroup_file_release() (and consequently waitqueue's lifetime) is not tied to the file's real lifetime. Using wake_up_pollfree() here might be less than ideal, but it is in line with the comment at commit 42288cb44c4b ("wait: add wake_up_pollfree()") since the waitqueue's lifetime is not tied to file's one and can be considered as another special case. While this would be fixable by somehow making cgroup_file_release() be tied to the fput(), it would require sizable refactoring at cgroups or higher layer which might be more justifiable if we identify more cases like this. BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x60/0xc0 Write of size 4 at addr ffff88810e625328 by task a.out/4404 CPU: 19 PID: 4404 Comm: a.out Not tainted 6.2.0-rc6 #38 Hardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017 Call Trace: dump_stack_lvl+0x73/0xa0 print_report+0x16c/0x4e0 kasan_report+0xc3/0xf0 kasan_check_range+0x2d2/0x310 _raw_spin_lock_irqsave+0x60/0xc0 remove_wait_queue+0x1a/0xa0 ep_free+0x12c/0x170 ep_eventpoll_release+0x26/0x30 __fput+0x202/0x400 task_work_run+0x11d/0x170 do_exit+0x495/0x1130 do_group_exit+0x100/0x100 get_signal+0xd67/0xde0 arch_do_signal_or_restart+0x2a/0x2b0 exit_to_user_mode_prepare+0x94/0x100 syscall_exit_to_user_mode+0x20/0x40 do_syscall_64+0x52/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 4404: kasan_set_track+0x3d/0x60 __kasan_kmalloc+0x85/0x90 psi_trigger_create+0x113/0x3e0 pressure_write+0x146/0x2e0 cgroup_file_write+0x11c/0x250 kernfs_fop_write_iter+0x186/0x220 vfs_write+0x3d8/0x5c0 ksys_write+0x90/0x110 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 4407: kasan_set_track+0x3d/0x60 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x11d/0x170 slab_free_freelist_hook+0x87/0x150 __kmem_cache_free+0xcb/0x180 psi_trigger_destroy+0x2e8/0x310 cgroup_file_release+0x4f/0xb0 kernfs_drain_open_files+0x165/0x1f0 kernfs_drain+0x162/0x1a0 __kernfs_remove+0x1fb/0x310 kernfs_remove_by_name_ns+0x95/0xe0 cgroup_addrm_files+0x67f/0x700 cgroup_destroy_locked+0x283/0x3c0 cgroup_rmdir+0x29/0x100 kernfs_iop_rmdir+0xd1/0x140 vfs_rmdir+0xfe/0x240 do_rmdir+0x13d/0x280 __x64_sys_rmdir+0x2c/0x30 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 0e94682b73bf ("psi: introduce psi monitor") Signed-off-by: Munehisa Kamata Signed-off-by: Mengchi Cheng Signed-off-by: Ingo Molnar Acked-by: Suren Baghdasaryan Acked-by: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/lkml/20230106224859.4123476-1-kamatam@amazon.com/ Link: https://lore.kernel.org/r/20230214212705.4058045-1-kamatam@amazon.com commit 971cecb9591a7b8ceae658252bf15240d7078a45 Author: Paolo Bonzini Date: Wed Feb 15 07:11:32 2023 -0500 Documentation/hw-vuln: Fix rST warning The following warning: Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst:92: ERROR: Unexpected indentation. was introduced by commit 493a2c2d23ca. Fix it by placing everything in the same paragraph and also use a monospace font. Fixes: 493a2c2d23ca ("Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions") Reported-by: Stephen Rothwell Signed-off-by: Paolo Bonzini commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 Author: Jakub Kicinski Date: Mon Feb 13 22:53:55 2023 -0800 net: mpls: fix stale pointer if allocation fails during device rename lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 42018a322bd453e38b3ffee294982243e50a484f Author: Pedro Tammela Date: Mon Feb 13 22:47:29 2023 -0300 net/sched: tcindex: search key must be 16 bits Syzkaller found an issue where a handle greater than 16 bits would trigger a null-ptr-deref in the imperfect hash area update. general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 5070 Comm: syz-executor456 Not tainted 6.2.0-rc7-syzkaller-00112-gc68f345b7c42 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 RIP: 0010:tcindex_set_parms+0x1a6a/0x2990 net/sched/cls_tcindex.c:509 Code: 01 e9 e9 fe ff ff 4c 8b bd 28 fe ff ff e8 0e 57 7d f9 48 8d bb a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 94 0c 00 00 48 8b 85 f8 fd ff ff 48 8b 9b a8 00 RSP: 0018:ffffc90003d3ef88 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000015 RSI: ffffffff8803a102 RDI: 00000000000000a8 RBP: ffffc90003d3f1d8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801e2b10a8 R13: dffffc0000000000 R14: 0000000000030000 R15: ffff888017b3be00 FS: 00005555569af300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056041c6d2000 CR3: 000000002bfca000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcindex_change+0x1ea/0x320 net/sched/cls_tcindex.c:572 tc_new_tfilter+0x96e/0x2220 net/sched/cls_api.c:2155 rtnetlink_rcv_msg+0x959/0xca0 net/core/rtnetlink.c:6132 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2574 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x334/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmmsg+0x18f/0x460 net/socket.c:2616 __do_sys_sendmmsg net/socket.c:2645 [inline] __se_sys_sendmmsg net/socket.c:2642 [inline] __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2642 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 Fixes: ee059170b1f7 ("net/sched: tcindex: update imperfect hash filters respecting rcu") Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reported-by: syzbot Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 11a4d6f67cf55883dc78e31c247d1903ed7feccc Author: Tung Nguyen Date: Tue Feb 14 01:26:06 2023 +0000 tipc: fix kernel warning when sending SYN message When sending a SYN message, this kernel stack trace is observed: ... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 ... [ 13.398494] Call Trace: [ 13.398630] [ 13.398630] ? __alloc_skb+0xed/0x1a0 [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc] [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290 [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __local_bh_enable_ip+0x37/0x80 [ 13.398630] tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __sys_connect+0x9f/0xd0 [ 13.398630] __sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because commit a41dad905e5a ("iov_iter: saner checks for attempt to copy to/from iterator") has introduced sanity check for copying from/to iov iterator. Lacking of copy direction from the iterator viewpoint would lead to kernel stack trace like above. This commit fixes this issue by initializing the iov iterator with the correct copy direction when sending SYN or ACK without data. Fixes: f25dcc7687d4 ("tipc: tipc ->sendmsg() conversion") Reported-by: syzbot+d43608d061e8847ec9f3@syzkaller.appspotmail.com Acked-by: Jon Maloy Signed-off-by: Tung Nguyen Link: https://lore.kernel.org/r/20230214012606.5804-1-tung.q.nguyen@dektech.com.au Signed-off-by: Jakub Kicinski commit 207ce626add80ddd941f62fc2fe5d77586e0801b Author: Miroslav Lichvar Date: Mon Feb 13 10:58:22 2023 -0800 igb: Fix PPS input and output using 3rd and 4th SDP Fix handling of the tsync interrupt to compare the pin number with IGB_N_SDP instead of IGB_N_EXTTS/IGB_N_PEROUT and fix the indexing to the perout array. Fixes: cf99c1dd7b77 ("igb: move PEROUT and EXTTS isr logic to separate functions") Reported-by: Matt Corallo Signed-off-by: Miroslav Lichvar Reviewed-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230213185822.3960072-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d3a373461f016b6fa6216b8f5a61d15ec18cce4b Merge: 2558b8039d059 43fbca02c2ddc Author: Jakub Kicinski Date: Tue Feb 14 20:41:23 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-02-13 (ice) This series contains updates to ice driver only. Michal fixes check of scheduling node weight and priority to be done against desired value, not current value. Jesse adds setting of all multicast when adding promiscuous mode to resolve traffic being lost due to filter settings. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: fix lost multicast packets in promisc mode ice: Fix check for weight and priority of a scheduling node ==================== Link: https://lore.kernel.org/r/20230213185259.3959224-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 2558b8039d059342197610498c8749ad294adee5 Author: Eric Dumazet Date: Mon Feb 13 16:00:59 2023 +0000 net: use a bounce buffer for copying skb->mark syzbot found arm64 builds would crash in sock_recv_mark() when CONFIG_HARDENED_USERCOPY=y x86 and powerpc are not detecting the issue because they define user_access_begin. This will be handled in a different patch, because a check_object_size() is missing. Only data from skb->cb[] can be copied directly to/from user space, as explained in commit 79a8a642bf05 ("net: Whitelist the skbuff_head_cache "cb" field") syzbot report was: usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_head_cache' (offset 168, size 4)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4410 Comm: syz-executor533 Not tainted 6.2.0-rc7-syzkaller-17907-g2d3827b3f393 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:90 lr : usercopy_abort+0x90/0x94 mm/usercopy.c:90 sp : ffff80000fb9b9a0 x29: ffff80000fb9b9b0 x28: ffff0000c6073400 x27: 0000000020001a00 x26: 0000000000000014 x25: ffff80000cf52000 x24: fffffc0000000000 x23: 05ffc00000000200 x22: fffffc000324bf80 x21: ffff0000c92fe1a8 x20: 0000000000000001 x19: 0000000000000004 x18: 0000000000000000 x17: 656a626f2042554c x16: ffff0000c6073dd0 x15: ffff80000dbd2118 x14: ffff0000c6073400 x13: 00000000ffffffff x12: ffff0000c6073400 x11: ff808000081bbb4c x10: 0000000000000000 x9 : 7b0572d7cc0ccf00 x8 : 7b0572d7cc0ccf00 x7 : ffff80000bf650d4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefbff08 x1 : 0000000100000000 x0 : 000000000000006c Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:90 __check_heap_object+0xa8/0x100 mm/slub.c:4761 check_heap_object mm/usercopy.c:196 [inline] __check_object_size+0x208/0x6b8 mm/usercopy.c:251 check_object_size include/linux/thread_info.h:199 [inline] __copy_to_user include/linux/uaccess.h:115 [inline] put_cmsg+0x408/0x464 net/core/scm.c:238 sock_recv_mark net/socket.c:975 [inline] __sock_recv_cmsgs+0x1fc/0x248 net/socket.c:984 sock_recv_cmsgs include/net/sock.h:2728 [inline] packet_recvmsg+0x2d8/0x678 net/packet/af_packet.c:3482 ____sys_recvmsg+0x110/0x3a0 ___sys_recvmsg net/socket.c:2737 [inline] __sys_recvmsg+0x194/0x210 net/socket.c:2767 __do_sys_recvmsg net/socket.c:2777 [inline] __se_sys_recvmsg net/socket.c:2774 [inline] __arm64_sys_recvmsg+0x2c/0x3c net/socket.c:2774 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x64/0x178 arch/arm64/kernel/syscall.c:52 el0_svc_common+0xbc/0x180 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x110 arch/arm64/kernel/syscall.c:193 el0_svc+0x58/0x14c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: 91388800 aa0903e1 f90003e8 94e6d752 (d4210000) Fixes: 6fd1d51cfa25 ("net: SO_RCVMARK socket option for SO_MARK with recvmsg()") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Erin MacNeil Reviewed-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230213160059.3829741-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a950b989ea29ab3b38ea7f6e3d2540700a3c54e8 Author: Zack Rusin Date: Sat Feb 11 00:05:14 2023 -0500 drm/vmwgfx: Do not drop the reference to the handle too soon v3: Fix vmw_user_bo_lookup which was also dropping the gem reference before the kernel was done with buffer depending on userspace doing the right thing. Same bug, different spot. It is possible for userspace to predict the next buffer handle and to destroy the buffer while it's still used by the kernel. Delay dropping the internal reference on the buffers until kernel is done with them. Instead of immediately dropping the gem reference in vmw_user_bo_lookup and vmw_gem_object_create_with_handle let the callers decide when they're ready give the control back to userspace. Also fixes the second usage of vmw_gem_object_create_with_handle in vmwgfx_surface.c which wasn't grabbing an explicit reference to the gem object which could have been destroyed by the userspace on the owning surface at any point. Signed-off-by: Zack Rusin Fixes: 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") Reviewed-by: Martin Krastev Reviewed-by: Maaz Mombasawala Link: https://patchwork.freedesktop.org/patch/msgid/20230211050514.2431155-1-zack@kde.org (cherry picked from commit 9ef8d83e8e25d5f1811b3a38eb1484f85f64296c) Cc: # v5.17+ commit 1a6897921f52ceb2c8665ef826e405bd96385159 Author: Zack Rusin Date: Wed Feb 8 13:00:50 2023 -0500 drm/vmwgfx: Stop accessing buffer objects which failed init ttm_bo_init_reserved on failure puts the buffer object back which causes it to be deleted, but kfree was still being called on the same buffer in vmw_bo_create leading to a double free. After the double free the vmw_gem_object_create_with_handle was setting the gem function objects before checking the return status of vmw_bo_create leading to null pointer access. Fix the entire path by relaying on ttm_bo_init_reserved to delete the buffer objects on failure and making sure the return status is checked before setting the gem function objects on the buffer object. Signed-off-by: Zack Rusin Fixes: 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20230208180050.2093426-1-zack@kde.org (cherry picked from commit 36d421e632e9a0e8375eaed0143551a34d81a7e3) Cc: # v5.17+ commit d5a1224aa68c8b124a4c5c390186e571815ed390 Author: Matt Roper Date: Wed Feb 1 14:28:29 2023 -0800 drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list The UNSLICE_UNIT_LEVEL_CLKGATE register programmed by this workaround has 'BUS' style reset, indicating that it does not lose its value on engine resets. Furthermore, this register is part of the GT forcewake domain rather than the RENDER domain, so it should not be impacted by RCS engine resets. As such, we should implement this on the GT workaround list rather than an engine list. Bspec: 19219 Fixes: 3551ff928744 ("drm/i915/gen11: Moving WAs to rcs_engine_wa_init()") Signed-off-by: Matt Roper Reviewed-by: Gustavo Sousa Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-2-matthew.d.roper@intel.com (cherry picked from commit 5f21dc07b52eb54a908e66f5d6e05a87bcb5b049) Signed-off-by: Rodrigo Vivi commit 0967bf837784a11c65d66060623a74e65211af0b Author: Jason Xing Date: Thu Feb 9 10:41:28 2023 +0800 ixgbe: add double of VLAN header when computing the max MTU Include the second VLAN HLEN into account when computing the maximum MTU size as other drivers do. Fixes: fabf1bce103a ("ixgbe: Prevent unsupported configurations with XDP") Signed-off-by: Jason Xing Reviewed-by: Alexander Duyck Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit ce45ffb815e8e238f05de1630be3969b6bb15e4e Author: Jason Xing Date: Wed Feb 8 10:43:33 2023 +0800 i40e: add double of VLAN header when computing the max MTU Include the second VLAN HLEN into account when computing the maximum MTU size as other drivers do. Fixes: 0c8493d90b6b ("i40e: add XDP support for pass and drop actions") Signed-off-by: Jason Xing Reviewed-by: Alexander Duyck Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit f9cd6a4418bac6a046ee78382423b1ae7565fb24 Author: Jason Xing Date: Wed Feb 8 10:43:32 2023 +0800 ixgbe: allow to increase MTU to 3K with XDP enabled Recently I encountered one case where I cannot increase the MTU size directly from 1500 to a much bigger value with XDP enabled if the server is equipped with IXGBE card, which happened on thousands of servers in production environment. After applying the current patch, we can set the maximum MTU size to 3K. This patch follows the behavior of changing MTU as i40e/ice does. References: [1] commit 23b44513c3e6 ("ice: allow 3k MTU for XDP") [2] commit 0c8493d90b6b ("i40e: add XDP support for pass and drop actions") Fixes: fabf1bce103a ("ixgbe: Prevent unsupported configurations with XDP") Signed-off-by: Jason Xing Reviewed-by: Alexander Duyck Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit e1c04510f521e853019afeca2a5991a5ef8d6a5b Merge: 82eac0c830b7d 6f098cde9df2c Author: Linus Torvalds Date: Tue Feb 14 09:38:33 2023 -0800 Merge tag 'pm-6.2-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Add a missing NULL pointer check to the cpufreq drver for Qualcomm platforms (Manivannan Sadhasivam)" * tag 'pm-6.2-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: qcom-hw: Add missing null pointer check commit 82eac0c830b7d917bd2a8806eb6ed21ef1e0f84e Merge: f6feea56f66d3 493a2c2d23ca9 Author: Linus Torvalds Date: Tue Feb 14 09:17:01 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Certain AMD processors are vulnerable to a cross-thread return address predictions bug. When running in SMT mode and one of the sibling threads transitions out of C0 state, the other thread gets access to twice as many entries in the RSB, but unfortunately the predictions of the now-halted logical processor are not purged. Therefore, the executing processor could speculatively execute from locations that the now-halted processor had trained the RSB on. The Spectre v2 mitigations cover the Linux kernel, as it fills the RSB when context switching to the idle thread. However, KVM allows a VMM to prevent exiting guest mode when transitioning out of C0 using the KVM_CAP_X86_DISABLE_EXITS capability can be used by a VMM to change this behavior. To mitigate the cross-thread return address predictions bug, a VMM must not be allowed to override the default behavior to intercept C0 transitions. These patches introduce a KVM module parameter that, if set, will prevent the user from disabling the HLT, MWAIT and CSTATE exits" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions KVM: x86: Mitigate the cross-thread return address predictions bug x86/speculation: Identify processors vulnerable to SMT RSB predictions commit 9251584af09285133bec0595e5c7218fe2e595c9 Author: Andy Chi Date: Tue Feb 14 22:04:31 2023 +0800 ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP Laptops On HP Laptops, requires the ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED quirk to make its audio LEDs and speaker work. Signed-off-by: Andy Chi Cc: Link: https://lore.kernel.org/r/20230214140432.39654-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit 6f098cde9df2c86d60db727d6270272751943674 Author: Manivannan Sadhasivam Date: Tue Feb 14 15:11:15 2023 +0530 cpufreq: qcom-hw: Add missing null pointer check of_device_get_match_data() may return NULL, so add a check to prevent potential null pointer dereference. Issue reported by Qualcomm's internal static analysis tool. Fixes: 4f7961706c63 ("cpufreq: qcom-hw: Move soc_data to struct qcom_cpufreq") Signed-off-by: Manivannan Sadhasivam Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 5007b848ff2234ff7ea55755cb315766888988da Author: Andy Chi Date: Tue Feb 14 11:58:51 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform. There is a HP platform needs ALC236_FIXUP_HP_GPIO_LED quirk to make mic-mute/audio-mute working. Signed-off-by: Andy Chi Cc: Link: https://lore.kernel.org/r/20230214035853.31217-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit d125d1349abeb46945dc5e98f7824bf688266f13 Author: Thomas Gleixner Date: Thu Feb 9 23:25:49 2023 +0100 alarmtimer: Prevent starvation by small intervals and SIG_IGN syzbot reported a RCU stall which is caused by setting up an alarmtimer with a very small interval and ignoring the signal. The reproducer arms the alarm timer with a relative expiry of 8ns and an interval of 9ns. Not a problem per se, but that's an issue when the signal is ignored because then the timer is immediately rearmed because there is no way to delay that rearming to the signal delivery path. See posix_timer_fn() and commit 58229a189942 ("posix-timers: Prevent softirq starvation by small intervals and SIG_IGN") for details. The reproducer does not set SIG_IGN explicitely, but it sets up the timers signal with SIGCONT. That has the same effect as explicitely setting SIG_IGN for a signal as SIGCONT is ignored if there is no handler set and the task is not ptraced. The log clearly shows that: [pid 5102] --- SIGCONT {si_signo=SIGCONT, si_code=SI_TIMER, si_timerid=0, si_overrun=316014, si_int=0, si_ptr=NULL} --- It works because the tasks are traced and therefore the signal is queued so the tracer can see it, which delays the restart of the timer to the signal delivery path. But then the tracer is killed: [pid 5087] kill(-5102, SIGKILL ... ./strace-static-x86_64: Process 5107 detached and after it's gone the stall can be observed: syzkaller login: [ 79.439102][ C0] hrtimer: interrupt took 68471 ns [ 184.460538][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: ... [ 184.658237][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 184.664574][ C1] Sending NMI from CPU 1 to CPUs 0: [ 184.669821][ C0] NMI backtrace for cpu 0 [ 184.669831][ C0] CPU: 0 PID: 5108 Comm: syz-executor192 Not tainted 6.2.0-rc6-next-20230203-syzkaller #0 ... [ 184.670036][ C0] Call Trace: [ 184.670041][ C0] [ 184.670045][ C0] alarmtimer_fired+0x327/0x670 posix_timer_fn() prevents that by checking whether the interval for timers which have the signal ignored is smaller than a jiffie and artifically delay it by shifting the next expiry out by a jiffie. That's accurate vs. the overrun accounting, but slightly inaccurate vs. timer_gettimer(2). The comment in that function says what needs to be done and there was a fix available for the regular userspace induced SIG_IGN mechanism, but that did not work due to the implicit ignore for SIGCONT and similar signals. This needs to be worked on, but for now the only available workaround is to do exactly what posix_timer_fn() does: Increase the interval of self-rearming timers, which have their signal ignored, to at least a jiffie. Interestingly this has been fixed before via commit ff86bf0c65f1 ("alarmtimer: Rate limit periodic intervals") already, but that fix got lost in a later rework. Reported-by: syzbot+b9564ba6e8e00694511b@syzkaller.appspotmail.com Fixes: f2c45807d399 ("alarmtimer: Switch over to generic set/get/rearm routine") Signed-off-by: Thomas Gleixner Acked-by: John Stultz Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87k00q1no2.ffs@tglx commit f9f57da2c2d119dbf109e3f6e1ceab7659294046 Author: Juergen Gross Date: Thu Feb 9 08:22:17 2023 +0100 x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case") Commit 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case") broke the use case of running Xen dom0 kernels on machines with an external disk enclosure attached via USB, see Link tag. What this commit was originally fixing - SEV-SNP guests on Hyper-V - is a more specialized situation which has other issues at the moment anyway so reverting this now and addressing the issue properly later is the prudent thing to do. So revert it in time for the 6.2 proper release. [ bp: Rewrite commit message. ] Reported-by: Christian Kujau Tested-by: Christian Kujau Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/4fe9541e-4d4c-2b2a-f8c8-2d34a7284930@nerdbynature.de commit 05d7623a892a9da62da0e714428e38f09e4a64d8 Author: Cristian Ciocaltea Date: Fri Feb 10 22:21:26 2023 +0200 net: stmmac: Restrict warning on disabling DMA store and fwd mode When setting 'snps,force_thresh_dma_mode' DT property, the following warning is always emitted, regardless the status of force_sf_dma_mode: dwmac-starfive 10020000.ethernet: force_sf_dma_mode is ignored if force_thresh_dma_mode is set. Do not print the rather misleading message when DMA store and forward mode is already disabled. Fixes: e2a240c7d3bc ("driver:net:stmmac: Disable DMA store and forward mode if platform data force_thresh_dma_mode is set.") Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20230210202126.877548-1-cristian.ciocaltea@collabora.com Signed-off-by: Paolo Abeni commit dc785d69d753a3894c93afc23b91404652382ead Author: Irvin Cote Date: Thu Feb 9 17:43:57 2023 -0300 nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev Don't mix NULL and ERR_PTR returns. Fixes: 2e87570be9d2 ("nvme-pci: factor out a nvme_pci_alloc_dev helper") Signed-off-by: Irvin Cote Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 924bd96ea27d53706147a94b8e576080535785df Author: Christoph Hellwig Date: Mon Feb 13 06:58:33 2023 +0100 nvme-pci: set the DMA mask earlier Set the DMA mask before calling dma_addressing_limited, which depends on it. Note that this stop checking the return value of dma_set_mask_and_coherent as this function can only fail for masks < 32-bit. Fixes: 3f30a79c2e2c ("nvme-pci: set constant paramters in nvme_pci_alloc_ctrl") Reported-by: Michael Kelley Signed-off-by: Christoph Hellwig Reviewed-by: Jens Axboe Reviewed-by: Sagi Grimberg Tested-by: Michael Kelley commit 21c167aa0ba943a7cac2f6969814f83bb701666b Author: Pedro Tammela Date: Fri Feb 10 17:08:25 2023 -0300 net/sched: act_ctinfo: use percpu stats The tc action act_ctinfo was using shared stats, fix it to use percpu stats since bstats_update() must be called with locks or with a percpu pointer argument. tdc results: 1..12 ok 1 c826 - Add ctinfo action with default setting ok 2 0286 - Add ctinfo action with dscp ok 3 4938 - Add ctinfo action with valid cpmark and zone ok 4 7593 - Add ctinfo action with drop control ok 5 2961 - Replace ctinfo action zone and action control ok 6 e567 - Delete ctinfo action with valid index ok 7 6a91 - Delete ctinfo action with invalid index ok 8 5232 - List ctinfo actions ok 9 7702 - Flush ctinfo actions ok 10 3201 - Add ctinfo action with duplicate index ok 11 8295 - Add ctinfo action with invalid index ok 12 3964 - Replace ctinfo action with invalid goto_chain control Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Larysa Zaremba Link: https://lore.kernel.org/r/20230210200824.444856-1-pctammela@mojatatu.com Signed-off-by: Jakub Kicinski commit 4562c65ec852067c6196abdcf2d925f08841dcbc Author: Johannes Zink Date: Fri Feb 10 15:39:37 2023 +0100 net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence So far changing the period by just setting new period values while running did not work. The order as indicated by the publicly available reference manual of the i.MX8MP [1] indicates a sequence: * initiate the programming sequence * set the values for PPS period and start time * start the pulse train generation. This is currently not used in dwmac5_flex_pps_config(), which instead does: * initiate the programming sequence and immediately start the pulse train generation * set the values for PPS period and start time This caused the period values written not to take effect until the FlexPPS output was disabled and re-enabled again. This patch fix the order and allows the period to be set immediately. [1] https://www.nxp.com/webapp/Download?colCode=IMX8MPRM Fixes: 9a8a02c9d46d ("net: stmmac: Add Flexible PPS support") Signed-off-by: Johannes Zink Link: https://lore.kernel.org/r/20230210143937.3427483-1-j.zink@pengutronix.de Signed-off-by: Jakub Kicinski commit 1aff53b2fd903b300dfd71af0064c21fbca313c6 Author: Randy Dunlap Date: Mon Feb 13 13:25:49 2023 -0800 ata: pata_octeon_cf: drop kernel-doc notation Fix a slew of kernel-doc warnings in pata_octeon_cf.c by changing all "/**" comments to "/*" since they are not in kernel-doc format. Fixes: 3c929c6f5aa7 ("libata: New driver for OCTEON SOC Compact Flash interface (v7).") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Link: https://lore.kernel.org/all/202302101722.5O56RClE-lkp@intel.com/ Cc: David Daney Cc: Damien Le Moal Cc: Mauro Carvalho Chehab Cc: linux-ide@vger.kernel.org Signed-off-by: Damien Le Moal commit 104ff59af73aba524e57ae0fef70121643ff270e Author: Simon Gaiser Date: Mon Feb 13 11:24:49 2023 +0100 ata: ahci: Add Tiger Lake UP{3,4} AHCI controller Mark the Tiger Lake UP{3,4} AHCI controller as "low_power". This enables S0ix to work out of the box. Otherwise this isn't working unless the user manually sets /sys/class/scsi_host/*/link_power_management_policy. Intel lists a total of 4 SATA controller IDs in [1] for those mobile PCHs. This commit just adds the "AHCI" variant since I only tested those. [1]: https://cdrdv2.intel.com/v1/dl/getContent/631119 Signed-off-by: Simon Gaiser CC: stable@vger.kernel.org Signed-off-by: Damien Le Moal commit ead089577e0f55b238f980d9f62eaa90b7b64672 Author: Patrick McLean Date: Fri Feb 10 13:51:51 2023 -0800 ata: libata-core: Disable READ LOG DMA EXT for Samsung MZ7LH Samsung MZ7LH drives are spewing messages like this in to dmesg with AMD SATA controllers: ata1.00: exception Emask 0x0 SAct 0x7e0000 SErr 0x0 action 0x6 frozen ata1.00: failed command: SEND FPDMA QUEUED ata1.00: cmd 64/01:88:00:00:00/00:00:00:00:00/a0 tag 17 ncq dma 512 out res 40/00:01:01:4f:c2/00:00:00:00:00/00 Emask 0x4 (timeout) Since this was seen previously with SSD 840 EVO drives in https://bugzilla.kernel.org/show_bug.cgi?id=203475 let's add the same fix for these drives as the EVOs have, since they likely have very similar firmwares. Signed-off-by: Patrick McLean Signed-off-by: Damien Le Moal commit 3f18c5046e633cc4bbad396b74c05d46d353033d Author: Paul Cercueil Date: Tue Jan 31 21:02:28 2023 +0000 mmc: jz4740: Work around bug on JZ4760(B) On JZ4760 and JZ4760B, SD cards fail to run if the maximum clock rate is set to 50 MHz, even though the controller officially does support it. Until the actual bug is found and fixed, limit the maximum clock rate to 24 MHz. Signed-off-by: Paul Cercueil Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230131210229.68129-1-paul@crapouillou.net Signed-off-by: Ulf Hansson commit cf4c9d2ac1e42c7d18b921bec39486896645b714 Author: Yang Yingliang Date: Tue Jan 31 09:38:35 2023 +0800 mmc: mmc_spi: fix error handling in mmc_spi_probe() If mmc_add_host() fails, it doesn't need to call mmc_remove_host(), or it will cause null-ptr-deref, because of deleting a not added device in mmc_remove_host(). To fix this, goto label 'fail_glue_init', if mmc_add_host() fails, and change the label 'fail_add_host' to 'fail_gpiod_request'. Fixes: 15a0580ced08 ("mmc_spi host driver") Signed-off-by: Yang Yingliang Cc:stable@vger.kernel.org Link: https://lore.kernel.org/r/20230131013835.3564011-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 605d9fb9556f8f5fb4566f4df1480f280f308ded Author: Yang Yingliang Date: Mon Jan 30 20:58:08 2023 +0800 mmc: sdio: fix possible resource leaks in some error paths If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can not release the resources, because the sdio function is not presented in these two cases, it won't call of_node_put() or put_device(). To fix these leaks, make sdio_func_present() only control whether device_del() needs to be called or not, then always call of_node_put() and put_device(). In error case in sdio_init_func(), the reference of 'card->dev' is not get, to avoid redundant put in sdio_free_func_cis(), move the get_device() to sdio_alloc_func() and put_device() to sdio_release_func(), it can keep the get/put function be balanced. Without this patch, while doing fault inject test, it can get the following leak reports, after this fix, the leak is gone. unreferenced object 0xffff888112514000 (size 2048): comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s) hex dump (first 32 bytes): 00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff ..o.....`X...... 10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff .@Q......@Q..... backtrace: [<000000009e5931da>] kmalloc_trace+0x21/0x110 [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core] [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core] [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core] [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] unreferenced object 0xffff888112511000 (size 2048): comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s) hex dump (first 32 bytes): 00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff .@Q......X...... 10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff ..Q.......Q..... backtrace: [<000000009e5931da>] kmalloc_trace+0x21/0x110 [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core] [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core] [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] Fixes: 3d10a1ba0d37 ("sdio: fix reference counting in sdio_remove_func()") Signed-off-by: Yang Yingliang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230130125808.3471254-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 6ea6b95a7e3ec2015954cb514ee9dbc6dc80ec8f Author: Heiner Kallweit Date: Mon Feb 13 21:55:56 2023 +0100 mmc: meson-gx: fix SDIO mode if cap_sdio_irq isn't set Some SDIO WiFi modules stopped working after SDIO interrupt mode was added if cap_sdio_irq isn't set in device tree. This patch was confirmed to fix the issue. Fixes: 066ecde6d826 ("mmc: meson-gx: add SDIO interrupt support") Reported-by: Geraldo Nascimento Tested-by: Geraldo Nascimento Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/816cba9f-ff92-31a2-60f0-aca542d1d13e@gmail.com Signed-off-by: Ulf Hansson commit f6feea56f66d34259c4222fa02e8171c4f2673d1 Merge: b408817d48840 ce4d9a1ea35ac Author: Linus Torvalds Date: Mon Feb 13 14:09:20 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-02-13-13-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Twelve hotfixes, mostly against mm/. Five of these fixes are cc:stable" * tag 'mm-hotfixes-stable-2023-02-13-13-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem scripts/gdb: fix 'lx-current' for x86 lib: parser: optimize match_NUMBER apis to use local array mm: shrinkers: fix deadlock in shrinker debugfs mm: hwpoison: support recovery from ksm_might_need_to_copy() kasan: fix Oops due to missing calls to kasan_arch_is_ready() revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" fsdax: dax_unshare_iter() should return a valid length mm/gup: add folio to list when folio_isolate_lru() succeed aio: fix mremap after fork null-deref mailmap: add entry for Alexander Mikhalitsyn mm: extend max struct page size for kmsan commit 43fbca02c2ddc39ff5879b6f3a4a097b1ba02098 Author: Jesse Brandeburg Date: Mon Feb 6 15:54:36 2023 -0800 ice: fix lost multicast packets in promisc mode There was a problem reported to us where the addition of a VF with an IPv6 address ending with a particular sequence would cause the parent device on the PF to no longer be able to respond to neighbor discovery packets. In this case, we had an ovs-bridge device living on top of a VLAN, which was on top of a PF, and it would not be able to talk anymore (the neighbor entry would expire and couldn't be restored). The root cause of the issue is that if the PF is asked to be in IFF_PROMISC mode (promiscuous mode) and it had an ipv6 address that needed the 33:33:ff:00:00:04 multicast address to work, then when the VF was added with the need for the same multicast address, the VF would steal all the traffic destined for that address. The ice driver didn't auto-subscribe a request of IFF_PROMISC to the "multicast replication from other port's traffic" meaning that it won't get for instance, packets with an exact destination in the VF, as above. The VF's IPv6 address, which adds a "perfect filter" for 33:33:ff:00:00:04, results in no packets for that multicast address making it to the PF (which is in promisc but NOT "multicast replication"). The fix is to enable "multicast promiscuous" whenever the driver is asked to enable IFF_PROMISC, and make sure to disable it when appropriate. Fixes: e94d44786693 ("ice: Implement filter sync, NDO operations and bump version") Signed-off-by: Jesse Brandeburg Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 3e6dc119a37bceb06e1d595b1d41b52f3e99132d Author: Michal Wilczynski Date: Wed Jan 25 12:37:40 2023 +0100 ice: Fix check for weight and priority of a scheduling node Currently checks for weight and priority ranges don't check incoming value from the devlink. Instead it checks node current weight or priority. This makes those checks useless. Change range checks in ice_set_object_tx_priority() and ice_set_object_tx_weight() to check against incoming priority an weight. Fixes: 42c2eb6b1f43 ("ice: Implement devlink-rate API") Signed-off-by: Michal Wilczynski Acked-by: Jesse Brandeburg Reviewed-by: Paul Menzel Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b408817d48840847c00052ae0e02a54311913073 Merge: ceaa837f96adb eb4b55f2f26fc Author: Linus Torvalds Date: Mon Feb 13 08:29:06 2023 -0800 Merge tag 'platform-drivers-x86-v6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fix from Hans de Goede: "Intel vsec driver Meteor Lake PCI ids addition" * tag 'platform-drivers-x86-v6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel/vsec: Add support for Meteor Lake commit bb2ff6c27bc9e1da4d3ec5e7b1d6b9df1092cb5a Author: Ville Syrjälä Date: Tue Feb 7 16:33:37 2023 +0200 drm: Disable dynamic debug as broken CONFIG_DRM_USE_DYNAMIC_DEBUG breaks debug prints for (at least modular) drm drivers. The debug prints can be reinstated by manually frobbing /sys/module/drm/parameters/debug after the fact, but at that point the damage is done and all debugs from driver probe are lost. This makes drivers totally undebuggable. There's a more complete fix in progress [1], with further details, but we need this fixed in stable kernels. Mark the feature as broken and disable it by default, with hopes distros follow suit and disable it as well. [1] https://lore.kernel.org/r/20230125203743.564009-1-jim.cromie@gmail.com Fixes: 84ec67288c10 ("drm_print: wrap drm_*_dbg in dyndbg descriptor factory macro") Cc: Jim Cromie Cc: Greg Kroah-Hartman Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v6.1+ Signed-off-by: Ville Syrjälä Acked-by: Greg Kroah-Hartman Acked-by: Jim Cromie Acked-by: Maxime Ripard Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230207143337.2126678-1-jani.nikula@intel.com commit df14b7f9efcda35e59bb6f50351aac25c50f6e24 Author: Waiman Long Date: Fri Feb 3 13:18:49 2023 -0500 sched/core: Fix a missed update of user_cpus_ptr Since commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask"), a successful call to sched_setaffinity() should always save the user requested cpu affinity mask in a task's user_cpus_ptr. However, when the given cpu mask is the same as the current one, user_cpus_ptr is not updated. Fix this by saving the user mask in this case too. Fixes: 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230203181849.221943-1-longman@redhat.com commit eedeb787ebb53de5c5dcf7b7b39d01bf1b0f037d Author: Peter Zijlstra Date: Fri Feb 3 15:31:11 2023 +0100 freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL Tetsuo-San noted that commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") broke call_usermodehelper_exec() for the KILLABLE case. Specifically it was missed that the second, unconditional, wait_for_completion() was not optional and ensures the on-stack completion is unused before going out-of-scope. Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Reported-by: syzbot+6cd18e123583550cf469@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Debugged-by: Tetsuo Handa Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/Y90ar35uKQoUrLEK@hirez.programming.kicks-ass.net commit 2b129f0b24ab578b02901b4a1744b7f97399faa0 Author: Reinette Chatre Date: Thu Feb 9 13:49:00 2023 -0800 PCI/MSI: Provide missing stubs for CONFIG_PCI_MSI=n pci_msix_alloc_irq_at() and pci_msix_free_irq() are not declared when CONFIG_PCI_MSI is disabled. Users of these two calls do not yet exist but when users do appear (shown below is an attempt to use the new API in vfio-pci) the following errors will be encountered when compiling with CONFIG_PCI_MSI disabled: drivers/vfio/pci/vfio_pci_intrs.c:461:4: error: implicit declaration of\ function 'pci_msix_free_irq' is invalid in C99\ [-Werror,-Wimplicit-function-declaration] pci_msix_free_irq(pdev, msix_map); ^ drivers/vfio/pci/vfio_pci_intrs.c:511:15: error: implicit declaration of\ function 'pci_msix_alloc_irq_at' is invalid in C99\ [-Werror,-Wimplicit-function-declaration] msix_map = pci_msix_alloc_irq_at(pdev, vector, NULL); Provide definitions for pci_msix_alloc_irq_at() and pci_msix_free_irq() in preparation for users that need to compile when CONFIG_PCI_MSI is disabled. Reported-by: kernel test robot Fixes: 34026364df8e ("PCI/MSI: Provide post-enable dynamic allocation interfaces for MSI-X") Signed-off-by: Reinette Chatre Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/158e40e1cfcfc58ae30ecb2bbfaf86e5bba7a1ef.1675978686.git.reinette.chatre@intel.com commit 2038cc592811209de20c4e094ca08bfb1e6fbc6c Author: Michael Chan Date: Fri Feb 10 12:31:55 2023 -0500 bnxt_en: Fix mqprio and XDP ring checking logic In bnxt_reserve_rings(), there is logic to check that the number of TX rings reserved is enough to cover all the mqprio TCs, but it fails to account for the TX XDP rings. So the check will always fail if there are mqprio TCs and TX XDP rings. As a result, the driver always fails to initialize after the XDP program is attached and the device will be brought down. A subsequent ifconfig up will also fail because the number of TX rings is set to an inconsistent number. Fix the check to properly account for TX XDP rings. If the check fails, set the number of TX rings back to a consistent number after calling netdev_reset_tc(). Fixes: 674f50a5b026 ("bnxt_en: Implement new method to reserve rings.") Reviewed-by: Hongguang Gao Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 9b55d3f0a69af649c62cbc2633e6d695bb3cc583 Author: Felix Riemann Date: Fri Feb 10 13:36:44 2023 +0100 net: Fix unwanted sign extension in netdev_stats_to_stats64() When converting net_device_stats to rtnl_link_stats64 sign extension is triggered on ILP32 machines as 6c1c509778 changed the previous "ulong -> u64" conversion to "long -> u64" by accessing the net_device_stats fields through a (signed) atomic_long_t. This causes for example the received bytes counter to jump to 16EiB after having received 2^31 bytes. Casting the atomic value to "unsigned long" beforehand converting it into u64 avoids this. Fixes: 6c1c5097781f ("net: add atomic_long_t to net_device_stats fields") Signed-off-by: Felix Riemann Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit c68f345b7c425b38656e1791a0486769a8797016 Author: Miko Larsson Date: Fri Feb 10 09:13:44 2023 +0100 net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed in the second error path would be the value of act_len from the first call to usb_bulk_msg.[1] With this in mind, let's just not pass act_len to the usb_bulk_msg error paths. 1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/ Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730") Reported-and-tested-by: syzbot+cd80c5ef5121bfe85b55@syzkaller.appspotmail.com Signed-off-by: Miko Larsson Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller commit 2fa28f5c6fcbfc794340684f36d2581b4f2d20b5 Author: Hangyu Hua Date: Fri Feb 10 10:05:51 2023 +0800 net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() old_meter needs to be free after it is detached regardless of whether the new meter is successfully attached. Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number") Signed-off-by: Hangyu Hua Acked-by: Eelco Chaudron Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2f4796518315ab246638db8feebfcb494212e7ee Author: Hyunwoo Kim Date: Thu Feb 9 01:16:48 2023 -0800 af_key: Fix heap information leak Since x->encap of pfkey_msg2xfrm_state() is not initialized to 0, kernel heap data can be leaked. Fix with kzalloc() to prevent this. Signed-off-by: Hyunwoo Kim Acked-by: Herbert Xu Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 2bdccfd290d421b50df4ec6a68d832dad1310748 Author: Kailang Yang Date: Mon Feb 13 14:54:22 2023 +0800 ALSA: hda/realtek - fixed wrong gpio assigned GPIO2 PIN use for output. Mask Dir and Data need to assign for 0x4. Not 0x3. This fixed was for Lenovo Desktop(0x17aa1056). GPIO2 use for AMP enable. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/8d02bb9ac8134f878cd08607fdf088fd@realtek.com Signed-off-by: Takashi Iwai commit 5f69f009b7c445ddd219609c0085825c6270415a Author: Daniel Wagner Date: Wed Feb 8 17:14:35 2023 +0100 nvme-pci: add bogus ID quirk for ADATA SX6000PNP Yet another device which needs a quirk: nvme nvme1: globally duplicate IDs for nsid 1 nvme nvme1: VID:DID 10ec:5763 model:ADATA SX6000PNP firmware:V9002s94 Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1207827 Reported-by: Gustavo Freitas Signed-off-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit 70b5339caf847b8b6097b6dfab0c5a99b40713c8 Author: Steven Rostedt (Google) Date: Sun Feb 12 20:11:42 2023 -0500 tracing: Make trace_define_field_ext() static trace_define_field_ext() is not used outside of trace_events.c, it should be static. Link: https://lore.kernel.org/oe-kbuild-all/202302130750.679RaRog-lkp@intel.com/ Fixes: b6c7abd1c28a ("tracing: Fix TASK_COMM_LEN in trace event format file") Reported-by: Reported-by: kernel test robot Signed-off-by: Steven Rostedt (Google) commit ceaa837f96adb69c0df0397937cd74991d5d821a Author: Linus Torvalds Date: Sun Feb 12 14:10:17 2023 -0800 Linux 6.2-rc8 commit 80510b63f7b6bdd30e07b3a42115d0a324e20cd6 Author: John Paul Adrian Glaubitz Date: Tue Feb 7 17:57:15 2023 +0100 MAINTAINERS: Add myself as maintainer for arch/sh (SUPERH) Both Rich Felker and Yoshinori Sato haven't done any work on arch/sh for a while. As I have been maintaining Debian's sh4 port since 2014, I am interested to keep the architecture alive. Signed-off-by: John Paul Adrian Glaubitz Acked-by: Yoshinori Sato Acked-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 5e98e916f95bdc50e90f3199d7f3d74b94fa5976 Merge: 711e9a4d52bf4 b6c7abd1c28a6 Author: Linus Torvalds Date: Sun Feb 12 13:52:17 2023 -0800 Merge tag 'trace-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "Fix showing of TASK_COMM_LEN instead of its value The TASK_COMM_LEN was converted from a macro into an enum so that BTF would have access to it. But this unfortunately caused TASK_COMM_LEN to display in the format fields of trace events, as they are created by the TRACE_EVENT() macro and such, macros convert to their values, where as enums do not. To handle this, instead of using the field itself to be display, save the value of the array size as another field in the trace_event_fields structure, and use that instead. Not only does this fix the issue, but also converts the other trace events that have this same problem (but were not breaking tooling). With this change, the original work around b3bc8547d3be6 ("tracing: Have TRACE_DEFINE_ENUM affect trace event types as well") could be reverted (but that should be done in the merge window)" * tag 'trace-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix TASK_COMM_LEN in trace event format file commit 711e9a4d52bf4e477e51c7135e1e6188c42018d0 Merge: e2bca0ebf7754 5f58d783fd782 Author: Linus Torvalds Date: Sun Feb 12 11:26:36 2023 -0800 Merge tag 'for-6.2-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - one more fix for a tree-log 'write time corruption' report, update the last dir index directly and don't keep in the log context - do VFS-level inode lock around FIEMAP to prevent a deadlock with concurrent fsync, the extent-level lock is not sufficient - don't cache a single-device filesystem device to avoid cases when a loop device is reformatted and the entry gets stale * tag 'for-6.2-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: free device in btrfs_close_devices for a single device filesystem btrfs: lock the inode in shared mode before starting fiemap btrfs: simplify update of last_dir_index_offset when logging a directory commit e2bca0ebf775453bb3c6b9c2149fb4712621493a Merge: dd78af9fde7ae 303e724d7b1e1 Author: Linus Torvalds Date: Sun Feb 12 11:18:57 2023 -0800 Merge tag 'usb-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are 2 small USB driver fixes that resolve some reported regressions and one new device quirk. Specifically these are: - new quirk for Alcor Link AK9563 smartcard reader - revert of u_ether gadget change in 6.2-rc1 that caused problems - typec pin probe fix All of these have been in linux-next with no reported problems" * tag 'usb-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: core: add quirk for Alcor Link AK9563 smartcard reader usb: typec: altmodes/displayport: Fix probe pin assign check Revert "usb: gadget: u_ether: Do not make UDC parent of the net device" commit dd78af9fde7aeae427adf4bac6cf62ed84e8f898 Merge: 49a0bdb0a38e2 190233164cd77 Author: Linus Torvalds Date: Sun Feb 12 11:13:29 2023 -0800 Merge tag 'efi-fixes-for-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: "A fix from Darren to widen the SMBIOS match for detecting Ampere Altra machines with problematic firmware. In the mean time, we are working on a more precise check, but this is still work in progress" * tag 'efi-fixes-for-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: arm64: efi: Force the use of SetVirtualAddressMap() on eMAG and Altra Max machines commit 49a0bdb0a38e222d35c50644468856e2408764f0 Merge: 462a8e08e0e62 2ea31e2e62bbc Author: Linus Torvalds Date: Sun Feb 12 11:08:15 2023 -0800 Merge tag 'powerpc-6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix interrupt exit race with security mitigation switching. - Don't select ARCH_WANTS_NO_INSTR until warnings are fixed. - Build fix for CONFIG_NUMA=n. Thanks to Nicholas Piggin, Randy Dunlap, and Sachin Sant. * tag 'powerpc-6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch powerpc/kexec_file: fix implicit decl error powerpc: Don't select ARCH_WANTS_NO_INSTR commit 462a8e08e0e6287e5ce13187257edbf24213ed03 Author: David Chen Date: Thu Feb 9 17:48:28 2023 +0000 Fix page corruption caused by racy check in __free_pages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca flags: 0x17ffffc0000000() raw: 0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount CPU: 0 PID: 15567 Comm: ganesha.nfsd Kdump: loaded Tainted: P B O 5.10.158-1.nutanix.20221209.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 Call Trace: dump_stack+0x74/0x96 bad_page.cold+0x63/0x94 check_new_page_bad+0x6d/0x80 rmqueue+0x46e/0x970 get_page_from_freelist+0xcb/0x3f0 ? _cond_resched+0x19/0x40 __alloc_pages_nodemask+0x164/0x300 alloc_pages_current+0x87/0xf0 skb_page_frag_refill+0x84/0x110 ... Sometimes, it would also show up as corruption in the free list pointer and cause crashes. After bisecting the issue, we found the issue started from commit e320d3012d25 ("mm/page_alloc.c: fix freeing non-compound pages"): if (put_page_testzero(page)) free_the_page(page, order); else if (!PageHead(page)) while (order-- > 0) free_the_page(page + (1 << order), order); So the problem is the check PageHead is racy because at this point we already dropped our reference to the page. So even if we came in with compound page, the page can already be freed and PageHead can return false and we will end up freeing all the tail pages causing double free. Fixes: e320d3012d25 ("mm/page_alloc.c: fix freeing non-compound pages") Link: https://lore.kernel.org/lkml/BYAPR02MB448855960A9656EEA81141FC94D99@BYAPR02MB4488.namprd02.prod.outlook.com/ Cc: Andrew Morton Cc: stable@vger.kernel.org Signed-off-by: Chunwei Chen Reviewed-by: Vlastimil Babka Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Linus Torvalds commit b6c7abd1c28a63ad633433d037ee15a1bc3023ba Author: Yafang Shao Date: Sun Feb 12 15:13:03 2023 +0000 tracing: Fix TASK_COMM_LEN in trace event format file After commit 3087c61ed2c4 ("tools/testing/selftests/bpf: replace open-coded 16 with TASK_COMM_LEN"), the content of the format file under /sys/kernel/tracing/events/task/task_newtask was changed from field:char comm[16]; offset:12; size:16; signed:0; to field:char comm[TASK_COMM_LEN]; offset:12; size:16; signed:0; John reported that this change breaks older versions of perfetto. Then Mathieu pointed out that this behavioral change was caused by the use of __stringify(_len), which happens to work on macros, but not on enum labels. And he also gave the suggestion on how to fix it: :One possible solution to make this more robust would be to extend :struct trace_event_fields with one more field that indicates the length :of an array as an actual integer, without storing it in its stringified :form in the type, and do the formatting in f_show where it belongs. The result as follows after this change, $ cat /sys/kernel/tracing/events/task/task_newtask/format field:char comm[16]; offset:12; size:16; signed:0; Link: https://lore.kernel.org/lkml/Y+QaZtz55LIirsUO@google.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230210155921.4610-1-laoar.shao@gmail.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230212151303.12353-1-laoar.shao@gmail.com Cc: stable@vger.kernel.org Cc: Alexei Starovoitov Cc: Kajetan Puchalski CC: Qais Yousef Fixes: 3087c61ed2c4 ("tools/testing/selftests/bpf: replace open-coded 16 with TASK_COMM_LEN") Reported-by: John Stultz Debugged-by: Mathieu Desnoyers Suggested-by: Mathieu Desnoyers Suggested-by: Steven Rostedt Signed-off-by: Yafang Shao Signed-off-by: Steven Rostedt (Google) commit f339c2597ebb00e738f2b6328c14804ed19f5d57 Merge: 47e9aa14ce5ab eede42c9459b5 Author: Linus Torvalds Date: Sat Feb 11 16:39:05 2023 -0800 Merge tag 'spi-fix-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of hopefully final fixes for spi: one driver specific fix for an issue with very large transfers and a fix for an issue with the locking fixes in spidev merged earlier this release cycle which was missed" * tag 'spi-fix-v6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spidev: fix a recursive locking error spi: dw: Fix wrong FIFO level setting for long xfers commit 47e9aa14ce5abca70d6584a8d8213707d197c38e Merge: 338c84730406c f545e8831e700 Author: Linus Torvalds Date: Sat Feb 11 11:17:21 2023 -0800 Merge tag 'x86-urgent-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Fix a kprobes bug, plus add a new Intel model number to the upstream header for drivers to use" * tag 'x86-urgent-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Add Lunar Lake M x86/kprobes: Fix 1 byte conditional jump target commit 338c84730406c30185d54b565d670e7e7c96967b Merge: d12aca5c0cee0 db370a8b9f67a Author: Linus Torvalds Date: Sat Feb 11 11:11:18 2023 -0800 Merge tag 'locking-urgent-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix an rtmutex missed-wakeup bug" * tag 'locking-urgent-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rtmutex: Ensure that the top waiter is always woken up commit d12aca5c0cee0da197ca55241bcc5ec55dd5ae58 Merge: 95232dd9ae13d 711442e29f16f Author: Linus Torvalds Date: Sat Feb 11 11:03:25 2023 -0800 Merge tag 'cxl-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dan Williams: "Two fixups for CXL (Compute Express Link) in presence of passthrough decoders. This primarily helps developers using the QEMU CXL emulation, but with the impending arrival of CXL switches these types of topologies will be of interest to end users. - Fix a crash when shutting down regions in the presence of passthrough decoders - Fix region creation to understand passthrough decoders instead of the narrower definition of passthrough ports" * tag 'cxl-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/region: Fix passthrough-decoder detection cxl/region: Fix null pointer dereference for resetting decoder commit 95232dd9ae13d6bb52ebd0c295e5dde30acd0d02 Merge: 230809c145091 c91d713630848 Author: Linus Torvalds Date: Sat Feb 11 10:58:36 2023 -0800 Merge tag 'libnvdimm-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A fix for an issue that could causes users to inadvertantly reserve too much capacity when debugging the KMSAN and persistent memory namespace, a lockdep fix, and a kernel-doc build warning: - Resolve the conflict between KMSAN and NVDIMM with respect to reserving pmem namespace / volume capacity for larger sizeof(struct page) - Fix a lockdep warning in the the NFIT code - Fix a kernel-doc build warning" * tag 'libnvdimm-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Support sizeof(struct page) > MAX_STRUCT_PAGE_SIZE ACPI: NFIT: fix a potential deadlock during NFIT teardown dax: super.c: fix kernel-doc bad line warning commit 230809c145091e5cfd948bd2db98e67a1a0571de Merge: 420b2d431d18a 647037adcad00 Author: Linus Torvalds Date: Sat Feb 11 10:51:45 2023 -0800 Merge tag 'fixes-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock revert from Mike Rapoport: "Revert 'mm: Always release pages to the buddy allocator in memblock_free_late()' The pages being freed by memblock_free_late() have already been initialized, but if they are in the deferred init range, __free_one_page() might access nearby uninitialized pages when trying to coalesce buddies, which will cause a crash. A proper fix will be more involved so revert this change for the time being" * tag 'fixes-2023-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." commit 4102db175b5d884d133270fdbd0e59111ce688fc Author: Jeff Layton Date: Sat Feb 11 07:50:08 2023 -0500 nfsd: don't destroy global nfs4_file table in per-net shutdown The nfs4_file table is global, so shutting it down when a containerized nfsd is shut down is wrong and can lead to double-frees. Tear down the nfs4_file_rhltable in nfs4_state_shutdown instead of nfs4_state_shutdown_net. Fixes: d47b295e8d76 ("NFSD: Use rhashtable for managing nfs4_file objects") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2169017 Reported-by: JianHong Yin Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 3af4a4f7a20c94009adba65764fa5a0269d70a82 Author: Cezary Rojewski Date: Fri Feb 10 17:55:41 2023 +0100 ALSA: hda: Fix codec device field initializan Commit f2bd1c5ae2cb ("ALSA: hda: Fix page fault in snd_hda_codec_shutdown()") relocated initialization of several codec device fields. Due to differences between codec_exec_verb() and snd_hdac_bus_exec_bus() in how they handle VERB execution - the latter does not touch PM - assigning ->exec_verb to codec_exec_verb() causes PM to be engaged before it is configured for the device. Configuration of PM for the ASoC HDAudio sound card is done with snd_hda_set_power_save() during skl_hda_audio_probe() whereas the assignment happens early, in snd_hda_codec_device_init(). Revert to previous behavior to avoid problems caused by too early PM manipulation. Suggested-by: Jason Montleon Link: https://lore.kernel.org/regressions/CALFERdzKUodLsm6=Ub3g2+PxpNpPtPq3bGBLbff=eZr9_S=YVA@mail.gmail.com Fixes: f2bd1c5ae2cb ("ALSA: hda: Fix page fault in snd_hda_codec_shutdown()") Signed-off-by: Cezary Rojewski Link: https://lore.kernel.org/r/20230210165541.3543604-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai commit 20ab8432420e51f1adce23027121efd5478d0ba3 Merge: 7fa0b526f865c 62ec33b44e0f7 Author: Jakub Kicinski Date: Fri Feb 10 19:53:43 2023 -0800 Merge branch 'sk-sk_forward_alloc-fixes' Kuniyuki Iwashima says: ==================== sk->sk_forward_alloc fixes. The first patch fixes a negative sk_forward_alloc by adding sk_rmem_schedule() before skb_set_owner_r(), and second patch removes an unnecessary WARN_ON_ONCE(). v2: https://lore.kernel.org/netdev/20230209013329.87879-1-kuniyu@amazon.com/ v1: https://lore.kernel.org/netdev/20230207183718.54520-1-kuniyu@amazon.com/ ==================== Link: https://lore.kernel.org/r/20230210002202.81442-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 62ec33b44e0f7168ff2886520fec6fb62d03b5a3 Author: Kuniyuki Iwashima Date: Thu Feb 9 16:22:02 2023 -0800 net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2] Also, we can reproduce it by a program in [3]. In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy() to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in inet_csk_destroy_sock(). The same check has been in inet_sock_destruct() from at least v2.6, we can just remove the WARN_ON_ONCE(). However, among the users of sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct(). Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor(). [0]: https://lore.kernel.org/netdev/39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com/ [1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341 [2]: WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0 Modules linked in: CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0 Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9 RSP: 0018:ffff88810570fc68 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005 RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488 R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458 FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0 Call Trace: inet_csk_destroy_sock+0x1a1/0x320 __tcp_close+0xab6/0xe90 tcp_close+0x30/0xc0 inet_release+0xe9/0x1f0 inet6_release+0x4c/0x70 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7fdf7ae28d Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000 R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8 [3]: https://lore.kernel.org/netdev/20230208004245.83497-1-kuniyu@amazon.com/ Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") Reported-by: syzbot Reported-by: Christoph Paasch Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit ca43ccf41224b023fc290073d5603a755fd12eed Author: Kuniyuki Iwashima Date: Thu Feb 9 16:22:01 2023 -0800 dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. Eric Dumazet pointed out [0] that when we call skb_set_owner_r() for ipv6_pinfo.pktoptions, sk_rmem_schedule() has not been called, resulting in a negative sk_forward_alloc. We add a new helper which clones a skb and sets its owner only when sk_rmem_schedule() succeeds. Note that we move skb_set_owner_r() forward in (dccp|tcp)_v6_do_rcv() because tcp_send_synack() can make sk_forward_alloc negative before ipv6_opt_accepted() in the crossed SYN-ACK or self-connect() cases. [0]: https://lore.kernel.org/netdev/CANn89iK9oc20Jdi_41jb9URdF210r7d1Y-+uypbMSbOfY6jqrg@mail.gmail.com/ Fixes: 323fbd0edf3f ("net: dccp: Add handling of IPV6_PKTOPTIONS to dccp_v6_do_rcv()") Fixes: 3df80d9320bc ("[DCCP]: Introduce DCCPv6") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 7fa0b526f865cb42aa33917fd02a92cb03746f4d Author: Natalia Petrova Date: Thu Feb 9 09:28:33 2023 -0800 i40e: Add checking for null for nlmsg_find_attr() The result of nlmsg_find_attr() 'br_spec' is dereferenced in nla_for_each_nested(), but it can take NULL value in nla_find() function, which will result in an error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 51616018dd1b ("i40e: Add support for getlink, setlink ndo ops") Signed-off-by: Natalia Petrova Reviewed-by: Jesse Brandeburg Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230209172833.3596034-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1f090494170ea298530cf1285fb8d078e355b4c0 Author: Larysa Zaremba Date: Thu Feb 9 17:01:30 2023 +0100 ice: xsk: Fix cleaning of XDP_TX frames Incrementation of xsk_frames inside the for-loop produces infinite loop, if we have both normal AF_XDP-TX and XDP_TXed buffers to complete. Split xsk_frames into 2 variables (xsk_frames and completed_frames) to eliminate this bug. Fixes: 29322791bc8b ("ice: xsk: change batched Tx descriptor cleaning") Acked-by: Maciej Fijalkowski Signed-off-by: Larysa Zaremba Reviewed-by: Alexander Duyck Acked-by: Tony Nguyen Link: https://lore.kernel.org/r/20230209160130.1779890-1-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit ee059170b1f7e94e55fa6cadee544e176a6e59c2 Author: Pedro Tammela Date: Thu Feb 9 11:37:39 2023 -0300 net/sched: tcindex: update imperfect hash filters respecting rcu The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. CPU 0: CPU 1: tcindex_set_parms tcindex_classify tcindex_lookup tcindex_lookup tcf_exts_change tcf_exts_exec [UAF] Stop operating on the shared area directly, by using a local copy, and update the filter with 'rcu_replace_pointer()'. Delete the old filter version only after a rcu grace period elapsed. Fixes: 9b0d4446b569 ("net: sched: avoid atomic swap in tcf_exts_change") Reported-by: valis Suggested-by: valis Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Link: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com Signed-off-by: Jakub Kicinski commit a1221703a0f75a9d81748c516457e0fc76951496 Author: Pietro Borrello Date: Thu Feb 9 12:13:05 2023 +0000 sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list Use list_is_first() to check whether tsp->asoc matches the first element of ep->asocs, as the list is not guaranteed to have an entry. Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Pietro Borrello Acked-by: Xin Long Link: https://lore.kernel.org/r/20230208-sctp-filter-v2-1-6e1f4017f326@diag.uniroma1.it Signed-off-by: Jakub Kicinski commit 0ed577e7e8e508c24e22ba07713ecc4903e147c3 Author: Siddharth Vadapalli Date: Thu Feb 9 14:14:32 2023 +0530 net: ethernet: ti: am65-cpsw: Add RX DMA Channel Teardown Quirk In TI's AM62x/AM64x SoCs, successful teardown of RX DMA Channel raises an interrupt. The process of servicing this interrupt involves flushing all pending RX DMA descriptors and clearing the teardown completion marker (TDCM). The am65_cpsw_nuss_rx_packets() function invoked from the RX NAPI callback services the interrupt. Thus, it is necessary to wait for this handler to run, drain all packets and clear TDCM, before calling napi_disable() in am65_cpsw_nuss_common_stop() function post channel teardown. If napi_disable() executes before ensuring that TDCM is cleared, the TDCM remains set when the interfaces are down, resulting in an interrupt storm when the interfaces are brought up again. Since the interrupt raised to indicate the RX DMA Channel teardown is specific to the AM62x and AM64x SoCs, add a quirk for it. Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g") Co-developed-by: Vignesh Raghavendra Signed-off-by: Vignesh Raghavendra Signed-off-by: Siddharth Vadapalli Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20230209084432.189222-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski commit 420b2d431d18a2572c8e86579e78105cb5ed45b0 Merge: 545c80ab3428d ecfb9f404771d Author: Linus Torvalds Date: Fri Feb 10 15:28:08 2023 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Two clk driver fixes - Use devm_kasprintf() to avoid overflows when forming clk names in the Microchip PolarFire driver - Fix the pretty broken Ingenic JZ4760 M/N/OD calculation to actually work and find proper divisors" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: ingenic: jz4760: Update M/N/OD calculation algorithm clk: microchip: mpfs-ccc: Use devm_kasprintf() for allocating formatted strings commit 545c80ab3428df0d693f6b99b57f3c6ada34494d Merge: 4cfd5afcd87eb a8520be3ffef3 Author: Linus Torvalds Date: Fri Feb 10 15:02:16 2023 -0800 Merge tag 'pinctrl-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some assorted pin control fixes, the most interesting will be the Intel patch fixing a classic problem: laptop touchpad IRQs... - Some pin drive register fixes in the Mediatek driver. - Return proper error code in the Aspeed driver, and revert and ill-advised force-disablement patch that needs to be reworked. - Fix AMD driver debug output. - Fix potential NULL dereference in the Single driver. - Fix a group definition error in the Qualcomm SM8450 LPASS driver. - Restore pins used in direct IRQ mode in the Intel driver (This fixes some laptop touchpads!)" * tag 'pinctrl-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: intel: Restore the pins that used to be in Direct IRQ mode pinctrl: qcom: sm8450-lpass-lpi: correct swr_rx_data group pinctrl: aspeed: Revert "Force to disable the function's signal" pinctrl: single: fix potential NULL dereference pinctrl: amd: Fix debug output for debounce time pinctrl: aspeed: Fix confusing types in return value pinctrl: mediatek: Fix the drive register definition of some Pins commit 4cfd5afcd87eb213f08863b6f34944978b0a678d Merge: 4f72a263e1629 ff209ecc376a2 Author: Linus Torvalds Date: Fri Feb 10 14:18:48 2023 -0800 Merge tag 'pci-v6.2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Move to a shared PCI git tree (Bjorn Helgaas) - Add Krzysztof Wilczyński as another PCI maintainer (Lorenzo Pieralisi) - Revert a couple ASPM patches to fix suspend/resume regressions (Bjorn Helgaas) * tag 'pci-v6.2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: Revert "PCI/ASPM: Refactor L1 PM Substates Control Register programming" Revert "PCI/ASPM: Save L1 PM Substates Capability for suspend/resume" MAINTAINERS: Promote Krzysztof to PCI controller maintainer MAINTAINERS: Move to shared PCI tree commit ff209ecc376a2ea8dd106a1f594427a5d94b7dd3 Author: Bjorn Helgaas Date: Fri Feb 3 13:57:39 2023 -0600 Revert "PCI/ASPM: Refactor L1 PM Substates Control Register programming" This reverts commit 5e85eba6f50dc288c22083a7e213152bcc4b8208. Thomas Witt reported that 5e85eba6f50d ("PCI/ASPM: Refactor L1 PM Substates Control Register programming") broke suspend/resume on a Tuxedo Infinitybook S 14 v5, which seems to use a Clevo L140CU Mainboard. The main symptom is: iwlwifi 0000:02:00.0: Unable to change power state from D3hot to D0, device inaccessible nvme 0000:03:00.0: Unable to change power state from D3hot to D0, device inaccessible and the machine is only partially usable after resume. It can't run dmesg and can't do a clean reboot. This happens on every suspend/resume cycle. Revert 5e85eba6f50d until we can figure out the root cause. Fixes: 5e85eba6f50d ("PCI/ASPM: Refactor L1 PM Substates Control Register programming") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216877 Reported-by: Thomas Witt Tested-by: Thomas Witt Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v6.1+ Cc: Vidya Sagar commit a7152be79b627428c628da2a887ca4b2512a78fd Author: Bjorn Helgaas Date: Fri Feb 3 13:57:29 2023 -0600 Revert "PCI/ASPM: Save L1 PM Substates Capability for suspend/resume" This reverts commit 4ff116d0d5fd8a025604b0802d93a2d5f4e465d1. Tasev Nikola and Mark Enriquez reported that resume from suspend was broken in v6.1-rc1. Tasev bisected to a47126ec29f5 ("PCI/PTM: Cache PTM Capability offset"), but we can't figure out how that could be related. Mark saw the same symptoms and bisected to 4ff116d0d5fd ("PCI/ASPM: Save L1 PM Substates Capability for suspend/resume"), which does have a connection: it restores L1 Substates configuration while ASPM L1 may be enabled: pci_restore_state pci_restore_aspm_l1ss_state aspm_program_l1ss pci_write_config_dword(PCI_L1SS_CTL1, ctl1) # L1SS restore pci_restore_pcie_state pcie_capability_write_word(PCI_EXP_LNKCTL, cap[i++]) # L1 restore which is a problem because PCIe r6.0, sec 5.5.4, requires that: If setting either or both of the enable bits for ASPM L1 PM Substates, both ports must be configured as described in this section while ASPM L1 is disabled. Separately, Thomas Witt reported that 5e85eba6f50d ("PCI/ASPM: Refactor L1 PM Substates Control Register programming") broke suspend/resume, and it depends on 4ff116d0d5fd. Revert 4ff116d0d5fd ("PCI/ASPM: Save L1 PM Substates Capability for suspend/resume") to fix the resume issue and enable revert of 5e85eba6f50d to fix the issue Thomas reported. Note that reverting 4ff116d0d5fd means L1 Substates config may be lost on suspend/resume. As far as we know the system will use more power but will still *work* correctly. Fixes: 4ff116d0d5fd ("PCI/ASPM: Save L1 PM Substates Capability for suspend/resume") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216782 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216877 Reported-by: Tasev Nikola Reported-by: Mark Enriquez Reported-by: Thomas Witt Tested-by: Mark Enriquez Tested-by: Thomas Witt Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v6.1+ Cc: Vidya Sagar commit 4f72a263e162938de26866b862ed6015f5725946 Merge: 8e9a8427a1f1f bc6772bbab9af Author: Linus Torvalds Date: Fri Feb 10 09:48:42 2023 -0800 Merge tag 'soc-fixes-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "All the changes this time are minor devicetree corrections, the majority being for 64-bit Rockchip SoC support. These are a couple of corrections for properties that are in violation of the binding, some that put the machine into safer operating points for the eMMC and thermal settings, and missing properties that prevented rk356x PCIe and ethernet from working correctly. The changes for amlogic and mediatek address incorrect properties that were preventing the display support on MT8195 and the MMC support on various Meson SoCs from working correctly. The stihxxx-b2120 change fixes the GPIO polarity for the DVB tuner to allow this to be used correctly after a futre driver change, though it has no effect on older kernels" * tag 'soc-fixes-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port arm64: dts: mediatek: mt8195: Fix vdosys* compatible strings arm64: dts: rockchip: align rk3399 DMC OPP table with bindings arm64: dts: rockchip: set sdmmc0 speed to sd-uhs-sdr50 on rock-3a arm64: dts: rockchip: fix probe of analog sound card on rock-3a arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1 arm64: dts: rockchip: fix input enable pinconf on rk3399 ARM: dts: rockchip: add power-domains property to dp node on rk3288 arm64: dts: rockchip: add io domain setting to rk3566-box-demo arm64: dts: rockchip: remove unsupported property from sdmmc2 for rock-3a arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro arm64: dts: rockchip: use correct reset names for rk3399 crypto nodes commit 8e9a8427a1f1f39632e2b2ccd651e499c64f59b2 Merge: 3647d2d70640f 950b879b7f025 Author: Linus Torvalds Date: Fri Feb 10 09:27:52 2023 -0800 Merge tag 'riscv-for-linus-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "This is a little bigger that I'd hope for this late in the cycle, but they're all pretty concrete fixes and the only one that's bigger than a few lines is pmdp_collapse_flush() (which is almost all boilerplate/comment). It's also all bug fixes for issues that have been around for a while. So I think it's not all that scary, just bad timing. - avoid partial TLB fences for huge pages, which are disallowed by the ISA - avoid missing a frame when dumping stacks - avoid misaligned accesses (and possibly overflows) in kprobes - fix a race condition in tracking page dirtiness" * tag 'riscv-for-linus-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte riscv: kprobe: Fixup misaligned load text riscv: stacktrace: Fix missing the first frame riscv: mm: Implement pmdp_collapse_flush for THP commit 3647d2d70640ff85be60793fa4b204bdae26ca44 Merge: 29716680adbb2 e7d84c6a1296d Author: Linus Torvalds Date: Fri Feb 10 09:04:00 2023 -0800 Merge tag 'ceph-for-6.2-rc8' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix for a pretty embarrassing omission in the session flush handler from Xiubo, marked for stable" * tag 'ceph-for-6.2-rc8' of https://github.com/ceph/ceph-client: ceph: flush cap releases when the session is flushed commit 29716680adbb221a5cd1604e11e81c6f2938e06f Merge: 4fe37223975ce 38c33ece23201 Author: Linus Torvalds Date: Fri Feb 10 08:55:09 2023 -0800 Merge tag 'block-6.2-2023-02-10' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "A single fix for a smatch regression introduced in this merge window" * tag 'block-6.2-2023-02-10' of git://git.kernel.dk/linux: nvme-auth: mark nvme_auth_wq static commit 4fe37223975ce04c4a4ad0a136cd4e64b39bc3ca Merge: 38c1e0c658654 88d18b8896bd9 Author: Linus Torvalds Date: Fri Feb 10 08:37:48 2023 -0800 Merge tag 'sound-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Hopefully the last one for 6.2, a collection of the fixes that have been gathered since the last pull. All changes are small and trivial device-specific fixes" * tag 'sound-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add Positivo N14KP6-TG ASoC: topology: Return -ENOMEM on memory allocation failure ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() ASoC: fsl_sai: fix getting version from VERID ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform. ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 ASoC: codecs: es8326: Fix DTS properties reading ASoC: tas5805m: add missing page switch. ASoC: tas5805m: rework to avoid scheduling while atomic. ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 ASoC: SOF: amd: Fix for handling spurious interrupts from DSP ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 ALSA: pci: lx6464es: fix a debug loop ASoC: rt715-sdca: fix clock stop prepare timeout issue commit 7484a5bc153e81a1740c06ce037fd55b7638335c Author: Jocelyn Falempe Date: Thu Feb 9 10:44:17 2023 +0100 drm/ast: Fix start address computation During the driver conversion to shmem, the start address for the scanout buffer was set to the base PCI address. In most cases it works because only the lower 24bits are used, and due to alignment it was almost always 0. But on some unlucky hardware, it's not the case, and some uninitialized memory is displayed on the BMC. With shmem, the primary plane is always at offset 0 in GPU memory. * v2: rewrite the patch to set the offset to 0. (Thomas Zimmermann) * v3: move the change to plane_init() and also fix the cursor plane. (Jammy Huang) Tested on a sr645 affected by this bug. Fixes: f2fa5a99ca81 ("drm/ast: Convert ast to SHMEM") Signed-off-by: Jocelyn Falempe Reviewed-by: Thomas Zimmermann Reviewed-by: Jammy Huang Link: https://patchwork.freedesktop.org/patch/msgid/20230209094417.21630-1-jfalempe@redhat.com commit 493a2c2d23ca91afba96ac32b6cbafb54382c2a3 Author: Tom Lendacky Date: Thu Feb 9 09:22:26 2023 -0600 Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions Add the admin guide for the Cross-Thread Return Predictions vulnerability. Signed-off-by: Tom Lendacky Message-Id: <60f9c0b4396956ce70499ae180cb548720b25c7e.1675956146.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini commit 6f0f2d5ef895d66a3f2b32dd05189ec34afa5a55 Author: Tom Lendacky Date: Thu Feb 9 09:22:25 2023 -0600 KVM: x86: Mitigate the cross-thread return address predictions bug By default, KVM/SVM will intercept attempts by the guest to transition out of C0. However, the KVM_CAP_X86_DISABLE_EXITS capability can be used by a VMM to change this behavior. To mitigate the cross-thread return address predictions bug (X86_BUG_SMT_RSB), a VMM must not be allowed to override the default behavior to intercept C0 transitions. Use a module parameter to control the mitigation on processors that are vulnerable to X86_BUG_SMT_RSB. If the processor is vulnerable to the X86_BUG_SMT_RSB bug and the module parameter is set to mitigate the bug, KVM will not allow the disabling of the HLT, MWAIT and CSTATE exits. Signed-off-by: Tom Lendacky Message-Id: <4019348b5e07148eb4d593380a5f6713b93c9a16.1675956146.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini commit be8de49bea505e7777a69ef63d60e02ac1712683 Author: Tom Lendacky Date: Thu Feb 9 09:22:24 2023 -0600 x86/speculation: Identify processors vulnerable to SMT RSB predictions Certain AMD processors are vulnerable to a cross-thread return address predictions bug. When running in SMT mode and one of the sibling threads transitions out of C0 state, the other sibling thread could use return target predictions from the sibling thread that transitioned out of C0. The Spectre v2 mitigations cover the Linux kernel, as it fills the RSB when context switching to the idle thread. However, KVM allows a VMM to prevent exiting guest mode when transitioning out of C0. A guest could act maliciously in this situation, so create a new x86 BUG that can be used to detect if the processor is vulnerable. Reviewed-by: Borislav Petkov (AMD) Signed-off-by: Tom Lendacky Message-Id: <91cec885656ca1fcd4f0185ce403a53dd9edecb7.1675956146.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini commit bc6772bbab9af6034f918624a40ac5c962df2bac Merge: 89e5dd41c444c 66e45351f7d67 Author: Arnd Bergmann Date: Fri Feb 10 11:31:24 2023 +0100 Merge tag 'amlogic-fixes-v6.2-rc-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes Amlogic fixes for v6.2-rc, take2: - Change MMC controllers interrupts flag to level on all families, fixes irq loss & performance issues when cpu loaded * tag 'amlogic-fixes-v6.2-rc-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive Link: https://lore.kernel.org/r/761c2ebc-7c93-8504-35ae-3e84ad216bcf@linaro.org Signed-off-by: Arnd Bergmann commit 3efc61d95259956db25347e2a9562c3e54546e20 Author: Takashi Iwai Date: Sun Jan 29 09:28:56 2023 +0100 fbdev: Fix invalid page access after closing deferred I/O devices When a fbdev with deferred I/O is once opened and closed, the dirty pages still remain queued in the pageref list, and eventually later those may be processed in the delayed work. This may lead to a corruption of pages, hitting an Oops. This patch makes sure to cancel the delayed work and clean up the pageref list at closing the device for addressing the bug. A part of the cleanup code is factored out as a new helper function that is called from the common fb_release(). Reviewed-by: Patrik Jakobsson Cc: Signed-off-by: Takashi Iwai Tested-by: Miko Larsson Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230129082856.22113-1-tiwai@suse.de commit 18d7e16c917a08f08778ecf2b780d63648d5d923 Author: Bo Liu Date: Thu Feb 9 10:13:48 2023 +0800 ALSA: hda/conexant: add a new hda codec SN6180 The current kernel does not support the SN6180 codec chip. Add the SN6180 codec configuration item to kernel. Signed-off-by: Bo Liu Cc: Link: https://lore.kernel.org/r/1675908828-1012-1-git-send-email-bo.liu@senarytech.com Signed-off-by: Takashi Iwai commit 66e45351f7d6798751f98001d1fcd572024d87f0 Author: Heiner Kallweit Date: Thu Feb 9 21:11:47 2023 +0100 arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive The usage of edge-triggered interrupts lead to lost interrupts under load, see [0]. This was confirmed to be fixed by using level-triggered interrupts. The report was about SDIO. However, as the host controller is the same for SD and MMC, apply the change to all mmc controller instances. [0] https://www.spinics.net/lists/linux-mmc/msg73991.html Fixes: ef8d2ffedf18 ("ARM64: dts: meson-gxbb: add MMC support") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/76e042e0-a610-5ed5-209f-c4d7f879df44@gmail.com Signed-off-by: Neil Armstrong commit ac8db4cceed218cca21c84f9d75ce88182d8b04f Author: Heiner Kallweit Date: Thu Feb 9 21:11:10 2023 +0100 arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive The usage of edge-triggered interrupts lead to lost interrupts under load, see [0]. This was confirmed to be fixed by using level-triggered interrupts. The report was about SDIO. However, as the host controller is the same for SD and MMC, apply the change to all mmc controller instances. [0] https://www.spinics.net/lists/linux-mmc/msg73991.html Fixes: 4759fd87b928 ("arm64: dts: meson: g12a: add mmc nodes") Tested-by: FUKAUMI Naoki Tested-by: Martin Blumenstingl Tested-by: Jerome Brunet Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/27d89baa-b8fa-baca-541b-ef17a97cde3c@gmail.com Signed-off-by: Neil Armstrong commit d182bcf300772d8b2e5f43e47fa0ebda2b767cc4 Author: Heiner Kallweit Date: Thu Feb 9 21:10:31 2023 +0100 arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive The usage of edge-triggered interrupts lead to lost interrupts under load, see [0]. This was confirmed to be fixed by using level-triggered interrupts. The report was about SDIO. However, as the host controller is the same for SD and MMC, apply the change to all mmc controller instances. [0] https://www.spinics.net/lists/linux-mmc/msg73991.html Fixes: 221cf34bac54 ("ARM64: dts: meson-axg: enable the eMMC controller") Reported-by: Peter Suti Tested-by: Vyacheslav Bocharov Tested-by: Peter Suti Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/c00655d3-02f8-6f5f-4239-ca2412420cad@gmail.com Signed-off-by: Neil Armstrong commit ec76d0c2da5c6dfb6a33f1545cc15997013923da Author: Ronak Doshi Date: Wed Feb 8 14:38:59 2023 -0800 vmxnet3: move rss code block under eop descriptor Commit b3973bb40041 ("vmxnet3: set correct hash type based on rss information") added hashType information into skb. However, rssType field is populated for eop descriptor. This can lead to incorrectly reporting of hashType for packets which use multiple rx descriptors. Multiple rx descriptors are used for Jumbo frame or LRO packets, which can hit this issue. This patch moves the RSS codeblock under eop descritor. Cc: stable@vger.kernel.org Fixes: b3973bb40041 ("vmxnet3: set correct hash type based on rss information") Signed-off-by: Ronak Doshi Acked-by: Peng Li Acked-by: Guolin Yang Link: https://lore.kernel.org/r/20230208223900.5794-1-doshir@vmware.com Signed-off-by: Jakub Kicinski commit 6e77a5a4af05d5e7391c841a4a4f3e4cadf72c25 Author: Eric Dumazet Date: Wed Feb 8 18:21:23 2023 +0000 net: initialize net->notrefcnt_tracker earlier syzbot was able to trigger a warning [1] from net_free() calling ref_tracker_dir_exit(&net->notrefcnt_tracker) while the corresponding ref_tracker_dir_init() has not been done yet. copy_net_ns() can indeed bypass the call to setup_net() in some error conditions. Note: We might factorize/move more code in preinit_net() in the future. [1] INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 PID: 5817 Comm: syz-executor.3 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 assign_lock_key kernel/locking/lockdep.c:982 [inline] register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951 lock_acquire.part.0+0x11c/0x370 kernel/locking/lockdep.c:5691 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 ref_tracker_dir_exit+0x52/0x600 lib/ref_tracker.c:24 net_free net/core/net_namespace.c:442 [inline] net_free+0x98/0xd0 net/core/net_namespace.c:436 copy_net_ns+0x4f3/0x6b0 net/core/net_namespace.c:493 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x449/0x920 kernel/fork.c:3205 __do_sys_unshare kernel/fork.c:3276 [inline] __se_sys_unshare kernel/fork.c:3274 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3274 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 Fixes: 0cafd77dcd03 ("net: add a refcount tracker for kernel sockets") Reported-by: syzbot Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230208182123.3821604-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e8ac615fe126c829612b97b4ddf6cae105ca20b8 Merge: 6e16e67a6b27f c21a20d9d102a Author: Jakub Kicinski Date: Thu Feb 9 22:49:06 2023 -0800 Merge branch 'ipv6-fix-socket-connection-with-dscp-fib-rules' Guillaume Nault says: ==================== ipv6: Fix socket connection with DSCP fib-rules. The "flowlabel" field of struct flowi6 is used to store both the actual flow label and the DS Field (or Traffic Class). However the .connect handlers of datagram and TCP sockets don't set the DS Field part when doing their route lookup. This breaks fib-rules that match on DSCP. ==================== Link: https://lore.kernel.org/r/cover.1675875519.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit c21a20d9d102ab809a992a6b056abbec4cd4c1cd Author: Guillaume Nault Date: Wed Feb 8 18:14:07 2023 +0100 selftests: fib_rule_tests: Test UDP and TCP connections with DSCP rules. Add the fib_rule6_send and fib_rule4_send tests to verify that DSCP values are properly taken into account when UDP or TCP sockets try to connect(). Tests are done with nettest, which needs a new option to specify the DS Field value of the socket being tested. This new option is named '-Q', in reference to the similar option used by ping. Signed-off-by: Guillaume Nault Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 8230680f36fd1525303d1117768c8852314c488c Author: Guillaume Nault Date: Wed Feb 8 18:14:03 2023 +0100 ipv6: Fix tcp socket connection with DSCP. Take into account the IPV6_TCLASS socket option (DSCP) in tcp_v6_connect(). Otherwise fib6_rule_match() can't properly match the DSCP value, resulting in invalid route lookup. For example: ip route add unreachable table main 2001:db8::10/124 ip route add table 100 2001:db8::10/124 dev eth0 ip -6 rule add dsfield 0x04 table 100 echo test | socat - TCP6:[2001:db8::11]:54321,ipv6-tclass=0x04 Without this patch, socat fails at connect() time ("No route to host") because the fib-rule doesn't jump to table 100 and the lookup ends up being done in the main table. Fixes: 2cc67cc731d9 ("[IPV6] ROUTE: Routing by Traffic Class.") Signed-off-by: Guillaume Nault Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit e010ae08c71fda8be3d6bda256837795a0b3ea41 Author: Guillaume Nault Date: Wed Feb 8 18:13:59 2023 +0100 ipv6: Fix datagram socket connection with DSCP. Take into account the IPV6_TCLASS socket option (DSCP) in ip6_datagram_flow_key_init(). Otherwise fib6_rule_match() can't properly match the DSCP value, resulting in invalid route lookup. For example: ip route add unreachable table main 2001:db8::10/124 ip route add table 100 2001:db8::10/124 dev eth0 ip -6 rule add dsfield 0x04 table 100 echo test | socat - UDP6:[2001:db8::11]:54321,ipv6-tclass=0x04 Without this patch, socat fails at connect() time ("No route to host") because the fib-rule doesn't jump to table 100 and the lookup ends up being done in the main table. Fixes: 2cc67cc731d9 ("[IPV6] ROUTE: Routing by Traffic Class.") Signed-off-by: Guillaume Nault Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 6e16e67a6b27f009ac70b1c59d8bd5a4e2820baf Merge: d61615c366a48 71f814cda659d Author: Jakub Kicinski Date: Thu Feb 9 22:28:08 2023 -0800 Merge branch 'nfp-fix-schedule-in-atomic-context-when-offloading-sa' Simon Horman says: ==================== nfp: fix schedule in atomic context when offloading sa Yinjun Zhang says: IPsec offloading callbacks may be called in atomic context, sleep is not allowed in the implementation. Now use workqueue mechanism to avoid this issue. Extend existing workqueue mechanism for multicast configuration only to universal use, so that all configuring through mailbox asynchoronously can utilize it. Also fix another two incorrect use of mailbox in IPsec: 1. Need lock for race condition when accessing mbox 2. Offset of mbox access should depends on tlv caps ==================== Link: https://lore.kernel.org/r/20230208102258.29639-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit 71f814cda659dca3db575ed67dfcdc4b93e8d33f Author: Yinjun Zhang Date: Wed Feb 8 11:22:58 2023 +0100 nfp: fix schedule in atomic context when offloading sa IPsec offloading callbacks may be called in atomic context, sleep is not allowed in the implementation. Now use workqueue mechanism to avoid this issue. Extend existing workqueue mechanism for multicast configuration only to universal use, so that all configuring through mailbox asynchronously can utilize it. Fixes: 859a497fe80c ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer") Signed-off-by: Yinjun Zhang Signed-off-by: Simon Horman Signed-off-by: Jakub Kicinski commit 7a13a2eef645f2d2e3018d6ea518f121b35a87c8 Author: Yinjun Zhang Date: Wed Feb 8 11:22:57 2023 +0100 nfp: fix incorrect use of mbox in IPsec code The mailbox configuration mechanism requires writing several registers, which shouldn't be interrupted, so need lock to avoid race condition. The base offset of mailbox configuration registers is not fixed, it depends on TLV caps read from application firmware. Fixes: 859a497fe80c ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer") Signed-off-by: Yinjun Zhang Signed-off-by: Simon Horman Signed-off-by: Jakub Kicinski commit d61615c366a489646a1bfe5b33455f916762d5f4 Author: Rafał Miłecki Date: Wed Feb 8 10:16:37 2023 +0100 net: bgmac: fix BCM5358 support by setting correct flags Code blocks handling BCMA_CHIP_ID_BCM5357 and BCMA_CHIP_ID_BCM53572 were incorrectly unified. Chip package values are not unique and cannot be checked independently. They are meaningful only in a context of a given chip. Packages BCM5358 and BCM47188 share the same value but then belong to different chips. Code unification resulted in treating BCM5358 as BCM47188 and broke its initialization. Link: https://github.com/openwrt/openwrt/issues/8278 Fixes: cb1b0f90acfe ("net: ethernet: bgmac: unify code of the same family") Cc: Jon Mason Signed-off-by: Rafał Miłecki Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230208091637.16291-1-zajec5@gmail.com Signed-off-by: Jakub Kicinski commit 38c1e0c65865426676123cc9a127526fa02bcac6 Merge: 1424c3e309bbd 777c1e01cb7e1 Author: Linus Torvalds Date: Thu Feb 9 17:52:00 2023 -0800 Merge tag 'drm-fixes-2023-02-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Weekly fixes. The amdgpu had a few small fixes to display flicker on certain configurations, however it was found the the flicker was lessened but there were other unintended consequences, so for now they've been reverted and replaced with an option for users to test with so future fixes can be developed. Otherwise apart from the usual bunch of i915 and amdgpu, there's a client, virtio-gpu and an nvidiafb fix that reorders its loading to avoid failure. client: - refcount fix amdgpu: - a bunch of attempted flicker fixes that regressed turned into a user workaround option for now - Properly fix S/G display with AGP aperture enabled - Fix cursor offset with 180 rotation - SMU13 fixes - Use TGID for GPUVM traces - Fix oops on in fence error path - Don't run IB tests on hw rings when sw rings are in use - memory leak fix i915: - Display watermark fix - fbdev fix for PSR, FBC, DRRS - Move fd_install after last use of fence - Initialize the obj flags for shmem objects - Fix VBT DSI DVO port handling virtio-gpu: - fence fix nvidiafb: - regression fix for driver load when no hw supported" * tag 'drm-fixes-2023-02-10' of git://anongit.freedesktop.org/drm/drm: (27 commits) Revert "drm/amd/display: disable S/G display on DCN 3.1.5" Revert "drm/amd/display: disable S/G display on DCN 2.1.0" Revert "drm/amd/display: disable S/G display on DCN 3.1.2/3" drm/amdgpu: add S/G display parameter drm/amdgpu/smu: skip pptable init under sriov amd/amdgpu: remove test ib on hw ring drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini drm/amdgpu: Use the TGID for trace_amdgpu_vm_update_ptes drm/amdgpu: Add unique_id support for GC 11.0.1/2 drm/amd/pm: bump SMU 13.0.7 driver_if header version drm/amd/pm: bump SMU 13.0.0 driver_if header version drm/amd/pm: add SMU 13.0.7 missing GetPptLimit message mapping drm/amd/display: fix cursor offset on rotation 180 drm/amd/amdgpu: enable athub cg 11.0.3 Revert "drm/amd/display: disable S/G display on DCN 3.1.4" drm/amd/display: properly handling AGP aperture in vm setup drm/amd/display: disable S/G display on DCN 3.1.2/3 drm/amd/display: disable S/G display on DCN 2.1.0 drm/i915: Fix VBT DSI DVO port handling drm/client: fix circular reference counting issue ... commit 1424c3e309bbdcf2d93977bf2840cc00ef9b6208 Merge: e544a07438522 2de49fb1c9bb8 Author: Linus Torvalds Date: Thu Feb 9 17:34:14 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "The usual collection of small driver bug fixes: - Fix error unwind bugs in hfi1, irdma rtrs - Old bug with IPoIB children interfaces possibly using the wrong number of queues - Really old bug in usnic calling iommu_map in an atomic context - Recent regression from the DMABUF locking rework - Missing user data validation in MANA" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/rtrs: Don't call kobject_del for srv_path->kobj RDMA/mana_ib: Prevent array underflow in mana_ib_create_qp_raw() IB/hfi1: Assign npages earlier RDMA/umem: Use dma-buf locked API to solve deadlock RDMA/usnic: use iommu_map_atomic() under spin_lock() RDMA/irdma: Fix potential NULL-ptr-dereference IB/IPoIB: Fix legacy IPoIB due to wrong number of queues IB/hfi1: Restore allocated resources on failed copyout commit ce4d9a1ea35ac5429e822c4106cb2859d5c71f3e Author: Isaac J. Manjarres Date: Wed Feb 8 15:20:00 2023 -0800 of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem Patch series "Fix kmemleak crashes when scanning CMA regions", v2. When trying to boot a device with an ARM64 kernel with the following config options enabled: CONFIG_DEBUG_PAGEALLOC=y CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y CONFIG_DEBUG_KMEMLEAK=y a crash is encountered when kmemleak starts to scan the list of gray or allocated objects that it maintains. Upon closer inspection, it was observed that these page-faults always occurred when kmemleak attempted to scan a CMA region. At the moment, kmemleak is made aware of CMA regions that are specified through the devicetree to be dynamically allocated within a range of addresses. However, kmemleak should not need to scan CMA regions or any reserved memory region, as those regions can be used for DMA transfers between drivers and peripherals, and thus wouldn't contain anything useful for kmemleak. Additionally, since CMA regions are unmapped from the kernel's address space when they are freed to the buddy allocator at boot when CONFIG_DEBUG_PAGEALLOC is enabled, kmemleak shouldn't attempt to access those memory regions, as that will trigger a crash. Thus, kmemleak should ignore all dynamically allocated reserved memory regions. This patch (of 1): Currently, kmemleak ignores dynamically allocated reserved memory regions that don't have a kernel mapping. However, regions that do retain a kernel mapping (e.g. CMA regions) do get scanned by kmemleak. This is not ideal for two reasons: 1 kmemleak works by scanning memory regions for pointers to allocated objects to determine if those objects have been leaked or not. However, reserved memory regions can be used between drivers and peripherals for DMA transfers, and thus, would not contain pointers to allocated objects, making it unnecessary for kmemleak to scan these reserved memory regions. 2 When CONFIG_DEBUG_PAGEALLOC is enabled, along with kmemleak, the CMA reserved memory regions are unmapped from the kernel's address space when they are freed to buddy at boot. These CMA reserved regions are still tracked by kmemleak, however, and when kmemleak attempts to scan them, a crash will happen, as accessing the CMA region will result in a page-fault, since the regions are unmapped. Thus, use kmemleak_ignore_phys() for all dynamically allocated reserved memory regions, instead of those that do not have a kernel mapping associated with them. Link: https://lkml.kernel.org/r/20230208232001.2052777-1-isaacmanjarres@google.com Link: https://lkml.kernel.org/r/20230208232001.2052777-2-isaacmanjarres@google.com Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Isaac J. Manjarres Acked-by: Mike Rapoport (IBM) Acked-by: Catalin Marinas Cc: Frank Rowand Cc: Kirill A. Shutemov Cc: Nick Kossifidis Cc: Rafael J. Wysocki Cc: Rob Herring Cc: Russell King (Oracle) Cc: Saravana Kannan Cc: [5.15+] Signed-off-by: Andrew Morton commit c16a3b11eaa88872d07f135df94dfa3fbcd05d10 Author: Jeff Xie Date: Sat Feb 4 17:01:39 2023 +0800 scripts/gdb: fix 'lx-current' for x86 When printing the name of the current process, it will report an error: (gdb) p $lx_current().comm Python Exception No symbol "current_task" in current context.: Error occurred in Python: No symbol "current_task" in current context. Because e57ef2ed97c1 ("x86: Put hot per CPU variables into a struct") changed it. Link: https://lkml.kernel.org/r/20230204090139.1789264-1-xiehuan09@gmail.com Fixes: e57ef2ed97c1 ("x86: Put hot per CPU variables into a struct") Signed-off-by: Jeff Xie Cc: Jan Kiszka Cc: Signed-off-by: Andrew Morton commit 67222c4ba8afe409d1e049a8f1e687c8a214fec7 Author: Li Lingfeng Date: Fri Jan 20 11:23:52 2023 +0800 lib: parser: optimize match_NUMBER apis to use local array Memory will be allocated to store substring_t in match_strdup(), which means the caller of match_strdup() may need to be scheduled out to wait for reclaiming memory. smatch complains that this can cuase sleeping in an atoic context. Using local array to store substring_t to remove the restriction. Link: https://lkml.kernel.org/r/20230120032352.242767-1-lilingfeng3@huawei.com Link: https://lore.kernel.org/all/20221104023938.2346986-5-yukuai1@huaweicloud.com/ Link: https://lkml.kernel.org/r/20230120032352.242767-1-lilingfeng3@huawei.com Fixes: 2c0647988433 ("blk-iocost: don't release 'ioc->lock' while updating params") Signed-off-by: Li Lingfeng Reported-by: Yu Kuai Acked-by: Tejun Heo Cc: BingJing Chang Cc: Eric Biggers Cc: Hou Tao Cc: James Smart Cc: Jan Kara Cc: Jens Axboe Cc: yangerkun Cc: Zhang Yi Signed-off-by: Andrew Morton commit badc28d4924bfed73efc93f716a0c3aa3afbdf6f Author: Qi Zheng Date: Thu Feb 2 18:56:12 2023 +0800 mm: shrinkers: fix deadlock in shrinker debugfs The debugfs_remove_recursive() is invoked by unregister_shrinker(), which is holding the write lock of shrinker_rwsem. It will waits for the handler of debugfs file complete. The handler also needs to hold the read lock of shrinker_rwsem to do something. So it may cause the following deadlock: CPU0 CPU1 debugfs_file_get() shrinker_debugfs_count_show()/shrinker_debugfs_scan_write() unregister_shrinker() --> down_write(&shrinker_rwsem); debugfs_remove_recursive() // wait for (A) --> wait_for_completion(); // wait for (B) --> down_read_killable(&shrinker_rwsem) debugfs_file_put() -- (A) up_write() -- (B) The down_read_killable() can be killed, so that the above deadlock can be recovered. But it still requires an extra kill action, otherwise it will block all subsequent shrinker-related operations, so it's better to fix it. [akpm@linux-foundation.org: fix CONFIG_SHRINKER_DEBUG=n stub] Link: https://lkml.kernel.org/r/20230202105612.64641-1-zhengqi.arch@bytedance.com Fixes: 5035ebc644ae ("mm: shrinkers: introduce debugfs interface for memory shrinkers") Signed-off-by: Qi Zheng Reviewed-by: Roman Gushchin Cc: Kent Overstreet Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit 6b970599e807ea95c653926d41b095a92fd381e2 Author: Kefeng Wang Date: Fri Dec 9 15:28:01 2022 +0800 mm: hwpoison: support recovery from ksm_might_need_to_copy() When the kernel copies a page from ksm_might_need_to_copy(), but runs into an uncorrectable error, it will crash since poisoned page is consumed by kernel, this is similar to the issue recently fixed by Copy-on-write poison recovery. When an error is detected during the page copy, return VM_FAULT_HWPOISON in do_swap_page(), and install a hwpoison entry in unuse_pte() when swapoff, which help us to avoid system crash. Note, memory failure on a KSM page will be skipped, but still call memory_failure_queue() to be consistent with general memory failure process, and we could support KSM page recovery in the feature. [wangkefeng.wang@huawei.com: enhance unuse_pte(), fix issue found by lkp] Link: https://lkml.kernel.org/r/20221213120523.141588-1-wangkefeng.wang@huawei.com [wangkefeng.wang@huawei.com: update changelog, alter ksm_might_need_to_copy(), restore unlikely() in unuse_pte()] Link: https://lkml.kernel.org/r/20230201074433.96641-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20221209072801.193221-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Naoya Horiguchi Cc: Miaohe Lin Cc: Tony Luck Signed-off-by: Andrew Morton commit 55d77bae73426237b3c74c1757a894b056550dff Author: Christophe Leroy Date: Thu Jan 26 08:04:47 2023 +0100 kasan: fix Oops due to missing calls to kasan_arch_is_ready() On powerpc64, you can build a kernel with KASAN as soon as you build it with RADIX MMU support. However if the CPU doesn't have RADIX MMU, KASAN isn't enabled at init and the following Oops is encountered. [ 0.000000][ T0] KASAN not enabled as it requires radix! [ 4.484295][ T26] BUG: Unable to handle kernel data access at 0xc00e000000804a04 [ 4.485270][ T26] Faulting instruction address: 0xc00000000062ec6c [ 4.485748][ T26] Oops: Kernel access of bad area, sig: 11 [#1] [ 4.485920][ T26] BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [ 4.486259][ T26] Modules linked in: [ 4.486637][ T26] CPU: 0 PID: 26 Comm: kworker/u2:2 Not tainted 6.2.0-rc3-02590-gf8a023b0a805 #249 [ 4.486907][ T26] Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1200 0xf000005 of:SLOF,HEAD pSeries [ 4.487445][ T26] Workqueue: eval_map_wq .tracer_init_tracefs_work_func [ 4.488744][ T26] NIP: c00000000062ec6c LR: c00000000062bb84 CTR: c0000000002ebcd0 [ 4.488867][ T26] REGS: c0000000049175c0 TRAP: 0380 Not tainted (6.2.0-rc3-02590-gf8a023b0a805) [ 4.489028][ T26] MSR: 8000000002009032 CR: 44002808 XER: 00000000 [ 4.489584][ T26] CFAR: c00000000062bb80 IRQMASK: 0 [ 4.489584][ T26] GPR00: c0000000005624d4 c000000004917860 c000000001cfc000 1800000000804a04 [ 4.489584][ T26] GPR04: c0000000003a2650 0000000000000cc0 c00000000000d3d8 c00000000000d3d8 [ 4.489584][ T26] GPR08: c0000000049175b0 a80e000000000000 0000000000000000 0000000017d78400 [ 4.489584][ T26] GPR12: 0000000044002204 c000000003790000 c00000000435003c c0000000043f1c40 [ 4.489584][ T26] GPR16: c0000000043f1c68 c0000000043501a0 c000000002106138 c0000000043f1c08 [ 4.489584][ T26] GPR20: c0000000043f1c10 c0000000043f1c20 c000000004146c40 c000000002fdb7f8 [ 4.489584][ T26] GPR24: c000000002fdb834 c000000003685e00 c000000004025030 c000000003522e90 [ 4.489584][ T26] GPR28: 0000000000000cc0 c0000000003a2650 c000000004025020 c000000004025020 [ 4.491201][ T26] NIP [c00000000062ec6c] .kasan_byte_accessible+0xc/0x20 [ 4.491430][ T26] LR [c00000000062bb84] .__kasan_check_byte+0x24/0x90 [ 4.491767][ T26] Call Trace: [ 4.491941][ T26] [c000000004917860] [c00000000062ae70] .__kasan_kmalloc+0xc0/0x110 (unreliable) [ 4.492270][ T26] [c0000000049178f0] [c0000000005624d4] .krealloc+0x54/0x1c0 [ 4.492453][ T26] [c000000004917990] [c0000000003a2650] .create_trace_option_files+0x280/0x530 [ 4.492613][ T26] [c000000004917a90] [c000000002050d90] .tracer_init_tracefs_work_func+0x274/0x2c0 [ 4.492771][ T26] [c000000004917b40] [c0000000001f9948] .process_one_work+0x578/0x9f0 [ 4.492927][ T26] [c000000004917c30] [c0000000001f9ebc] .worker_thread+0xfc/0x950 [ 4.493084][ T26] [c000000004917d60] [c00000000020be84] .kthread+0x1a4/0x1b0 [ 4.493232][ T26] [c000000004917e10] [c00000000000d3d8] .ret_from_kernel_thread+0x58/0x60 [ 4.495642][ T26] Code: 60000000 7cc802a6 38a00000 4bfffc78 60000000 7cc802a6 38a00001 4bfffc68 60000000 3d20a80e 7863e8c2 792907c6 <7c6348ae> 20630007 78630fe0 68630001 [ 4.496704][ T26] ---[ end trace 0000000000000000 ]--- The Oops is due to kasan_byte_accessible() not checking the readiness of KASAN. Add missing call to kasan_arch_is_ready() and bail out when not ready. The same problem is observed with ____kasan_kfree_large() so fix it the same. Also, as KASAN is not available and no shadow area is allocated for linear memory mapping, there is no point in allocating shadow mem for vmalloc memory as shown below in /sys/kernel/debug/kernel_page_tables ---[ kasan shadow mem start ]--- 0xc00f000000000000-0xc00f00000006ffff 0x00000000040f0000 448K r w pte valid present dirty accessed 0xc00f000000860000-0xc00f00000086ffff 0x000000000ac10000 64K r w pte valid present dirty accessed 0xc00f3ffffffe0000-0xc00f3fffffffffff 0x0000000004d10000 128K r w pte valid present dirty accessed ---[ kasan shadow mem end ]--- So, also verify KASAN readiness before allocating and poisoning shadow mem for VMAs. Link: https://lkml.kernel.org/r/150768c55722311699fdcf8f5379e8256749f47d.1674716617.git.christophe.leroy@csgroup.eu Fixes: 41b7a347bf14 ("powerpc: Book3S 64-bit outline-only KASAN support") Signed-off-by: Christophe Leroy Reported-by: Nathan Lynch Suggested-by: Michael Ellerman Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: [5.19+] Signed-off-by: Andrew Morton commit 777c1e01cb7e1947765fb0c3b9b71dab18e53e46 Merge: 0ed904169f85e e7d636476ba73 Author: Dave Airlie Date: Fri Feb 10 09:49:12 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-02-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-02-09: amdgpu: - Add a parameter to disable S/G display - Re-enable S/G display on all DCNs Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230209174504.7577-1-alexander.deucher@amd.com commit 0ed904169f85efcf9f82bd960597aac46260537f Merge: 337d5b5edc3d0 6a7ff131f17f4 Author: Dave Airlie Date: Fri Feb 10 09:47:20 2023 +1000 Merge tag 'drm-intel-fixes-2023-02-09' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Display watermark fix (Ville) - fbdev fix for PSR, FBC, DRRS (Jouni) - Move fd_install after last use of fence (Rob) - Initialize the obj flags for shmem objects (Aravind) - Fix VBT DSI DVO port handling (Ville) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y+UZ0rh2YlhTrE4t@intel.com commit 337d5b5edc3d03a30a972aead75cc6be5dcebbf6 Merge: 4684f5ce839ab 85e26dd5100a1 Author: Dave Airlie Date: Fri Feb 10 09:15:52 2023 +1000 Merge tag 'drm-misc-fixes-2023-02-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A fix for a circular refcounting in drm/client, one for a memory leak in amdgpu and a virtio fence fix when interrupted Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230209083600.7hi6roht6xxgldgz@houat commit 950b879b7f0251317d26bae0687e72592d607532 Author: Guo Ren Date: Thu Jan 26 22:53:06 2023 -0500 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte In commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache()"), we found RISC-V has the same issue as the previous arm64. The previous implementation didn't guarantee the correct sequence of operations, which means flush_icache_all() hasn't been called when the PG_dcache_clean was set. That would cause a risk of page synchronization. Fixes: 08f051eda33b ("RISC-V: Flush I$ when making a dirty page executable") Signed-off-by: Guo Ren Signed-off-by: Guo Ren Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230127035306.1819561-1-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit eb7423273cc9922ee2d05bf660c034d7d515bb91 Author: Guo Ren Date: Sat Feb 4 01:35:31 2023 -0500 riscv: kprobe: Fixup misaligned load text The current kprobe would cause a misaligned load for the probe point. This patch fixup it with two half-word loads instead. Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/linux-riscv/878rhig9zj.fsf@all.your.base.are.belong.to.us/ Reported-by: Bjorn Topel Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230204063531.740220-1-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit e544a07438522ab3688416e6e2e34bf0ee6d8755 Merge: 35674e7875187 918c5765a1542 Author: Linus Torvalds Date: Thu Feb 9 10:54:57 2023 -0800 Merge tag 'pm-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix the incorrect value returned by cpufreq driver's ->get() callback for Qualcomm platforms (Douglas Anderson)" * tag 'pm-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems commit 35674e787518768626d3a0ffce1c13a7eeed922d Merge: 0b028189d1019 3a082086aa200 Author: Linus Torvalds Date: Thu Feb 9 09:17:38 2023 -0800 Merge tag 'net-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can and ipsec subtrees. Current release - regressions: - sched: fix off by one in htb_activate_prios() - eth: mana: fix accessing freed irq affinity_hint - eth: ice: fix out-of-bounds KASAN warning in virtchnl Current release - new code bugs: - eth: mtk_eth_soc: enable special tag when any MAC uses DSA Previous releases - always broken: - core: fix sk->sk_txrehash default - neigh: make sure used and confirmed times are valid - mptcp: be careful on subflow status propagation on errors - xfrm: prevent potential spectre v1 gadget in xfrm_xlate32_attr() - phylink: move phy_device_free() to correctly release phy device - eth: mlx5: - fix crash unsetting rx-vlan-filter in switchdev mode - fix hang on firmware reset - serialize module cleanup with reload and remove" * tag 'net-6.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (57 commits) selftests: forwarding: lib: quote the sysctl values net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP timestamping is used rds: rds_rm_zerocopy_callback() use list_first_entry() net: txgbe: Update support email address selftests: Fix failing VXLAN VNI filtering test selftests: mptcp: stop tests earlier selftests: mptcp: allow more slack for slow test-case mptcp: be careful on subflow status propagation on errors mptcp: fix locking for in-kernel listener creation mptcp: fix locking for setsockopt corner-case mptcp: do not wait for bare sockets' timeout net: ethernet: mtk_eth_soc: fix DSA TX tag hwaccel for switch port 0 nfp: ethtool: fix the bug of setting unsupported port speed txhash: fix sk->sk_txrehash default net: ethernet: mtk_eth_soc: fix wrong parameters order in __xdp_rxq_info_reg() net: ethernet: mtk_eth_soc: enable special tag when any MAC uses DSA net: sched: sch: Fix off by one in htb_activate_prios() igc: Add ndo_tx_timeout support net: mana: Fix accessing freed irq affinity_hint hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC ... commit 0b028189d1019ca352da108643b8f1503ee25a0e Merge: 94a1f56db688f ebebf05a4b06a Author: Linus Torvalds Date: Thu Feb 9 09:09:13 2023 -0800 Merge tag 'for-linus-2023020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - fix potential infinite loop with a badly crafted HID device (Xin Zhao) - fix regression from 6.1 in USB logitech devices potentially making their mouse wheel not working (Bastien Nocera) - clean up in AMD sensors, which fixes a long time resume bug (Mario Limonciello) - few device small fixes and quirks * tag 'for-linus-2023020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: Ignore battery for ELAN touchscreen 29DF on HP HID: amd_sfh: if no sensors are enabled, clean up HID: logitech: Disable hi-res scrolling on USB HID: core: Fix deadloop in hid_apply_multiplier. HID: Ignore battery for Elan touchscreen on Asus TP420IA HID: elecom: add support for TrackBall 056E:011C commit 94a1f56db688f134c763a4b2a5926b437f1ab4b9 Merge: 0983f6bf2bfc0 aa5465aeca3c6 Author: Linus Torvalds Date: Thu Feb 9 09:00:26 2023 -0800 Merge tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull cifx fix from Steve French: "Small fix for use after free" * tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix use-after-free in rdata->read_into_pages() commit 5f58d783fd7823b2c2d5954d1126e702f94bfc4c Author: Anand Jain Date: Fri Jan 20 21:47:16 2023 +0800 btrfs: free device in btrfs_close_devices for a single device filesystem We have this check to make sure we don't accidentally add older devices that may have disappeared and re-appeared with an older generation from being added to an fs_devices (such as a replace source device). This makes sense, we don't want stale disks in our file system. However for single disks this doesn't really make sense. I've seen this in testing, but I was provided a reproducer from a project that builds btrfs images on loopback devices. The loopback device gets cached with the new generation, and then if it is re-used to generate a new file system we'll fail to mount it because the new fs is "older" than what we have in cache. Fix this by freeing the cache when closing the device for a single device filesystem. This will ensure that the mount command passed device path is scanned successfully during the next mount. CC: stable@vger.kernel.org # 5.10+ Reported-by: Daan De Meyer Signed-off-by: Josef Bacik Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit 519b7e13b5ae8dd38da1e52275705343be6bb508 Author: Filipe Manana Date: Mon Jan 23 16:54:46 2023 +0000 btrfs: lock the inode in shared mode before starting fiemap Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in the inode's io tree. This however can lead to a deadlock if we have a concurrent fsync on the file and fiemap code triggers a fault when accessing the user space buffer with fiemap_fill_next_extent(). The deadlock happens on the inode's i_mmap_lock semaphore, which is taken both by fsync and btrfs_page_mkwrite(). This deadlock was recently reported by syzbot and triggers a trace like the following: task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 wait_on_state fs/btrfs/extent-io-tree.c:707 [inline] wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751 lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742 find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488 writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863 __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174 extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091 extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211 do_writepages+0x3c3/0x680 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439 btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline] start_ordered_ops fs/btrfs/file.c:1737 [inline] btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839 generic_write_sync include/linux/fs.h:2885 [inline] btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684 call_write_iter include/linux/fs.h:2189 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9 RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8 INFO: task syz-executor361:5697 blocked for more than 145 seconds. Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor361 state:D stack:21216 pid:5697 ppid:5119 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095 __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260 btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526 do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947 wp_page_shared+0x15e/0x380 mm/memory.c:3295 handle_pte_fault mm/memory.c:4949 [inline] __handle_mm_fault mm/memory.c:5073 [inline] handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219 do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [inline] exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233 Code: 74 0a 89 (...) RSP: 0018:ffffc9000570f330 EFLAGS: 00050202 RAX: ffffffff843e6601 RBX: 00007fffffffefc8 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffc9000570f3e0 RDI: 0000000020000120 RBP: ffffc9000570f490 R08: 0000000000000000 R09: fffff52000ae1e83 R10: fffff52000ae1e83 R11: 1ffff92000ae1e7c R12: 0000000000000038 R13: ffffc9000570f3e0 R14: 0000000020000120 R15: ffffc9000570f3e0 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xe9/0x130 lib/usercopy.c:34 copy_to_user include/linux/uaccess.h:169 [inline] fiemap_fill_next_extent+0x22e/0x410 fs/ioctl.c:144 emit_fiemap_extent+0x22d/0x3c0 fs/btrfs/extent_io.c:3458 fiemap_process_hole+0xa00/0xad0 fs/btrfs/extent_io.c:3716 extent_fiemap+0xe27/0x2100 fs/btrfs/extent_io.c:3922 btrfs_fiemap+0x172/0x1e0 fs/btrfs/inode.c:8209 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x185b/0x2980 fs/ioctl.c:810 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl+0x83/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d390d92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d405d87b0 RCX: 00007f7d4054e9b9 RDX: 0000000020000100 RSI: 00000000c020660b RDI: 0000000000000005 RBP: 00007f7d405a51d0 R08: 00007f7d390d9700 R09: 0000000000000000 R10: 00007f7d390d9700 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87b8 What happens is the following: 1) Task A is doing an fsync, enters btrfs_sync_file() and flushes delalloc before locking the inode and the i_mmap_lock semaphore, that is, before calling btrfs_inode_lock(); 2) After task A flushes delalloc and before it calls btrfs_inode_lock(), another task dirties a page; 3) Task B starts a fiemap without FIEMAP_FLAG_SYNC, so the page dirtied at step 2 remains dirty and unflushed. Then when it enters extent_fiemap() and it locks a file range that includes the range of the page dirtied in step 2; 4) Task A calls btrfs_inode_lock() and locks the inode (VFS lock) and the inode's i_mmap_lock semaphore in write mode. Then it tries to flush delalloc by calling start_ordered_ops(), which will block, at find_lock_delalloc_range(), when trying to lock the range of the page dirtied at step 2, since this range was locked by the fiemap task (at step 3); 5) Task B generates a page fault when accessing the user space fiemap buffer with a call to fiemap_fill_next_extent(). The fault handler needs to call btrfs_page_mkwrite() for some other page of our inode, and there we deadlock when trying to lock the inode's i_mmap_lock semaphore in read mode, since the fsync task locked it in write mode (step 4) and the fsync task can not progress because it's waiting to lock a file range that is currently locked by us (the fiemap task, step 3). Fix this by taking the inode's lock (VFS lock) in shared mode when entering fiemap. This effectively serializes fiemap with fsync (except the most expensive part of fsync, the log sync), preventing this deadlock. Reported-by: syzbot+cc35f55c41e34c30dcb5@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000032dc7305f2a66f46@google.com/ CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e7d636476ba73e61460619bd8822e16af3cba509 Author: Alex Deucher Date: Thu Feb 9 09:09:45 2023 -0500 Revert "drm/amd/display: disable S/G display on DCN 3.1.5" This reverts commit 3cc67fe1b3aa1ac4720e002f2aa2d08c9199a584. Some users have reported flickerng with S/G display. We've tried extensively to reproduce and debug the issue on a wide variety of platform configurations (DRAM bandwidth, etc.) and a variety of monitors, but so far have not been able to. We disabled S/G display on a number of platforms to address this but that leads to failure to pin framebuffers errors and blank displays when there is memory pressure or no displays at all on systems with limited carveout (e.g., Chromebooks). We have a parameter to disable this as a debugging option as a way for users to disable this, depending on their use case, and for us to help debug this further. Having this enabled seems like the lesser of to evils. Reviewed-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher commit 1b7ac7989ad82f8df6365cd6338df0d9937e0119 Author: Alex Deucher Date: Thu Feb 9 09:09:19 2023 -0500 Revert "drm/amd/display: disable S/G display on DCN 2.1.0" This reverts commit 2404f9b0ea0153c3fddb0c4d7a43869dc8608f6f. Some users have reported flickerng with S/G display. We've tried extensively to reproduce and debug the issue on a wide variety of platform configurations (DRAM bandwidth, etc.) and a variety of monitors, but so far have not been able to. We disabled S/G display on a number of platforms to address this but that leads to failure to pin framebuffers errors and blank displays when there is memory pressure or no displays at all on systems with limited carveout (e.g., Chromebooks). We have a parameter to disable this as a debugging option as a way for users to disable this, depending on their use case, and for us to help debug this further. Having this enabled seems like the lesser of to evils. Reviewed-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher commit 9734a75cd99d448814e64feca133dc9a6e3f65f2 Author: Alex Deucher Date: Thu Feb 9 09:07:42 2023 -0500 Revert "drm/amd/display: disable S/G display on DCN 3.1.2/3" This reverts commit f081cd4ca2658752a8c0e2353d50aec80d07c65f. Some users have reported flickerng with S/G display. We've tried extensively to reproduce and debug the issue on a wide variety of platform configurations (DRAM bandwidth, etc.) and a variety of monitors, but so far have not been able to. We disabled S/G display on a number of platforms to address this but that leads to failure to pin framebuffers errors and blank displays when there is memory pressure or no displays at all on systems with limited carveout (e.g., Chromebooks). We have a parameter to disable this as a debugging option as a way for users to disable this, depending on their use case, and for us to help debug this further. Having this enabled seems like the lesser of to evils. Reviewed-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher commit 4693e852f19a1338a49e540fb99fe3b2898d8594 Author: Alex Deucher Date: Thu Feb 9 09:00:02 2023 -0500 drm/amdgpu: add S/G display parameter Some users have reported flickerng with S/G display. We've tried extensively to reproduce and debug the issue on a wide variety of platform configurations (DRAM bandwidth, etc.) and a variety of monitors, but so far have not been able to. We disabled S/G display on a number of platforms to address this but that leads to failure to pin framebuffers errors and blank displays when there is memory pressure or no displays at all on systems with limited carveout (e.g., Chromebooks). Add a option to disable this as a debugging option as a way for users to disable this, depending on their use case, and for us to help debug this further. v2: fix typo Reviewed-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher commit 38c33ece232019c5b18b4d5ec0254807cac06b7c Merge: e02bbac74cdde 70daa5c8f001e Author: Jens Axboe Date: Thu Feb 9 08:12:06 2023 -0700 Merge tag 'nvme-6.2-2023-02-09' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fix from Christoph: "nvme fixes for Linux 6.2 - fix a static checker warning for a variable introduces in the last pull request (Tom Rix)" * tag 'nvme-6.2-2023-02-09' of git://git.infradead.org/nvme: nvme-auth: mark nvme_auth_wq static commit 303e724d7b1e1a0a93daf0b1ab5f7c4f53543b34 Author: Mark Pearson Date: Wed Feb 8 13:12:23 2023 -0500 usb: core: add quirk for Alcor Link AK9563 smartcard reader The Alcor Link AK9563 smartcard reader used on some Lenovo platforms doesn't work. If LPM is enabled the reader will provide an invalid usb config descriptor. Added quirk to disable LPM. Verified fix on Lenovo P16 G1 and T14 G3 Tested-by: Miroslav Zatko Tested-by: Dennis Wassenberg Cc: stable@vger.kernel.org Signed-off-by: Dennis Wassenberg Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230208181223.1092654-1-mpearson-lenovo@squebb.ca Signed-off-by: Greg Kroah-Hartman commit 54e5c00a4eb0a4c663445b245f641bbfab142430 Author: Prashant Malani Date: Wed Feb 8 20:53:19 2023 +0000 usb: typec: altmodes/displayport: Fix probe pin assign check While checking Pin Assignments of the port and partner during probe, we don't take into account whether the peripheral is a plug or receptacle. This manifests itself in a mode entry failure on certain docks and dongles with captive cables. For instance, the Startech.com Type-C to DP dongle (Model #CDP2DP) advertises its DP VDO as 0x405. This would fail the Pin Assignment compatibility check, despite it supporting Pin Assignment C as a UFP. Update the check to use the correct DP Pin Assign macros that take the peripheral's receptacle bit into account. Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") Cc: stable@vger.kernel.org Reported-by: Diana Zigterman Signed-off-by: Prashant Malani Link: https://lore.kernel.org/r/20230208205318.131385-1-pmalani@chromium.org Signed-off-by: Greg Kroah-Hartman commit bb07bd68fa0983e3915f83c471382868860389fe Author: Paul Cercueil Date: Thu Feb 9 10:56:26 2023 +0000 Revert "usb: gadget: u_ether: Do not make UDC parent of the net device" This reverts commit 321b59870f850a10dbb211ecd2bd87b41497ea6f. This commit broke USB networking on Ingenic SoCs and maybe elsewhere. The actual reason is unknown; and while a proper fix would be better, we're sitting at -rc7 now, so a revert is justified - and we can work on re-introducing this change for 6.3. Fixes: 321b59870f85 ("usb: gadget: u_ether: Do not make UDC parent of the net device") Signed-off-by: Paul Cercueil Acked-by: Sascha Hauer Link: https://lore.kernel.org/r/20230209105626.10597-1-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman commit 190233164cd77115f8dea718cbac561f557092c6 Author: Darren Hart Date: Wed Feb 8 16:28:21 2023 -0800 arm64: efi: Force the use of SetVirtualAddressMap() on eMAG and Altra Max machines Commit 550b33cfd445 ("arm64: efi: Force the use of SetVirtualAddressMap() on Altra machines") identifies the Altra family via the family field in the type#1 SMBIOS record. eMAG and Altra Max machines are similarly affected but not detected with the strict strcmp test. The type1_family smbios string is not an entirely reliable means of identifying systems with this issue as OEMs can, and do, use their own strings for these fields. However, until we have a better solution, capture the bulk of these systems by adding strcmp matching for "eMAG" and "Altra Max". Fixes: 550b33cfd445 ("arm64: efi: Force the use of SetVirtualAddressMap() on Altra machines") Cc: # 6.1.x Cc: Alexandru Elisei Signed-off-by: Darren Hart Tested-by: Justin He Signed-off-by: Ard Biesheuvel commit 3a082086aa200852545cf15159213582c0c80eba Author: Hangbin Liu Date: Wed Feb 8 11:21:10 2023 +0800 selftests: forwarding: lib: quote the sysctl values When set/restore sysctl value, we should quote the value as some keys may have multi values, e.g. net.ipv4.ping_group_range Fixes: f5ae57784ba8 ("selftests: forwarding: lib: Add sysctl_set(), sysctl_restore()") Signed-off-by: Hangbin Liu Reviewed-by: Petr Machata Link: https://lore.kernel.org/r/20230208032110.879205-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 2fcde9fe258ec8b88d41def38e43ca4da32c0a9a Author: Vladimir Oltean Date: Tue Feb 7 20:31:17 2023 +0200 net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP timestamping is used While running this selftest which usually passes: ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0 TEST: swp0: Unicast IPv4 to primary MAC address [ OK ] TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ] TEST: swp0: Multicast IPv4 to joined group [ OK ] TEST: swp0: Multicast IPv4 to unknown group [ OK ] TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ] TEST: swp0: Multicast IPv6 to joined group [ OK ] TEST: swp0: Multicast IPv6 to unknown group [ OK ] TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ] if I start PTP timestamping then run it again (debug prints added by me), the unknown IPv6 MC traffic is seen by the CPU port even when it should have been dropped: ~/selftests/drivers/net/dsa# ptp4l -i swp0 -2 -P -m ptp4l[225.410]: selected /dev/ptp1 as PTP clock [ 225.445746] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_add: port 0 adding L2 PTP trap [ 225.453815] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP event trap [ 225.462703] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP general trap [ 225.471768] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP event trap [ 225.480651] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP general trap ptp4l[225.488]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE ptp4l[225.488]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE ^C ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0 TEST: swp0: Unicast IPv4 to primary MAC address [ OK ] TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ] TEST: swp0: Multicast IPv4 to joined group [ OK ] TEST: swp0: Multicast IPv4 to unknown group [ OK ] TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ] TEST: swp0: Multicast IPv6 to joined group [ OK ] TEST: swp0: Multicast IPv6 to unknown group [FAIL] reception succeeded, but should have failed TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ] The PGID_MCIPV6 is configured correctly to not flood to the CPU, I checked that. Furthermore, when I disable back PTP RX timestamping (ptp4l doesn't do that when it exists), packets are RX filtered again as they should be: ~/selftests/drivers/net/dsa# hwstamp_ctl -i swp0 -r 0 [ 218.202854] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_del: port 0 removing L2 PTP trap [ 218.212656] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP event trap [ 218.222975] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP general trap [ 218.233133] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP event trap [ 218.242251] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP general trap current settings: tx_type 1 rx_filter 12 new settings: tx_type 1 rx_filter 0 ~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0 TEST: swp0: Unicast IPv4 to primary MAC address [ OK ] TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ] TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ] TEST: swp0: Multicast IPv4 to joined group [ OK ] TEST: swp0: Multicast IPv4 to unknown group [ OK ] TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ] TEST: swp0: Multicast IPv6 to joined group [ OK ] TEST: swp0: Multicast IPv6 to unknown group [ OK ] TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ] TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ] So it's clear that something in the PTP RX trapping logic went wrong. Looking a bit at the code, I can see that there are 4 typos, which populate "ipv4" VCAP IS2 key filter fields for IPv6 keys. VCAP IS2 keys of type OCELOT_VCAP_KEY_IPV4 and OCELOT_VCAP_KEY_IPV6 are handled by is2_entry_set(). OCELOT_VCAP_KEY_IPV4 looks at &filter->key.ipv4, and OCELOT_VCAP_KEY_IPV6 at &filter->key.ipv6. Simply put, when we populate the wrong key field, &filter->key.ipv6 fields "proto.mask" and "proto.value" remain all zeroes (or "don't care"). So is2_entry_set() will enter the "else" of this "if" condition: if (msk == 0xff && (val == IPPROTO_TCP || val == IPPROTO_UDP)) and proceed to ignore the "proto" field. The resulting rule will match on all IPv6 traffic, trapping it to the CPU. This is the reason why the local_termination.sh selftest sees it, because control traps are stronger than the PGID_MCIPV6 used for flooding (from the forwarding data path). But the problem is in fact much deeper. We trap all IPv6 traffic to the CPU, but if we're bridged, we set skb->offload_fwd_mark = 1, so software forwarding will not take place and IPv6 traffic will never reach its destination. The fix is simple - correct the typos. I was intentionally inaccurate in the commit message about the breakage occurring when any PTP timestamping is enabled. In fact it only happens when L4 timestamping is requested (HWTSTAMP_FILTER_PTP_V2_EVENT or HWTSTAMP_FILTER_PTP_V2_L4_EVENT). But ptp4l requests a larger RX timestamping filter than it needs for "-2": HWTSTAMP_FILTER_PTP_V2_EVENT. I wanted people skimming through git logs to not think that the bug doesn't affect them because they only use ptp4l in L2 mode. Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230207183117.1745754-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit f753a68980cf4b59a80fe677619da2b1804f526d Author: Pietro Borrello Date: Tue Feb 7 18:26:34 2023 +0000 rds: rds_rm_zerocopy_callback() use list_first_entry() rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Use list_first_entry() to actually access the first element of the rs_zcookie_queue list. Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Reviewed-by: Willem de Bruijn Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it Signed-off-by: Paolo Abeni commit 247a631f9c0ffb37ed0786a94cb4c5f2b6fc7ab1 Author: Dom Cobley Date: Fri Jan 27 15:55:58 2023 +0100 drm/vc4: crtc: Increase setup cost in core clock calculation to handle extreme reduced blanking The formula that determines the core clock requirement based on pixel clock and blanking has been determined experimentally to minimise the clock while supporting all modes we've seen. A new reduced blanking mode (4kp60 at 533MHz rather than the standard 594MHz) has been seen that doesn't produce a high enough clock and results in "flip_done timed out" error. Increase the setup cost in the formula to make this work. The result is a reduced blanking mode increases by up to 7MHz while leaving the standard timing mode untouched Link: https://github.com/raspberrypi/linux/issues/4446 Fixes: 16e101051f32 ("drm/vc4: Increase the core clock based on HVS load") Signed-off-by: Dom Cobley Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230127145558.446123-1-maxime@cerno.tech commit 7fa846b95ce8fd4cb80f32516e2ad3f4ea4d6742 Author: Dom Cobley Date: Fri Jan 27 17:12:19 2023 +0100 drm/vc4: hdmi: Always enable GCP with AVMUTE cleared Issue is some displays go blank at the point of firmware to kms handover. Plugging/unplugging hdmi cable, power cycling display, or switching standby off/on typically resolve this case. Finally managed to find a display that suffers from this, and track down the issue. The firmware uses AVMUTE in normal operation. It will set AVMUTE before disabling hdmi clocks and phy. It will clear AVMUTE after clocks and phy are set up for a new hdmi mode. But with the hdmi handover from firmware to kms, AVMUTE will be set by firmware. kms driver typically has no GCP packet (except for deep colour modes). The spec isn't clear on whether to consider the AVMUTE as continuing indefinitely in the absence of a GCP packet, or to consider that state to have ended. Most displays behave as we want, but there are a number (from multiple manufacturers) which need to see AVMUTE cleared before displaying a picture. Lets just always enable GCP packet with AVMUTE cleared. That resolves the issue on problematic displays. From HDMI 1.4 spec: A CD field of zero (Color Depth not indicated) shall be used whenever the Sink does not indicate support for Deep Color. This value may also be used in Deep Color mode to transmit a GCP indicating only non-Deep Color information (e.g. AVMUTE). So use CD=0 where we were previously not enabling a GCP. Link: https://forum.libreelec.tv/thread/24780-le-10-0-1-rpi4-no-picture-after-update-from-le-10-0-0 Signed-off-by: Dom Cobley Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230127161219.457058-1-maxime@cerno.tech commit 6b77b16de75a6efc0870b1fa467209387cbee8f3 Author: Dave Stevenson Date: Fri Jan 27 16:57:08 2023 +0100 drm/vc4: Fix YUV plane handling when planes are in different buffers YUV images can either be presented as one allocation with offsets for the different planes, or multiple allocations with 0 offsets. The driver only ever calls drm_fb_[dma|cma]_get_gem_obj with plane index 0, therefore any application using the second approach was incorrectly rendered. Correctly determine the address for each plane, removing the assumption that the base address is the same for each. Fixes: fc04023fafec ("drm/vc4: Add support for YUV planes.") Signed-off-by: Dave Stevenson Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230127155708.454704-1-maxime@cerno.tech commit 4684f5ce839ab27f5f0414c08084468098363d27 Merge: 04119ab1a49fc c6ac406cd8ff6 Author: Dave Airlie Date: Thu Feb 9 17:04:25 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-02-08' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-02-08: amdgpu: - Flickering fixes for DCN 2.1, 3.1.2/3 - Re-enable S/G display on DCN 3.1.4 - Properly fix S/G display with AGP aperture enabled - Fix cursor offset with 180 rotation - SMU13 fixes - Use TGID for GPUVM traces - Fix oops on in fence error path - Don't run IB tests on hw rings when sw rings are in use Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230209045321.565132-1-alexander.deucher@amd.com commit 646be03ec46cc736d78ca4db2e0b00fa84446d77 Merge: 363d7c2298e73 6028da3f125fe Author: Jakub Kicinski Date: Wed Feb 8 21:35:38 2023 -0800 Merge tag 'ipsec-2023-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== ipsec 2023-02-08 1) Fix policy checks for nested IPsec tunnels when using xfrm interfaces. From Benedict Wong. 2) Fix netlink message expression on 32=>64-bit messages translators. From Anastasia Belova. 3) Prevent potential spectre v1 gadget in xfrm_xlate32_attr. From Eric Dumazet. 4) Always consistently use time64_t in xfrm_timer_handler. From Eric Dumazet. 5) Fix KCSAN reported bug: Multiple cpus can update use_time at the same time. From Eric Dumazet. 6) Fix SCP copy from IPv4 to IPv6 on interfamily tunnel. From Christian Hopps. * tag 'ipsec-2023-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: fix bug with DSCP copy to v6 from v4 tunnel xfrm: annotate data-race around use_time xfrm: consistently use time64_t in xfrm_timer_handler() xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() xfrm: compat: change expression for switch in xfrm_xlate64 Fix XFRM-I support for nested ESP tunnels ==================== Link: https://lore.kernel.org/r/20230208114322.266510-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 363d7c2298e730083df942446534825654d65c5e Author: Jiawen Wu Date: Wed Feb 8 10:30:35 2023 +0800 net: txgbe: Update support email address Update new email address for Wangxun 10Gb NIC support team. Signed-off-by: Jiawen Wu Link: https://lore.kernel.org/r/20230208023035.3371250-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit c6ac406cd8ff610a2d5da298b1d3071acfcde7f0 Author: Jane Jian Date: Fri Jan 13 18:53:45 2023 +0800 drm/amdgpu/smu: skip pptable init under sriov sriov does not need to init pptable from amdgpu driver we finish it from PF Signed-off-by: Jane Jian Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 6c1a6d0b64e1a15016ba7450cce8629f94de56c7 Author: JesseZhang Date: Wed Feb 8 10:07:18 2023 +0800 amd/amdgpu: remove test ib on hw ring test ib function is not necessary on hw ring, so remove it. v2: squash in NULL check fix Signed-off-by: JesseZhang Acked-by: Christian König Signed-off-by: Alex Deucher commit 5ad7bbf3dba5c4a684338df1f285080f2588b535 Author: Guilherme G. Piccoli Date: Thu Feb 2 10:48:56 2023 -0300 drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini Currently amdgpu calls drm_sched_fini() from the fence driver sw fini routine - such function is expected to be called only after the respective init function - drm_sched_init() - was executed successfully. Happens that we faced a driver probe failure in the Steam Deck recently, and the function drm_sched_fini() was called even without its counter-part had been previously called, causing the following oops: amdgpu: probe of 0000:04:00.0 failed with error -110 BUG: kernel NULL pointer dereference, address: 0000000000000090 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 609 Comm: systemd-udevd Not tainted 6.2.0-rc3-gpiccoli #338 Hardware name: Valve Jupiter/Jupiter, BIOS F7A0113 11/04/2022 RIP: 0010:drm_sched_fini+0x84/0xa0 [gpu_sched] [...] Call Trace: amdgpu_fence_driver_sw_fini+0xc8/0xd0 [amdgpu] amdgpu_device_fini_sw+0x2b/0x3b0 [amdgpu] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] devm_drm_dev_init_release+0x49/0x70 [...] To prevent that, check if the drm_sched was properly initialized for a given ring before calling its fini counter-part. Notice ideally we'd use sched.ready for that; such field is set as the latest thing on drm_sched_init(). But amdgpu seems to "override" the meaning of such field - in the above oops for example, it was a GFX ring causing the crash, and the sched.ready field was set to true in the ring init routine, regardless of the state of the DRM scheduler. Hence, we ended-up using sched.ops as per Christian's suggestion [0], and also removed the no_scheduler check [1]. [0] https://lore.kernel.org/amd-gfx/984ee981-2906-0eaf-ccec-9f80975cb136@amd.com/ [1] https://lore.kernel.org/amd-gfx/cd0e2994-f85f-d837-609f-7056d5fb7231@amd.com/ Fixes: 067f44c8b459 ("drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)") Suggested-by: Christian König Cc: Guchun Chen Cc: Luben Tuikov Cc: Mario Limonciello Reviewed-by: Luben Tuikov Signed-off-by: Guilherme G. Piccoli Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e53448e0a1efa5133c7db78f1df1f4caf177676b Author: Friedrich Vock Date: Thu Feb 2 17:21:03 2023 +0100 drm/amdgpu: Use the TGID for trace_amdgpu_vm_update_ptes The pid field corresponds to the result of gettid() in userspace. However, userspace cannot reliably attribute PTE events to processes with just the thread id. This patch allows userspace to easily attribute PTE update events to specific processes by comparing this field with the result of getpid(). For attributing events to specific threads, the thread id is also contained in the common fields of each trace event. Reviewed-by: Christian König Signed-off-by: Friedrich Vock Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c108a18462949fe709ebd6b0be68398d643bc285 Author: Kent Russell Date: Mon Feb 6 12:21:42 2023 -0500 drm/amdgpu: Add unique_id support for GC 11.0.1/2 These can support unique_id, so create the sysfs file for them Signed-off-by: Kent Russell Reviewed-by: Harish Kasiviswanathan Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit dc38b996db968f51f0fe45845a519c5cd7f6bd04 Author: Evan Quan Date: Tue Feb 7 10:42:31 2023 +0800 drm/amd/pm: bump SMU 13.0.7 driver_if header version This can suppress the warning caused by version mismatch. Signed-off-by: Evan Quan Acked-by: Alex Deucher Acked-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 9874cc2df4e892c8744aa0472866cbf7c3cf1862 Author: Evan Quan Date: Tue Jan 31 10:40:09 2023 +0800 drm/amd/pm: bump SMU 13.0.0 driver_if header version This can suppress the warning caused by version mismatch. Signed-off-by: Evan Quan Acked-by: Alex Deucher Acked-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 0e763afcb50814e256ecb780fcc0f3bade2e1a0c Author: Evan Quan Date: Fri Feb 3 15:33:59 2023 +0800 drm/amd/pm: add SMU 13.0.7 missing GetPptLimit message mapping Add missing GetPptLimit message mapping. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit ff8ced4eefbff5f27a21015b20228ae0118d2f7d Merge: b963d9d5b9437 8f0d1451ecf7b Author: Jakub Kicinski Date: Wed Feb 8 19:23:44 2023 -0800 Merge tag 'mlx5-fixes-2023-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-02-07 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Serialize module cleanup with reload and remove net/mlx5: fw_tracer, Zero consumer index when reloading the tracer net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers net/mlx5: Expose SF firmware pages counter net/mlx5: Store page counters in a single array net/mlx5e: IPoIB, Show unknown speed instead of error net/mlx5e: Fix crash unsetting rx-vlan-filter in switchdev mode net/mlx5: Bridge, fix ageing of peer FDB entries net/mlx5: DR, Fix potential race in dr_rule_create_rule_nic net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change ==================== Link: https://lore.kernel.org/r/20230208030302.95378-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 49d0555976f0972af68397ed996375c135b38ba7 Author: Melissa Wen Date: Tue Jan 31 15:05:46 2023 -0100 drm/amd/display: fix cursor offset on rotation 180 Cursor gets clipped off in the middle of the screen with hw rotation 180. Fix a miscalculation of cursor offset when it's placed near the edges in the pipe split case. Cursor bugs with hw rotation were reported on AMD issue tracker: https://gitlab.freedesktop.org/drm/amd/-/issues/2247 The issues on rotation 270 was fixed by: https://lore.kernel.org/amd-gfx/20221118125935.4013669-22-Brian.Chang@amd.com/ that partially addressed the rotation 180 too. So, this patch is the final bits for rotation 180. Reported-by: Xaver Hugl Reviewed-by: Harry Wentland Fixes: 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror") Signed-off-by: Melissa Wen Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5630a35024d12432827bd7e7986dd60cfe2f983b Author: Kenneth Feng Date: Fri Feb 3 14:19:37 2023 +0800 drm/amd/amdgpu: enable athub cg 11.0.3 enable athub cg on gc 11.0.3 Signed-off-by: Kenneth Feng Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 7ece674cd9468ce740494f6108c39831cfc7eb4e Author: Alex Deucher Date: Tue Jan 31 13:10:55 2023 -0500 Revert "drm/amd/display: disable S/G display on DCN 3.1.4" This reverts commit 9aa15370819294beb7eb67c9dcbf654d79ff8790. This is fixed now so we can re-enable S/G display on DCN 3.1.4. Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 5c4e8c71d1202cd84d870e7e5cb8d6b52f9c3507 Author: Alex Deucher Date: Tue Jan 31 09:56:46 2023 -0500 drm/amd/display: properly handling AGP aperture in vm setup Take into account whether or not the AGP aperture is enabled or not when calculating the system aperture. Fixes white screens with DCN 3.1.4. Based on a patch from Yifan Zhang Cc: Yifan Zhang Acked-by: Harry Wentland Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 077e9659581acab70f2dcc04b5bc799aca3a056b Author: Alex Deucher Date: Wed Jan 25 09:57:27 2023 -0500 drm/amd/display: disable S/G display on DCN 3.1.2/3 Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2352 Cc: roman.li@amd.com Cc: yifan1.zhang@amd.com Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 877f26bf3ca65447e923e86305a7f2a20d059e21 Author: Alex Deucher Date: Thu Jan 26 10:15:37 2023 -0500 drm/amd/display: disable S/G display on DCN 2.1.0 Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2352 Cc: roman.li@amd.com Cc: yifan1.zhang@amd.com Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit b963d9d5b9437a6b99504987310f98537c9e77d4 Author: Ido Schimmel Date: Tue Feb 7 16:18:19 2023 +0200 selftests: Fix failing VXLAN VNI filtering test iproute2 does not recognize the "group6" and "remote6" keywords. Fix by using "group" and "remote" instead. Before: # ./test_vxlan_vnifiltering.sh [...] Tests passed: 25 Tests failed: 2 After: # ./test_vxlan_vnifiltering.sh [...] Tests passed: 27 Tests failed: 0 Fixes: 3edf5f66c12a ("selftests: add new tests for vxlan vnifiltering") Signed-off-by: Ido Schimmel Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230207141819.256689-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit f545e8831e70065e127f903fc7aca09aa50422c7 Author: Kan Liang Date: Wed Feb 8 09:23:40 2023 -0800 x86/cpu: Add Lunar Lake M Intel confirmed the existence of this CPU in Q4'2022 earnings presentation. Add the CPU model number. [ dhansen: Merging these as soon as possible makes it easier on all the folks developing model-specific features. ] Signed-off-by: Kan Liang Signed-off-by: Tony Luck Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20230208172340.158548-1-tony.luck%40intel.com commit ae052e3ae09572194d7e574906db7272041577d3 Author: Nadav Amit Date: Wed Feb 8 07:17:08 2023 +0000 x86/kprobes: Fix 1 byte conditional jump target Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") broke kprobes. Setting a probe-point on 1 byte conditional jump can cause the kernel to crash when the (signed) relative jump offset gets treated as unsigned. Fix by replacing the unsigned 'immediate.bytes' (plus a cast) with the signed 'immediate.value' when assigning to the relative jump offset. [ dhansen: clarified changelog ] Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned") Suggested-by: Masami Hiramatsu (Google) Suggested-by: Dave Hansen Signed-off-by: Nadav Amit Signed-off-by: Dave Hansen Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20230208071708.4048-1-namit%40vmware.com commit 6a7ff131f17f44c593173c5ee30e2c03ef211685 Author: Ville Syrjälä Date: Tue Feb 7 08:43:35 2023 +0200 drm/i915: Fix VBT DSI DVO port handling Turns out modern (icl+) VBTs still declare their DSI ports as MIPI-A and MIPI-C despite the PHYs now being A and B. Remap appropriately to allow the panels declared as MIPI-C to work. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8016 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230207064337.18697-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 118b5c136c04da705b274b0d39982bb8b7430fc5) Signed-off-by: Rodrigo Vivi commit 5afc7eefe41645259da84898fc55f6f46cb4de47 Author: Rander Wang Date: Wed Feb 8 12:44:04 2023 +0200 ASoC: SOF: ops: refine parameters order in function snd_sof_dsp_update8 SOF driver calls snd_sof_dsp_update8 with parameters mask and value but the snd_sof_dsp_update8 declares these two parameters in reverse order. This causes some issues such as d0i3 register can't be set correctly Now change function definition according to common SOF usage. Fixes: c28a36b012f1 ("ASoC: SOF: ops: add snd_sof_dsp_updateb() helper") Signed-off-by: Rander Wang Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Chao Song Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230208104404.20554-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 965bffd2dd8a2c769ae17e5344545ba03d584176 Merge: 1a3245fe0cf84 070d6dafacbaa Author: David S. Miller Date: Wed Feb 8 09:39:34 2023 +0000 Merge branch 'mptcp-fixes' Matthieu Baerts says: ==================== mptcp: fixes for v6.2 Patch 1 clears resources earlier if there is no more reasons to keep MPTCP sockets alive. Patches 2 and 3 fix some locking issues visible in some rare corner cases: the linked issues should be quite hard to reproduce. Patch 4 makes sure subflows are correctly cleaned after the end of a connection. Patch 5 and 6 improve the selftests stability when running in a slow environment by transfering data for a longer period on one hand and by stopping the tests when all expected events have been observed on the other hand. All these patches fix issues introduced before v6.2. ==================== Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 070d6dafacbaa9d1f2e4e3edc263853d194af15e Author: Matthieu Baerts Date: Tue Feb 7 14:04:18 2023 +0100 selftests: mptcp: stop tests earlier These 'endpoint' tests from 'mptcp_join.sh' selftest start a transfer in the background and check the status during this transfer. Once the expected events have been recorded, there is no reason to wait for the data transfer to finish. It can be stopped earlier to reduce the execution time by more than half. For these tests, the exchanged data were not verified. Errors, if any, were ignored but that's fine, plenty of other tests are looking at that. It is then OK to mute stderr now that we are sure errors will be printed (and still ignored) because the transfer is stopped before the end. Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit a635a8c3df66ab68dc088c08a4e9e955e22c0e64 Author: Paolo Abeni Date: Tue Feb 7 14:04:17 2023 +0100 selftests: mptcp: allow more slack for slow test-case A test-case is frequently failing on some extremely slow VMs. The mptcp transfer completes before the script is able to do all the required PM manipulation. Address the issue in the simplest possible way, making the transfer even more slow. Additionally dump more info in case of failures, to help debugging similar problems in the future and init dump_stats var. Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/323 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 1249db44a102d9d3541ed7798d4b01ffdcf03524 Author: Paolo Abeni Date: Tue Feb 7 14:04:16 2023 +0100 mptcp: be careful on subflow status propagation on errors Currently the subflow error report callback unconditionally propagates the fallback subflow status to the owning msk. If the msk is already orphaned, the above prevents the code from correctly tracking the msk moving to the TCP_CLOSE state and doing the appropriate cleanup. All the above causes increasing memory usage over time and sporadic self-tests failures. There is a great deal of infrastructure trying to propagate correctly the fallback subflow status to the owning mptcp socket, e.g. via mptcp_subflow_eof() and subflow_sched_work_if_closed(): in the error propagation path we need only to cope with unorphaned sockets. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/339 Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit ad2171009d968104ccda9dc517f5a3ba891515db Author: Paolo Abeni Date: Tue Feb 7 14:04:15 2023 +0100 mptcp: fix locking for in-kernel listener creation For consistency, in mptcp_pm_nl_create_listen_socket(), we need to call the __mptcp_nmpc_socket() under the msk socket lock. Note that as a side effect, mptcp_subflow_create_socket() needs a 'nested' lockdep annotation, as it will acquire the subflow (kernel) socket lock under the in-kernel listener msk socket lock. The current lack of locking is almost harmless, because the relevant socket is not exposed to the user space, but in future we will add more complexity to the mentioned helper, let's play safe. Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 21e43569685de4ad773fb060c11a15f3fd5e7ac4 Author: Paolo Abeni Date: Tue Feb 7 14:04:14 2023 +0100 mptcp: fix locking for setsockopt corner-case We need to call the __mptcp_nmpc_socket(), and later subflow socket access under the msk socket lock, or e.g. a racing connect() could change the socket status under the hood, with unexpected results. Fixes: 54635bd04701 ("mptcp: add TCP_FASTOPEN_CONNECT socket option") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit d4e85922e3e7ef2071f91f65e61629b60f3a9cf4 Author: Paolo Abeni Date: Tue Feb 7 14:04:13 2023 +0100 mptcp: do not wait for bare sockets' timeout If the peer closes all the existing subflows for a given mptcp socket and later the application closes it, the current implementation let it survive until the timewait timeout expires. While the above is allowed by the protocol specification it consumes resources for almost no reason and additionally causes sporadic self-tests failures. Let's move the mptcp socket to the TCP_CLOSE state when there are no alive subflows at close time, so that the allocated resources will be freed immediately. Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 1a3245fe0cf84e630598da4ab110a5f8a2d6730d Author: Vladimir Oltean Date: Tue Feb 7 12:30:27 2023 +0200 net: ethernet: mtk_eth_soc: fix DSA TX tag hwaccel for switch port 0 Arınç reports that on his MT7621AT Unielec U7621-06 board and MT7623NI Bananapi BPI-R2, packets received by the CPU over mt7530 switch port 0 (of which this driver acts as the DSA master) are not processed correctly by software. More precisely, they arrive without a DSA tag (in packet or in the hwaccel area - skb_metadata_dst()), so DSA cannot demux them towards the switch's interface for port 0. Traffic from other ports receives a skb_metadata_dst() with the correct port and is demuxed properly. Looking at mtk_poll_rx(), it becomes apparent that this driver uses the skb vlan hwaccel area: union { u32 vlan_all; struct { __be16 vlan_proto; __u16 vlan_tci; }; }; as a temporary storage for the VLAN hwaccel tag, or the DSA hwaccel tag. If this is a DSA master it's a DSA hwaccel tag, and finally clears up the skb VLAN hwaccel header. I'm guessing that the problem is the (mis)use of API. skb_vlan_tag_present() looks like this: #define skb_vlan_tag_present(__skb) (!!(__skb)->vlan_all) So if both vlan_proto and vlan_tci are zeroes, skb_vlan_tag_present() returns precisely false. I don't know for sure what is the format of the DSA hwaccel tag, but I surely know that lowermost 3 bits of vlan_proto are 0 when receiving from port 0: unsigned int port = vlan_proto & GENMASK(2, 0); If the RX descriptor has no other bits set to non-zero values in RX_DMA_VTAG, then the call to __vlan_hwaccel_put_tag() will not, in fact, make the subsequent skb_vlan_tag_present() return true, because it's implemented like this: static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci) { skb->vlan_proto = vlan_proto; skb->vlan_tci = vlan_tci; } What we need to do to fix this problem (assuming this is the problem) is to stop using skb->vlan_all as temporary storage for driver affairs, and just create some local variables that serve the same purpose, but hopefully better. Instead of calling skb_vlan_tag_present(), let's look at a boolean has_hwaccel_tag which we set to true when the RX DMA descriptors have something. Disambiguate based on netdev_uses_dsa() whether this is a VLAN or DSA hwaccel tag, and only call __vlan_hwaccel_put_tag() if we're certain it's a VLAN tag. Arınç confirms that the treatment works, so this validates the assumption. Link: https://lore.kernel.org/netdev/704f3a72-fc9e-714a-db54-272e17612637@arinc9.com/ Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") Reported-by: Arınç ÜNAL Tested-by: Arınç ÜNAL Signed-off-by: Vladimir Oltean Reviewed-by: Felix Fietkau Signed-off-by: David S. Miller commit 821de68c1f9c0236b0b9c10834cda900ae9b443c Author: Yu Xiao Date: Tue Feb 7 11:16:50 2023 +0100 nfp: ethtool: fix the bug of setting unsupported port speed Unsupported port speed can be set and cause error. Now fixing it and return an error if setting unsupported speed. This fix depends on the following, which was included in v6.2-rc1: commit a61474c41e8c ("nfp: ethtool: support reporting link modes"). Fixes: 7c698737270f ("nfp: add support for .set_link_ksettings()") Signed-off-by: Yu Xiao Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit c11204c78d6966c5bda6dd05c3ac5cbb193f93e3 Author: Kevin Yang Date: Tue Feb 7 02:08:20 2023 +0000 txhash: fix sk->sk_txrehash default This code fix a bug that sk->sk_txrehash gets its default enable value from sysctl_txrehash only when the socket is a TCP listener. We should have sysctl_txrehash to set the default sk->sk_txrehash, no matter TCP, nor listerner/connector. Tested by following packetdrill: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 socket(..., SOCK_DGRAM, IPPROTO_UDP) = 4 // SO_TXREHASH == 74, default to sysctl_txrehash == 1 +0 getsockopt(3, SOL_SOCKET, 74, [1], [4]) = 0 +0 getsockopt(4, SOL_SOCKET, 74, [1], [4]) = 0 Fixes: 26859240e4ee ("txhash: Add socket option to control TX hash rethink behavior") Signed-off-by: Kevin Yang Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c966153d120222cd4e85e1e1601584d7d4d91dcb Author: Tariq Toukan Date: Mon Feb 6 22:47:03 2023 +0200 net: ethernet: mtk_eth_soc: fix wrong parameters order in __xdp_rxq_info_reg() Parameters 'queue_index' and 'napi_id' are passed in a swapped order. Fix it here. Fixes: 23233e577ef9 ("net: ethernet: mtk_eth_soc: rely on page_pool for single page buffers") Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 21386e692613702502f7c982d81e0dfa86d25cfd Author: Arınç ÜNAL Date: Sun Feb 5 20:53:31 2023 +0300 net: ethernet: mtk_eth_soc: enable special tag when any MAC uses DSA The special tag is only enabled when the first MAC uses DSA. However, it must be enabled when any MAC uses DSA. Change the check accordingly. This fixes hardware DSA untagging not working on the second MAC of the MT7621 and MT7623 SoCs, and likely other SoCs too. Therefore, remove the check that disables hardware DSA untagging for the second MAC of the MT7621 and MT7623 SoCs. Fixes: a1f47752fd62 ("net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC") Co-developed-by: Richard van Schagen Signed-off-by: Richard van Schagen Signed-off-by: Arınç ÜNAL Signed-off-by: David S. Miller commit 88d18b8896bd98e636b632f805b7e84e61458255 Author: Edson Juliano Drosdeck Date: Tue Feb 7 15:37:20 2023 -0300 ALSA: hda/realtek: Add Positivo N14KP6-TG Positivo N14KP6-TG (1c6c:1251) require quirk for enabling headset-mic Signed-off-by: Edson Juliano Drosdeck Cc: Link: https://lore.kernel.org/r/20230207183720.2519-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit 9cec2aaffe969f2a3e18b5ec105fc20bb908e475 Author: Dan Carpenter Date: Mon Feb 6 16:18:32 2023 +0300 net: sched: sch: Fix off by one in htb_activate_prios() The > needs be >= to prevent an out of bounds access. Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/Y+D+KN18FQI2DKLq@kili Signed-off-by: Jakub Kicinski commit 70daa5c8f001e351af174c40ac21eb0a25600483 Author: Tom Rix Date: Mon Feb 6 06:57:00 2023 -0800 nvme-auth: mark nvme_auth_wq static Fix a smatch report for the newly added nvme_auth_wq. Signed-off-by: Tom Rix Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 91701f63d8e14fb86ec58bb0b5a6c9d2683d99b4 Merge: 9b275176270ef 4a606ce68426c Author: Jakub Kicinski Date: Tue Feb 7 22:04:44 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-02-06 (ice) This series contains updates to ice driver only. Ani removes WQ_MEM_RECLAIM flag from workqueue to resolve check_flush_dependency warning. Michal fixes KASAN out-of-bounds warning. Brett corrects behaviour for port VLAN Rx filters to prevent receiving of unintended traffic. Dan Carpenter fixes possible off by one issue. Zhang Changzhong adjusts error path for switch recipe to prevent memory leak. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: switch: fix potential memleak in ice_add_adv_recipe() ice: Fix off by one in ice_tc_forward_to_queue() ice: Fix disabling Rx VLAN filtering with port VLAN enabled ice: fix out-of-bounds KASAN warning in virtchnl ice: Do not use WQ_MEM_RECLAIM flag for workqueue ==================== Link: https://lore.kernel.org/r/20230206232934.634298-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 9b275176270efd18f2f4e328b32be1bad34c4c0d Author: Sasha Neftin Date: Mon Feb 6 15:58:18 2023 -0800 igc: Add ndo_tx_timeout support On some platforms, 100/1000/2500 speeds seem to have sometimes problems reporting false positive tx unit hang during stressful UDP traffic. Likely other Intel drivers introduce responses to a tx hang. Update the 'tx hang' comparator with the comparison of the head and tail of ring pointers and restore the tx_timeout_factor to the previous value (one). This can be test by using netperf or iperf3 applications. Example: iperf3 -s -p 5001 iperf3 -c 192.168.0.2 --udp -p 5001 --time 600 -b 0 netserver -p 16604 netperf -H 192.168.0.2 -l 600 -p 16604 -t UDP_STREAM -- -m 64000 Fixes: b27b8dc77b5e ("igc: Increase timeout value for Speed 100/1000/2500") Signed-off-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230206235818.662384-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 18a048370b06a3a521219e9e5b10bdc2178ef19c Author: Haiyang Zhang Date: Mon Feb 6 13:28:49 2023 -0800 net: mana: Fix accessing freed irq affinity_hint After calling irq_set_affinity_and_hint(), the cpumask pointer is saved in desc->affinity_hint, and will be used later when reading /proc/irq//affinity_hint. So the cpumask variable needs to be persistent. Otherwise, we are accessing freed memory when reading the affinity_hint file. Also, need to clear affinity_hint before free_irq(), otherwise there is a one-time warning and stack trace during module unloading: [ 243.948687] WARNING: CPU: 10 PID: 1589 at kernel/irq/manage.c:1913 free_irq+0x318/0x360 ... [ 243.948753] Call Trace: [ 243.948754] [ 243.948760] mana_gd_remove_irqs+0x78/0xc0 [mana] [ 243.948767] mana_gd_remove+0x3e/0x80 [mana] [ 243.948773] pci_device_remove+0x3d/0xb0 [ 243.948778] device_remove+0x46/0x70 [ 243.948782] device_release_driver_internal+0x1fe/0x280 [ 243.948785] driver_detach+0x4e/0xa0 [ 243.948787] bus_remove_driver+0x70/0xf0 [ 243.948789] driver_unregister+0x35/0x60 [ 243.948792] pci_unregister_driver+0x44/0x90 [ 243.948794] mana_driver_exit+0x14/0x3fe [mana] [ 243.948800] __do_sys_delete_module.constprop.0+0x185/0x2f0 To fix the bug, use the persistent mask, cpumask_of(cpu#), and set affinity_hint to NULL before freeing the IRQ, as required by free_irq(). Cc: stable@vger.kernel.org Fixes: 71fa6887eeca ("net: mana: Assign interrupts to CPUs based on NUMA nodes") Signed-off-by: Haiyang Zhang Reviewed-by: Michael Kelley Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/1675718929-19565-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski commit b1f4fbabbb912eb7061795461a498895bdc30f3c Merge: c6aa9d3b43cd1 4ae5e1e97c44f Author: Jakub Kicinski Date: Tue Feb 7 20:50:30 2023 -0800 Merge tag 'linux-can-fixes-for-6.2-20230207' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== can 2023-02-07 The patch is from Devid Antonio Filoni and fixes an address claiming problem in the J1939 CAN protocol. * tag 'linux-can-fixes-for-6.2-20230207' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: j1939: do not wait 250 ms if the same addr was already claimed ==================== Link: https://lore.kernel.org/r/20230207140514.2885065-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit c6aa9d3b43cd11ac13a8220368a3b0483c6751d4 Author: Michael Kelley Date: Mon Feb 6 12:11:57 2023 -0800 hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC Memory allocations in the network transmit path must use GFP_ATOMIC so they won't sleep. Reported-by: Paolo Abeni Link: https://lore.kernel.org/lkml/8a4d08f94d3e6fe8b6da68440eaa89a088ad84f9.camel@redhat.com/ Fixes: 846da38de0e8 ("net: netvsc: Add Isolation VM support for netvsc driver") Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1675714317-48577-1-git-send-email-mikelley@microsoft.com Signed-off-by: Jakub Kicinski commit 8f0d1451ecf7b3bd5a06ffc866c753d0f3ab4683 Author: Shay Drory Date: Wed Dec 14 22:16:23 2022 +0200 net/mlx5: Serialize module cleanup with reload and remove Currently, remove and reload flows can run in parallel to module cleanup. This design is error prone. For example: aux_drivers callbacks are called from both cleanup and remove flows with different lockings, which can cause a deadlock[1]. Hence, serialize module cleanup with reload and remove. [1] cleanup remove ------- ------ auxiliary_driver_unregister(); devl_lock() auxiliary_device_delete(mlx5e_aux) device_lock(mlx5e_aux) devl_lock() device_lock(mlx5e_aux) Fixes: 912cebf420c2 ("net/mlx5e: Connect ethernet part to auxiliary bus") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 184e1e4474dbcfebc4dbd1fa823a329978f25506 Author: Shay Drory Date: Wed Jan 25 17:39:36 2023 +0200 net/mlx5: fw_tracer, Zero consumer index when reloading the tracer When tracer is reloaded, the device will log the traces at the beginning of the log buffer. Also, driver is reading the log buffer in chunks in accordance to the consumer index. Hence, zero consumer index when reloading the tracer. Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload") Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed commit db561fed6b8fa3878e74d5df6512a4a38152b63e Author: Shay Drory Date: Mon Jan 9 15:27:40 2023 +0200 net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers Whenever the driver is reading the string DBs into buffers, the driver is setting the load bit, but the driver never clears this bit. As a result, in case load bit is on and the driver query the device for new string DBs, the driver won't read again the string DBs. Fix it by clearing the load bit when query the device for new string DBs. Fixes: 2d69356752ff ("net/mlx5: Add support for fw live patch event") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 9965bbebae59b3563a4d95e4aed121e8965dfdc2 Author: Maher Sanalla Date: Sun Jan 22 23:24:56 2023 +0200 net/mlx5: Expose SF firmware pages counter Currently, each core device has VF pages counter which stores number of fw pages used by its VFs and SFs. The current design led to a hang when performing firmware reset on DPU, where the DPU PFs stalled in sriov unload flow due to waiting on release of SFs pages instead of waiting on only VFs pages. Thus, Add a separate counter for SF firmware pages, which will prevent the stall scenario described above. Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver") Signed-off-by: Maher Sanalla Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit c3bdbaea654d8df39112de33037106134a520dc7 Author: Maher Sanalla Date: Sun Jan 22 21:09:40 2023 +0200 net/mlx5: Store page counters in a single array Currently, an independent page counter is used for tracking memory usage for each function type such as VF, PF and host PF (DPU). For better code-readibilty, use a single array that stores the number of allocated memory pages for each function type. Signed-off-by: Maher Sanalla Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 8aa5f171d51c1cb69e5e3106df4dd1a446102823 Author: Dragos Tatulea Date: Mon Jan 23 16:06:32 2023 +0200 net/mlx5e: IPoIB, Show unknown speed instead of error ethtool is returning an error for unknown speeds for the IPoIB interface: $ ethtool ib0 netlink error: failed to retrieve link settings netlink error: Invalid argument netlink error: failed to retrieve link settings netlink error: Invalid argument Settings for ib0: Link detected: no After this change, ethtool will return success and show "unknown speed": $ ethtool ib0 Settings for ib0: Supported ports: [ ] Supported link modes: Not reported Supported pause frame use: No Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: Unknown! Duplex: Full Auto-negotiation: off Port: Other PHYAD: 0 Transceiver: internal Link detected: no Fixes: eb234ee9d541 ("net/mlx5e: IPoIB, Add support for get_link_ksettings in ethtool") Signed-off-by: Dragos Tatulea Reviewed-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 8974aa9638df557f4642acef707af15648a03555 Author: Amir Tzin Date: Sun Jan 8 15:54:46 2023 +0200 net/mlx5e: Fix crash unsetting rx-vlan-filter in switchdev mode Moving to switchdev mode with rx-vlan-filter on and then setting it off causes the kernel to crash since fs->vlan is freed during nic profile cleanup flow. RX VLAN filtering is not supported in switchdev mode so unset it when changing to switchdev and restore its value when switching back to legacy. trace: [] RIP: 0010:mlx5e_disable_cvlan_filter+0x43/0x70 [] set_feature_cvlan_filter+0x37/0x40 [mlx5_core] [] mlx5e_handle_feature+0x3a/0x60 [mlx5_core] [] mlx5e_set_features+0x6d/0x160 [mlx5_core] [] __netdev_update_features+0x288/0xa70 [] ethnl_set_features+0x309/0x380 [] ? __nla_parse+0x21/0x30 [] genl_family_rcv_msg_doit.isra.17+0x110/0x150 [] genl_rcv_msg+0x112/0x260 [] ? features_reply_size+0xe0/0xe0 [] ? genl_family_rcv_msg_doit.isra.17+0x150/0x150 [] netlink_rcv_skb+0x4e/0x100 [] genl_rcv+0x24/0x40 [] netlink_unicast+0x1ab/0x290 [] netlink_sendmsg+0x257/0x4f0 [] sock_sendmsg+0x5c/0x70 Fixes: cb67b832921c ("net/mlx5e: Introduce SRIOV VF representors") Signed-off-by: Amir Tzin Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit da0c52426cd23f8728eff72c2b2d2a3eb6b451f5 Author: Vlad Buslov Date: Thu Jan 26 14:47:12 2023 +0100 net/mlx5: Bridge, fix ageing of peer FDB entries SWITCHDEV_FDB_ADD_TO_BRIDGE event handler that updates FDB entry 'lastuse' field is only executed for eswitch that owns the entry. However, if peer entry processed packets at least once it will have hardware counter 'used' value greater than entry 'lastuse' from that point on, which will cause FDB entry not being aged out. Process the event on all eswitch instances. Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG") Signed-off-by: Vlad Buslov Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 288d85e07fbca5ee35882a4884dd701e43637be1 Author: Yevgeny Kliteynik Date: Tue Jan 17 17:34:20 2023 +0200 net/mlx5: DR, Fix potential race in dr_rule_create_rule_nic Selecting builder should be protected by the lock to prevent the case where a new rule sets a builder in the nic_matcher while the previous rule is still using the nic_matcher. Fixing this issue and cleaning the error flow. Fixes: b9b81e1e9382 ("net/mlx5: DR, For short chains of STEs, avoid allocating ste_arr dynamically") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 1e66220948df815d7b37e0ff8b4627ce10433738 Author: Adham Faris Date: Sun Jan 8 18:09:32 2023 +0200 net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change rq->hw_mtu is used in function en_rx.c/mlx5e_skb_from_cqe_mpwrq_linear() to catch oversized packets. If FCS is concatenated to the end of the packet then the check should be updated accordingly. Rx rings initialization (mlx5e_init_rxq_rq()) invoked for every new set of channels, as part of mlx5e_safe_switch_params(), unknowingly if it runs with default configuration or not. Current rq->hw_mtu initialization assumes default configuration and ignores params->scatter_fcs_en flag state. Fix this, by accounting for params->scatter_fcs_en flag state during rq->hw_mtu initialization. In addition, updating rq->hw_mtu value during ingress traffic might lead to packets drop and oversize_pkts_sw_drop counter increase with no good reason. Hence we remove this optimization and switch the set of channels with a new one, to make sure we don't get false positives on the oversize_pkts_sw_drop counter. Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag") Signed-off-by: Adham Faris Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 0983f6bf2bfc0789b51ddf7315f644ff4da50acb Merge: 513c1a3d3f198 707344c8a188b Author: Linus Torvalds Date: Tue Feb 7 14:17:12 2023 -0800 Merge tag 'devicetree-fixes-for-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix handling of multiple OF framebuffer devices - Fix booting on Socionext Synquacer with bad 'dma-ranges' entries - Add DT binding .yamllint to .gitignore * tag 'devicetree-fixes-for-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: interrupt-controller: arm,gic-v3: Fix typo in description of msi-controller property dt-bindings: Fix .gitignore of/address: Return an error when no valid dma-ranges are found of: Make OF framebuffer device names unique commit 711442e29f16f0d39dd0e2460c9baacfccb9d5a7 Author: Dan Williams Date: Tue Feb 7 11:04:30 2023 -0800 cxl/region: Fix passthrough-decoder detection A passthrough decoder is a decoder that maps only 1 target. It is a special case because it does not impose any constraints on the interleave-math as compared to a decoder with multiple targets. Extend the passthrough case to multi-target-capable decoders that only have one target selected. I.e. the current code was only considering passthrough *ports* which are only a subset of the potential passthrough decoder scenarios. Fixes: e4f6dfa9ef75 ("cxl/region: Fix 'distance' calculation with passthrough ports") Cc: Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/167564540422.847146.13816934143225777888.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 02f64ed06670120d35b5352a67ebd7a4cc104546 Merge: 6a32425f953b9 c173ee5b2fa61 Author: Takashi Iwai Date: Tue Feb 7 18:04:44 2023 +0100 Merge tag 'asoc-fix-v6.2-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.2 A few more fixes for v6.2, all driver specific and small. It's larger than is ideal but we can't really control when people find problems. commit e7d84c6a1296d059389f7342d9b4b7defb518d3a Author: Xiubo Li Date: Tue Feb 7 13:04:52 2023 +0800 ceph: flush cap releases when the session is flushed MDS expects the completed cap release prior to responding to the session flush for cache drop. Cc: stable@vger.kernel.org Link: http://tracker.ceph.com/issues/38009 Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 513c1a3d3f1982fb850c910937099525b0d35e24 Merge: 05ecb680708a1 3e46d910d8acf Author: Linus Torvalds Date: Tue Feb 7 07:54:40 2023 -0800 Merge tag 'trace-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "Fix regression in poll() and select() With the fix that made poll() and select() block if read would block caused a slight regression in rasdaemon, as it needed that kind of behavior. Add a way to make that behavior come back by writing zero into the 'buffer_percentage', which means to never block on read" * tag 'trace-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw commit c173ee5b2fa6195066674d66d1d7e191010fb1ff Author: Amadeusz Sławiński Date: Tue Feb 7 22:04:28 2023 +0100 ASoC: topology: Return -ENOMEM on memory allocation failure When handling error path, ret needs to be set to correct value. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: d29d41e28eea ("ASoC: topology: Add support for multiple kcontrol types to a widget") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230207210428.2076354-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 4ae5e1e97c44f4654516c1d41591a462ed62fa7b Author: Devid Antonio Filoni Date: Fri Nov 25 18:04:18 2022 +0100 can: j1939: do not wait 250 ms if the same addr was already claimed The ISO 11783-5 standard, in "4.5.2 - Address claim requirements", states: d) No CF shall begin, or resume, transmission on the network until 250 ms after it has successfully claimed an address except when responding to a request for address-claimed. But "Figure 6" and "Figure 7" in "4.5.4.2 - Address-claim prioritization" show that the CF begins the transmission after 250 ms from the first AC (address-claimed) message even if it sends another AC message during that time window to resolve the address contention with another CF. As stated in "4.4.2.3 - Address-claimed message": In order to successfully claim an address, the CF sending an address claimed message shall not receive a contending claim from another CF for at least 250 ms. As stated in "4.4.3.2 - NAME management (NM) message": 1) A commanding CF can d) request that a CF with a specified NAME transmit the address- claimed message with its current NAME. 2) A target CF shall d) send an address-claimed message in response to a request for a matching NAME Taking the above arguments into account, the 250 ms wait is requested only during network initialization. Do not restart the timer on AC message if both the NAME and the address match and so if the address has already been claimed (timer has expired) or the AC message has been sent to resolve the contention with another CF (timer is still running). Signed-off-by: Devid Antonio Filoni Acked-by: Oleksij Rempel Link: https://lore.kernel.org/all/20221125170418.34575-1-devid.filoni@egluetechnologies.com Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 6a32425f953b955b4ff82f339d01df0b713caa5d Author: Artemii Karasev Date: Tue Feb 7 18:20:26 2023 +0500 ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() snd_emux_xg_control() can be called with an argument 'param' greater than size of 'control' array. It may lead to accessing 'control' array at a wrong index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Link: https://lore.kernel.org/r/20230207132026.2870-1-karasev@ispras.ru Signed-off-by: Takashi Iwai commit 565b4824c39fa335cba2028a09d7beb7112f3c9a Author: Jiri Pirko Date: Mon Feb 6 10:41:51 2023 +0100 devlink: change port event netdev notifier from per-net to global Currently only the network namespace of devlink instance is monitored for port events. If netdev is moved to a different namespace and then unregistered, NETDEV_PRE_UNINIT is missed which leads to trigger following WARN_ON in devl_port_unregister(). WARN_ON(devlink_port->type != DEVLINK_PORT_TYPE_NOTSET); Fix this by changing the netdev notifier from per-net to global so no event is missed. Fixes: 02a68a47eade ("net: devlink: track netdev with devlink_port assigned") Signed-off-by: Jiri Pirko Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20230206094151.2557264-1-jiri@resnulli.us Signed-off-by: Paolo Abeni commit 29aab38823b61e482995c24644bd2d8acfe56185 Author: Shengjiu Wang Date: Tue Feb 7 17:04:24 2023 +0800 ASoC: fsl_sai: fix getting version from VERID The version information is at the bit31 ~ bit16 in the VERID register, so need to right shift 16bit to get it, otherwise the result of comparison "sai->verid.version >= 0x0301" is wrong. Fixes: 99c1e74f25d4 ("ASoC: fsl_sai: store full version instead of major/minor") Signed-off-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/1675760664-25193-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit bbb253b206b9c417928a6c827d038e457f3012e9 Author: Vladimir Oltean Date: Sun Feb 5 21:24:09 2023 +0200 selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify() more comprehensive We have two IS1 filters of the OCELOT_VCAP_KEY_ANY key type (the one with "action vlan pop" and the one with "action vlan modify") and one of the OCELOT_VCAP_KEY_IPV4 key type (the one with "action skbedit priority"). But we have no IS1 filter with the OCELOT_VCAP_KEY_ETYPE key type, and there was an uncaught breakage there. To increase test coverage, convert one of the OCELOT_VCAP_KEY_ANY filters to OCELOT_VCAP_KEY_ETYPE, by making the filter also match on the MAC SA of the traffic sent by mausezahn, $h1_mac. Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230205192409.1796428-2-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit f964f8399df29d3e3ced77177cf35131cd2491bf Author: Vladimir Oltean Date: Sun Feb 5 21:24:08 2023 +0200 net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" Alternative short title: don't instruct the hardware to match on EtherType with "protocol 802.1Q" flower filters. It doesn't work for the reasons detailed below. With a command such as the following: tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \ protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \ action vlan modify id 300 \ action goto chain $(IS2 0 0) the created filter is set by ocelot_flower_parse_key() to be of type OCELOT_VCAP_KEY_ETYPE, and etype is set to {value=0x8100, mask=0xffff}. This gets propagated all the way to is1_entry_set() which commits it to hardware (the VCAP_IS1_HK_ETYPE field of the key). Compare this to the case where src_mac isn't specified - the key type is OCELOT_VCAP_KEY_ANY, and is1_entry_set() doesn't populate VCAP_IS1_HK_ETYPE. The problem is that for VLAN-tagged frames, the hardware interprets the ETYPE field as holding the encapsulated VLAN protocol. So the above filter will only match those packets which have an encapsulated protocol of 0x8100, rather than all packets with VLAN ID 200 and the given src_mac. The reason why this is allowed to occur is because, although we have a block of code in ocelot_flower_parse_key() which sets "match_protocol" to false when VLAN keys are present, that code executes too late. There is another block of code, which executes for Ethernet addresses, and has a "goto finished_key_parsing" and skips the VLAN header parsing. By skipping it, "match_protocol" remains with the value it was initialized with, i.e. "true", and "proto" is set to f->common.protocol, or 0x8100. The concept of ignoring some keys rather than erroring out when they are present but can't be offloaded is dubious in itself, but is present since the initial commit fe3490e6107e ("net: mscc: ocelot: Hardware ofload for tc flower filter"), and it's outside of the scope of this patch to change that. The problem was introduced when the driver started to interpret the flower filter's protocol, and populate the VCAP filter's ETYPE field based on it. To fix this, it is sufficient to move the code that parses the VLAN keys earlier than the "goto finished_key_parsing" instruction. This will ensure that if we have a flower filter with both VLAN and Ethernet address keys, it won't match on ETYPE 0x8100, because the VLAN key parsing sets "match_protocol = false". Fixes: 86b956de119c ("net: mscc: ocelot: support matching on EtherType") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230205192409.1796428-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 647037adcad00f2bab8828d3d41cd0553d41f3bd Author: Aaron Thompson Date: Tue Feb 7 08:21:51 2023 +0000 Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." This reverts commit 115d9d77bb0f9152c60b6e8646369fa7f6167593. The pages being freed by memblock_free_late() have already been initialized, but if they are in the deferred init range, __free_one_page() might access nearby uninitialized pages when trying to coalesce buddies. This can, for example, trigger this BUG: BUG: unable to handle page fault for address: ffffe964c02580c8 RIP: 0010:__list_del_entry_valid+0x3f/0x70 __free_one_page+0x139/0x410 __free_pages_ok+0x21d/0x450 memblock_free_late+0x8c/0xb9 efi_free_boot_services+0x16b/0x25c efi_enter_virtual_mode+0x403/0x446 start_kernel+0x678/0x714 secondary_startup_64_no_verify+0xd2/0xdb A proper fix will be more involved so revert this change for the time being. Fixes: 115d9d77bb0f ("mm: Always release pages to the buddy allocator in memblock_free_late().") Signed-off-by: Aaron Thompson Link: https://lore.kernel.org/r/20230207082151.1303-1-dev@aaront.org Signed-off-by: Mike Rapoport (IBM) commit 0b6d6425103a676e2b6a81f3fd35d7ea4f9b90ec Author: Vladimir Oltean Date: Sun Feb 5 16:07:13 2023 +0200 net: dsa: mt7530: don't change PVC_EG_TAG when CPU port becomes VLAN-aware Frank reports that in a mt7530 setup where some ports are standalone and some are in a VLAN-aware bridge, 8021q uppers of the standalone ports lose their VLAN tag on xmit, as seen by the link partner. This seems to occur because once the other ports join the VLAN-aware bridge, mt7530_port_vlan_filtering() also calls mt7530_port_set_vlan_aware(ds, cpu_dp->index), and this affects the way that the switch processes the traffic of the standalone port. Relevant is the PVC_EG_TAG bit. The MT7530 documentation says about it: EG_TAG: Incoming Port Egress Tag VLAN Attribution 0: disabled (system default) 1: consistent (keep the original ingress tag attribute) My interpretation is that this setting applies on the ingress port, and "disabled" is basically the normal behavior, where the egress tag format of the packet (tagged or untagged) is decided by the VLAN table (MT7530_VLAN_EGRESS_UNTAG or MT7530_VLAN_EGRESS_TAG). But there is also an option of overriding the system default behavior, and for the egress tagging format of packets to be decided not by the VLAN table, but simply by copying the ingress tag format (if ingress was tagged, egress is tagged; if ingress was untagged, egress is untagged; aka "consistent). This is useful in 2 scenarios: - VLAN-unaware bridge ports will always encounter a miss in the VLAN table. They should forward a packet as-is, though. So we use "consistent" there. See commit e045124e9399 ("net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode"). - Traffic injected from the CPU port. The operating system is in god mode; if it wants a packet to exit as VLAN-tagged, it sends it as VLAN-tagged. Otherwise it sends it as VLAN-untagged*. *This is true only if we don't consider the bridge TX forwarding offload feature, which mt7530 doesn't support. So for now, make the CPU port always stay in "consistent" mode to allow software VLANs to be forwarded to their egress ports with the VLAN tag intact, and not stripped. Link: https://lore.kernel.org/netdev/trinity-e6294d28-636c-4c40-bb8b-b523521b00be-1674233135062@3c-app-gmx-bs36/ Fixes: e045124e9399 ("net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode") Reported-by: Frank Wunderlich Tested-by: Frank Wunderlich Signed-off-by: Vladimir Oltean Tested-by: Arınç ÜNAL Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230205140713.1609281-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 2de49fb1c9bb8bfe283070fef2e9304d9842a30c Author: Li Zhijian Date: Thu Feb 2 10:12:01 2023 +0000 RDMA/rtrs: Don't call kobject_del for srv_path->kobj As the mention in commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free"), it was intended to remove the kobject_del for srv_path->kobj. f7452a7e96c1 said: >This patch moves kobject_del() into free_sess() so that the kobject of > rtrs_srv_sess can be freed. This patch also move rtrs_srv_destroy_once_sysfs_root_folders back to 'if (srv_path->kobj.state_in_sysfs)' block to avoid a 'held lock freed!' A kernel panic will be triggered by following script ----------------------- $ while true do echo "sessname=foo path=ip: device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device echo "normal" > /sys/block/rnbd0/rnbd/unmap_device done ----------------------- The bisection pointed to commit 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") at last. rnbd_server L777: : Opened device 'nvme0n1' general protection fault, probably for non-canonical address 0x765f766564753aea: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 3558 Comm: systemd-udevd Kdump: loaded Not tainted 6.1.0-rc3-roce-flush+ #51 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kernfs_dop_revalidate+0x36/0x180 Code: 00 00 41 55 41 54 55 53 48 8b 47 68 48 89 fb 48 85 c0 0f 84 db 00 00 00 48 8b a8 60 04 00 00 48 8b 45 30 48 85 c0 48 0f 44 c5 <4c> 8b 60 78 49 81 c4 d8 00 00 00 4c 89 e7 e8 b7 78 7b 00 8b 05 3d RSP: 0018:ffffaf1700b67c78 EFLAGS: 00010206 RAX: 765f766564753a72 RBX: ffff89e2830849c0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89e2830849c0 RBP: ffff89e280361bd0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000065 R11: 0000000000000000 R12: ffff89e2830849c0 R13: ffff89e283084888 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f13fbce7b40(0000) GS:ffff89e2bbc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f93e055d340 CR3: 0000000104664002 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lookup_fast+0x7b/0x100 walk_component+0x21/0x160 link_path_walk.part.0+0x24d/0x390 path_openat+0xad/0x9a0 do_filp_open+0xa9/0x150 ? lock_release+0x13c/0x2e0 ? _raw_spin_unlock+0x29/0x50 ? alloc_fd+0x124/0x1f0 do_sys_openat2+0x9b/0x160 __x64_sys_openat+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f13fc9d701b Code: 25 00 00 41 00 3d 00 00 41 00 74 4b 64 8b 04 25 18 00 00 00 85 c0 75 67 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 91 00 00 00 48 8b 54 24 28 64 48 2b 14 25 RSP: 002b:00007ffddf242640 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f13fc9d701b RDX: 0000000000080000 RSI: 00007ffddf2427c0 RDI: 00000000ffffff9c RBP: 00007ffddf2427c0 R08: 00007f13fcc5b440 R09: 21b2131aa64b1ef2 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000 R13: 00007ffddf2427c0 R14: 000055ed13be8db0 R15: 0000000000000000 Fixes: 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") Acked-by: Guoqing Jiang Signed-off-by: Li Zhijian Link: https://lore.kernel.org/r/1675332721-2-1-git-send-email-lizhijian@fujitsu.com Acked-by: Jack Wang Signed-off-by: Leon Romanovsky commit 6c4715aa5b0ab1c0d35780b7c552e952dbb5515d Author: Andy Chi Date: Tue Feb 7 16:30:09 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform. There is a HP platform needs ALC236_FIXUP_HP_GPIO_LED quirk to make mic-mute/audio-mute working. Signed-off-by: Andy Chi Cc: Link: https://lore.kernel.org/r/20230207083011.100189-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit a8520be3ffef3d25b53bf171a7ebe17ee0154175 Author: Andy Shevchenko Date: Mon Feb 6 16:15:59 2023 +0200 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode If the firmware mangled the register contents too much, check the saved value for the Direct IRQ mode. If it matches, we will restore the pin state. Reported-by: Jim Minter Fixes: 6989ea4881c8 ("pinctrl: intel: Save and restore pins in "direct IRQ" mode") Tested-by: Jim Minter Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Link: https://lore.kernel.org/r/20230206141558.20916-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij commit 85e26dd5100a182bf8448050427539c0a66ab793 Author: Christian König Date: Thu Jan 26 10:24:26 2023 +0100 drm/client: fix circular reference counting issue We reference dump buffers both by their handle as well as their object. The problem is now that when anybody iterates over the DRM framebuffers and exports the underlying GEM objects through DMA-buf we run into a circular reference count situation. The result is that the fbdev handling holds the GEM handle preventing the DMA-buf in the GEM object to be released. This DMA-buf in turn holds a reference to the driver module which on unload would release the fbdev. Break that loop by releasing the handle as soon as the DRM framebuffer object is created. The DRM framebuffer and the DRM client buffer structure still hold a reference to the underlying GEM object preventing its destruction. Signed-off-by: Christian König Fixes: c76f0f7cb546 ("drm: Begin an API for in-kernel clients") Cc: Reviewed-by: Thomas Zimmermann Tested-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230126102814.8722-1-christian.koenig@amd.com commit aa5465aeca3c66fecdf7efcf554aed79b4c4b211 Author: ZhaoLong Wang Date: Mon Feb 6 09:10:09 2023 +0800 cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement. Signed-off-by: ZhaoLong Wang Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 4fa4302d6dc7de7e8e74dc7405611a2efb4bf54b Author: Fan Ni Date: Thu Dec 15 17:09:14 2022 +0000 cxl/region: Fix null pointer dereference for resetting decoder Not all decoders have a reset callback. The CXL specification allows a host bridge with a single root port to have no explicit HDM decoders. Currently the region driver assumes there are none. As such the CXL core creates a special pass through decoder instance without a commit/reset callback. Prior to this patch, the ->reset() callback was called unconditionally when calling cxl_region_decode_reset. Thus a configuration with 1 Host Bridge, 1 Root Port, and one directly attached CXL type 3 device or multiple CXL type 3 devices attached to downstream ports of a switch can cause a null pointer dereference. Before the fix, a kernel crash was observed when we destroy the region, and a pass through decoder is reset. The issue can be reproduced as below, 1) create a region with a CXL setup which includes a HB with a single root port under which a memdev is attached directly. 2) destroy the region with cxl destroy-region regionX -f. Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Cc: Signed-off-by: Fan Ni Reviewed-by: Davidlohr Bueso Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Gregory Price Reviewed-by: Gregory Price Link: https://lore.kernel.org/r/20221215170909.2650271-1-fan.ni@samsung.com Signed-off-by: Dan Williams commit 2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1 Author: Nicholas Piggin Date: Mon Feb 6 14:22:40 2023 +1000 powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch The RFI and STF security mitigation options can flip the interrupt_exit_not_reentrant static branch condition concurrently with the interrupt exit code which tests that branch. Interrupt exit tests this condition to set MSR[EE|RI] for exit, then again in the case a soft-masked interrupt is found pending, to recover the MSR so the interrupt can be replayed before attempting to exit again. If the condition changes between these two tests, the MSR and irq soft-mask state will become corrupted, leading to warnings and possible crashes. For example, if the branch is initially true then false, MSR[EE] will be 0 but PACA_IRQ_HARD_DIS clear and EE may not get enabled, leading to warnings in irq_64.c. Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt") Cc: stable@vger.kernel.org # v5.14+ Reported-by: Sachin Sant Tested-by: Sachin Sant Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230206042240.92103-1-npiggin@gmail.com commit 4a606ce68426c88ff2563382b33cc34f3485fe57 Author: Zhang Changzhong Date: Mon Dec 12 15:11:26 2022 -0800 ice: switch: fix potential memleak in ice_add_adv_recipe() When ice_add_special_words() fails, the 'rm' is not released, which will lead to a memory leak. Fix this up by going to 'err_unroll' label. Compile tested only. Fixes: 8b032a55c1bd ("ice: low level support for tunnels") Signed-off-by: Zhang Changzhong Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky commit 3f4870df1b15d62665cb86ca116c8c9cf0e830b0 Author: Dan Carpenter Date: Fri Oct 28 18:02:24 2022 +0300 ice: Fix off by one in ice_tc_forward_to_queue() The > comparison should be >= to prevent reading one element beyond the end of the array. The "vsi->num_rxq" is not strictly speaking the number of elements in the vsi->rxq_map[] array. The array has "vsi->alloc_rxq" elements and "vsi->num_rxq" is less than or equal to the number of elements in the array. The array is allocated in ice_vsi_alloc_arrays(). It's still an off by one but it might not access outside the end of the array. Fixes: 143b86f346c7 ("ice: Enable RX queue selection using skbedit action") Signed-off-by: Dan Carpenter Acked-by: Amritha Nambiar Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky commit c793f8ea15e312789b5b6b4a5e7b0b92315be5cb Author: Brett Creeley Date: Mon Jan 16 13:34:58 2023 +0100 ice: Fix disabling Rx VLAN filtering with port VLAN enabled If the user turns on the vf-true-promiscuous-support flag, then Rx VLAN filtering will be disabled if the VF requests to enable promiscuous mode. When the VF is in a port VLAN, this is the incorrect behavior because it will allow the VF to receive traffic outside of its port VLAN domain. Fortunately this only resulted in the VF(s) receiving broadcast traffic outside of the VLAN domain because all of the VLAN promiscuous rules are based on the port VLAN ID. Fix this by setting the .disable_rx_filtering VLAN op to a no-op when a port VLAN is enabled on the VF. Also, make sure to make this fix for both Single VLAN Mode and Double VLAN Mode enabled devices. Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations") Signed-off-by: Brett Creeley Signed-off-by: Karen Ostrowska Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit b2dbde3ad44f290ded319f00b71dccec90083a50 Author: Michal Swiatkowski Date: Wed Jan 4 09:25:17 2023 +0100 ice: fix out-of-bounds KASAN warning in virtchnl KASAN reported: [ 9793.708867] BUG: KASAN: global-out-of-bounds in ice_get_link_speed+0x16/0x30 [ice] [ 9793.709205] Read of size 4 at addr ffffffffc1271b1c by task kworker/6:1/402 [ 9793.709222] CPU: 6 PID: 402 Comm: kworker/6:1 Kdump: loaded Tainted: G B OE 6.1.0+ #3 [ 9793.709235] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0014.070920180847 07/09/2018 [ 9793.709245] Workqueue: ice ice_service_task [ice] [ 9793.709575] Call Trace: [ 9793.709582] [ 9793.709588] dump_stack_lvl+0x44/0x5c [ 9793.709613] print_report+0x17f/0x47b [ 9793.709632] ? __cpuidle_text_end+0x5/0x5 [ 9793.709653] ? ice_get_link_speed+0x16/0x30 [ice] [ 9793.709986] ? ice_get_link_speed+0x16/0x30 [ice] [ 9793.710317] kasan_report+0xb7/0x140 [ 9793.710335] ? ice_get_link_speed+0x16/0x30 [ice] [ 9793.710673] ice_get_link_speed+0x16/0x30 [ice] [ 9793.711006] ice_vc_notify_vf_link_state+0x14c/0x160 [ice] [ 9793.711351] ? ice_vc_repr_cfg_promiscuous_mode+0x120/0x120 [ice] [ 9793.711698] ice_vc_process_vf_msg+0x7a7/0xc00 [ice] [ 9793.712074] __ice_clean_ctrlq+0x98f/0xd20 [ice] [ 9793.712534] ? ice_bridge_setlink+0x410/0x410 [ice] [ 9793.712979] ? __request_module+0x320/0x520 [ 9793.713014] ? ice_process_vflr_event+0x27/0x130 [ice] [ 9793.713489] ice_service_task+0x11cf/0x1950 [ice] [ 9793.713948] ? io_schedule_timeout+0xb0/0xb0 [ 9793.713972] process_one_work+0x3d0/0x6a0 [ 9793.714003] worker_thread+0x8a/0x610 [ 9793.714031] ? process_one_work+0x6a0/0x6a0 [ 9793.714049] kthread+0x164/0x1a0 [ 9793.714071] ? kthread_complete_and_exit+0x20/0x20 [ 9793.714100] ret_from_fork+0x1f/0x30 [ 9793.714137] [ 9793.714151] The buggy address belongs to the variable: [ 9793.714158] ice_aq_to_link_speed+0x3c/0xffffffffffff3520 [ice] [ 9793.714632] Memory state around the buggy address: [ 9793.714642] ffffffffc1271a00: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 02 f9 [ 9793.714656] ffffffffc1271a80: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 [ 9793.714670] >ffffffffc1271b00: 00 00 00 04 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 [ 9793.714680] ^ [ 9793.714690] ffffffffc1271b80: 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 9793.714704] ffffffffc1271c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 The ICE_AQ_LINK_SPEED_UNKNOWN define is BIT(15). The value is bigger than both legacy and normal link speed tables. Add one element (0 - unknown) to both tables. There is no need to explicitly set table size, leave it empty. Fixes: 1d0e28a9be1f ("ice: Remove and replace ice speed defines with ethtool.h versions") Signed-off-by: Michal Swiatkowski Reviewed-by: Alexander Lobakin Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky commit 4d159f7884f78b1aacb99b4fc37d1e3cb1194e39 Author: Anirudh Venkataramanan Date: Mon Jan 30 14:06:40 2023 -0800 ice: Do not use WQ_MEM_RECLAIM flag for workqueue When both ice and the irdma driver are loaded, a warning in check_flush_dependency is being triggered. This is due to ice driver workqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one is not. According to kernel documentation, this flag should be set if the workqueue will be involved in the kernel's memory reclamation flow. Since it is not, there is no need for the ice driver's WQ to have this flag set so remove it. Example trace: [ +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0 [ +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0 [ +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha in_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel _rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1 0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_ core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs ib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter acpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba ta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse [ +0.000161] [last unloaded: bonding] [ +0.000006] CPU: 0 PID: 728 Comm: kworker/0:2 Tainted: G S 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1 [ +0.000006] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ +0.000003] Workqueue: ice ice_service_task [ice] [ +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0 [ +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08 9f e8 bb d3 07 01 <0f> 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06 [ +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282 [ +0.000005] RAX: 0000000000000000 RBX: ffff888141bc2400 RCX: 0000000000000000 [ +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffffa1213a80 [ +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112 [ +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000 [ +0.000003] R13: ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400 [ +0.000004] FS: 0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000 [ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0 [ +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000003] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000002] PKRU: 55555554 [ +0.000003] Call Trace: [ +0.000002] [ +0.000003] __flush_workqueue+0x203/0x840 [ +0.000006] ? mutex_unlock+0x84/0xd0 [ +0.000008] ? __pfx_mutex_unlock+0x10/0x10 [ +0.000004] ? __pfx___flush_workqueue+0x10/0x10 [ +0.000006] ? mutex_lock+0xa3/0xf0 [ +0.000005] ib_cache_cleanup_one+0x39/0x190 [ib_core] [ +0.000174] __ib_unregister_device+0x84/0xf0 [ib_core] [ +0.000094] ib_unregister_device+0x25/0x30 [ib_core] [ +0.000093] irdma_ib_unregister_device+0x97/0xc0 [irdma] [ +0.000064] ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma] [ +0.000059] ? up_write+0x5c/0x90 [ +0.000005] irdma_remove+0x36/0x90 [irdma] [ +0.000062] auxiliary_bus_remove+0x32/0x50 [ +0.000007] device_release_driver_internal+0xfa/0x1c0 [ +0.000005] bus_remove_device+0x18a/0x260 [ +0.000007] device_del+0x2e5/0x650 [ +0.000005] ? __pfx_device_del+0x10/0x10 [ +0.000003] ? mutex_unlock+0x84/0xd0 [ +0.000004] ? __pfx_mutex_unlock+0x10/0x10 [ +0.000004] ? _raw_spin_unlock+0x18/0x40 [ +0.000005] ice_unplug_aux_dev+0x52/0x70 [ice] [ +0.000160] ice_service_task+0x1309/0x14f0 [ice] [ +0.000134] ? __pfx___schedule+0x10/0x10 [ +0.000006] process_one_work+0x3b1/0x6c0 [ +0.000008] worker_thread+0x69/0x670 [ +0.000005] ? __kthread_parkme+0xec/0x110 [ +0.000007] ? __pfx_worker_thread+0x10/0x10 [ +0.000005] kthread+0x17f/0x1b0 [ +0.000005] ? __pfx_kthread+0x10/0x10 [ +0.000004] ret_from_fork+0x29/0x50 [ +0.000009] Fixes: 940b61af02f4 ("ice: Initialize PF and setup miscellaneous interrupt") Signed-off-by: Anirudh Venkataramanan Signed-off-by: Marcin Szycik Tested-by: Jakub Andrysiak Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky commit 04119ab1a49fc41cb70f0472be5455af268fa260 Author: Dave Airlie Date: Mon Feb 6 07:05:28 2023 +1000 nvidiafb: detect the hardware support before removing console. This driver removed the console, but hasn't yet decided if it could take over the console yet. Instead of doing that, probe the hw for support and then remove the console afterwards. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216859 Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus") Reported-by: Zeno Davatz Tested-by: Zeno Davatz Tested-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230205210751.3842103-1-airlied@gmail.com commit 6afaed53cc9adde69d8a76ff5b4d740d5efbc54c Author: Filipe Manana Date: Tue Jan 10 14:56:39 2023 +0000 btrfs: simplify update of last_dir_index_offset when logging a directory When logging a directory, we always set the inode's last_dir_index_offset to the offset of the last dir index item we found. This is using an extra field in the log context structure, and it makes more sense to update it only after we insert dir index items, and we could directly update the inode's last_dir_index_offset field instead. So make this simpler by updating the inode's last_dir_index_offset only when we actually insert dir index keys in the log tree, and getting rid of the last_dir_item_offset field in the log context structure. Reported-by: David Arendt Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/ Reported-by: Maxim Mikityanskiy Link: https://lore.kernel.org/linux-btrfs/Y8voyTXdnPDz8xwY@mail.gmail.com/ Reported-by: Hunter Wardlaw Link: https://bugzilla.suse.com/show_bug.cgi?id=1207231 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216851 CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 05ecb680708a1dbe6554d6fc17e5d9a8a7cb5e6a Merge: 66fcf74e5c0d7 7a2127e66a00e Author: Linus Torvalds Date: Mon Feb 6 14:07:38 2023 -0800 Merge tag 'cgroup-for-6.2-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "During the v6.2 cycle, there were a series of changes to task cpu affinity handling which fixed cpuset inadvertently clobbering user-configured affinity masks. Unfortunately, they broke the affinity handling on hybrid heterogeneous CPUs which have cores that can execute both 64 and 32bit along with cores that can only execute 32bit code. This contains two fix patches for the above issue. While reverting the changes that caused the regression is definitely an option, the origial patches do improve how cpuset behave signficantly in some cases and the fixes seem fairly safe, so I think it'd be better to try to fix them first" * tag 'cgroup-for-6.2-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task cgroup/cpuset: Don't filter offline CPUs in cpuset_cpus_allowed() for top cpuset tasks commit 66fcf74e5c0d771a456b96ec9aebfb53d648eede Merge: d2d11f342b179 a9ad4d87aa263 Author: Linus Torvalds Date: Mon Feb 6 14:05:16 2023 -0800 Merge tag 'for-6.2-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - explicitly initialize zlib work memory to fix a KCSAN warning - limit number of send clones by maximum memory allocated - limit device size extent in case it device shrink races with chunk allocation - raid56 fixes: - fix copy&paste error in RAID6 stripe recovery - make error bitmap update atomic * tag 'for-6.2-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: raid56: make error_bitmap update atomic btrfs: send: limit number of clones and allocated memory size btrfs: zlib: zero-initialize zlib workspace btrfs: limit device extents to the device size btrfs: raid56: fix stripes if vertical errors are found commit 95ff4aadf1326633e157dbf9c59260465dde9513 Merge: fe1e7e8ce2c47 e0576cd642ced Author: Mark Brown Date: Mon Feb 6 21:36:47 2023 +0000 Two bug fixes for tas5805m codec driver Merge series from Daniel Beer : This pair of patches fixes two issues which crept in while revising the original submission, at a time when I no longer had access to test hardware. The fixes here have been tested and verified on hardware. commit 7a2127e66a00e073db8d90f9aac308f4a8a64226 Author: Will Deacon Date: Tue Jan 31 22:17:19 2023 +0000 cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task set_cpus_allowed_ptr() will fail with -EINVAL if the requested affinity mask is not a subset of the task_cpu_possible_mask() for the task being updated. Consequently, on a heterogeneous system with cpusets spanning the different CPU types, updates to the cgroup hierarchy can silently fail to update task affinities when the effective affinity mask for the cpuset is expanded. For example, consider an arm64 system with 4 CPUs, where CPUs 2-3 are the only cores capable of executing 32-bit tasks. Attaching a 32-bit task to a cpuset containing CPUs 0-2 will correctly affine the task to CPU 2. Extending the cpuset to CPUs 0-3, however, will fail to extend the affinity mask of the 32-bit task because update_tasks_cpumask() will pass the full 0-3 mask to set_cpus_allowed_ptr(). Extend update_tasks_cpumask() to take a temporary 'cpumask' paramater and use it to mask the 'effective_cpus' mask with the possible mask for each task being updated. Fixes: 431c69fac05b ("cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus()") Signed-off-by: Will Deacon Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 3fb906e7fabbb5b76c3c5256b10dc46ef80a0bfe Author: Waiman Long Date: Sun Feb 5 22:48:53 2023 -0500 cgroup/cpuset: Don't filter offline CPUs in cpuset_cpus_allowed() for top cpuset tasks Since commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask"), relax_compatible_cpus_allowed_ptr() is calling __sched_setaffinity() unconditionally. This helps to expose a bug in the current cpuset hotplug code where the cpumasks of the tasks in the top cpuset are not updated at all when some CPUs become online or offline. It is likely caused by the fact that some of the tasks in the top cpuset, like percpu kthreads, cannot have their cpu affinity changed. One way to reproduce this as suggested by Peter is: - boot machine - offline all CPUs except one - taskset -p ffffffff $$ - online all CPUs Fix this by allowing cpuset_cpus_allowed() to return a wider mask that includes offline CPUs for those tasks that are in the top cpuset. For tasks not in the top cpuset, the old rule applies and only online CPUs will be returned in the mask since hotplug events will update their cpumasks accordingly. Fixes: 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") Reported-by: Will Deacon Originally-from: Peter Zijlstra (Intel) Tested-by: Will Deacon Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 89e5dd41c444cc2178be8d3090e386d02f4fccf3 Merge: 97801cfcf9565 4722dd4029c63 Author: Arnd Bergmann Date: Mon Feb 6 20:47:13 2023 +0100 Merge tag 'sti-dt-for-6.3-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti into arm/fixes Fix polarity of reset line of tsin0 port for stihxxx-b2120 * tag 'sti-dt-for-6.3-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti: ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port Link: https://lore.kernel.org/r/8e05c729-89bc-20f3-acf6-096fb85d7e36@foss.st.com Signed-off-by: Arnd Bergmann commit 918c5765a15420ad60730fbe5b5b67beb74ca7b6 Merge: 4ec5183ec4865 51be2fffd65d9 Author: Rafael J. Wysocki Date: Mon Feb 6 18:54:35 2023 +0100 Merge tag 'cpufreq-arm-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull an ARM cpufreq fix for 6.2-rc8 from Viresh Kumar: - Fix the incorrect value returned by cpufreq driver's ->get() callback for Qualcomm platforms (Douglas Anderson). * tag 'cpufreq-arm-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems commit 8f20660f053cefd4693e69cfff9cf58f4f7c4929 Author: Ryan Neph Date: Fri Feb 3 15:33:44 2023 -0800 drm/virtio: exbuf->fence_fd unmodified on interrupted wait An interrupted dma_fence_wait() becomes an -ERESTARTSYS returned to userspace ioctl(DRM_IOCTL_VIRTGPU_EXECBUFFER) calls, prompting to retry the ioctl(), but the passed exbuf->fence_fd has been reset to -1, making the retry attempt fail at sync_file_get_fence(). The uapi for DRM_IOCTL_VIRTGPU_EXECBUFFER is changed to retain the passed value for exbuf->fence_fd when returning anything besides a successful result from the ioctl. Fixes: 2cd7b6f08bc4 ("drm/virtio: add in/out fence support for explicit synchronization") Signed-off-by: Ryan Neph Reviewed-by: Rob Clark Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20230203233345.2477767-1-ryanneph@chromium.org commit 7a17e8423a133a6ac238462126d7f88faaccc681 Author: Stefan Binding Date: Mon Feb 6 15:00:19 2023 +0000 ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 This Asus Zenbook laptop use Realtek HDA codec combined with 2xCS35L41 Amplifiers using I2C with External Boost. Signed-off-by: Stefan Binding Cc: Link: https://lore.kernel.org/r/20230206150019.3825120-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit ebebf05a4b06a1be49788ca0edf990de01c4b0d0 Author: Luka Guzenko Date: Fri Jan 20 23:37:41 2023 +0100 HID: Ignore battery for ELAN touchscreen 29DF on HP The touchscreen reports a battery status of 0% and jumps to 1% when a stylus is used. The device ID was added and the battery ignore quirk was enabled for it. Signed-off-by: Luka Guzenko Link: https://lore.kernel.org/r/20230120223741.3007-1-l.guzenko@web.de Signed-off-by: Benjamin Tissoires commit db370a8b9f67ae5f17e3d5482493294467784504 Author: Wander Lairson Costa Date: Thu Feb 2 09:30:20 2023 -0300 rtmutex: Ensure that the top waiter is always woken up Let L1 and L2 be two spinlocks. Let T1 be a task holding L1 and blocked on L2. T1, currently, is the top waiter of L2. Let T2 be the task holding L2. Let T3 be a task trying to acquire L1. The following events will lead to a state in which the wait queue of L2 isn't empty, but no task actually holds the lock. T1 T2 T3 == == == spin_lock(L1) | raw_spin_lock(L1->wait_lock) | rtlock_slowlock_locked(L1) | | task_blocks_on_rt_mutex(L1, T3) | | | orig_waiter->lock = L1 | | | orig_waiter->task = T3 | | | raw_spin_unlock(L1->wait_lock) | | | rt_mutex_adjust_prio_chain(T1, L1, L2, orig_waiter, T3) spin_unlock(L2) | | | | | rt_mutex_slowunlock(L2) | | | | | | raw_spin_lock(L2->wait_lock) | | | | | | wakeup(T1) | | | | | | raw_spin_unlock(L2->wait_lock) | | | | | | | | waiter = T1->pi_blocked_on | | | | waiter == rt_mutex_top_waiter(L2) | | | | waiter->task == T1 | | | | raw_spin_lock(L2->wait_lock) | | | | dequeue(L2, waiter) | | | | update_prio(waiter, T1) | | | | enqueue(L2, waiter) | | | | waiter != rt_mutex_top_waiter(L2) | | | | L2->owner == NULL | | | | wakeup(T1) | | | | raw_spin_unlock(L2->wait_lock) T1 wakes up T1 != top_waiter(L2) schedule_rtlock() If the deadline of T1 is updated before the call to update_prio(), and the new deadline is greater than the deadline of the second top waiter, then after the requeue, T1 is no longer the top waiter, and the wrong task is woken up which will then go back to sleep because it is not the top waiter. This can be reproduced in PREEMPT_RT with stress-ng: while true; do stress-ng --sched deadline --sched-period 1000000000 \ --sched-runtime 800000000 --sched-deadline \ 1000000000 --mmapfork 23 -t 20 done A similar issue was pointed out by Thomas versus the cases where the top waiter drops out early due to a signal or timeout, which is a general issue for all regular rtmutex use cases, e.g. futex. The problematic code is in rt_mutex_adjust_prio_chain(): // Save the top waiter before dequeue/enqueue prerequeue_top_waiter = rt_mutex_top_waiter(lock); rt_mutex_dequeue(lock, waiter); waiter_update_prio(waiter, task); rt_mutex_enqueue(lock, waiter); // Lock has no owner? if (!rt_mutex_owner(lock)) { // Top waiter changed ----> if (prerequeue_top_waiter != rt_mutex_top_waiter(lock)) ----> wake_up_state(waiter->task, waiter->wake_state); This only takes the case into account where @waiter is the new top waiter due to the requeue operation. But it fails to handle the case where @waiter is not longer the top waiter due to the requeue operation. Ensure that the new top waiter is woken up so in all cases so it can take over the ownerless lock. [ tglx: Amend changelog, add Fixes tag ] Fixes: c014ef69b3ac ("locking/rtmutex: Add wake_state to rt_mutex_waiter") Signed-off-by: Wander Lairson Costa Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230117172649.52465-1-wander@redhat.com Link: https://lore.kernel.org/r/20230202123020.14844-1-wander@redhat.com commit eb4b55f2f26fc8a7b7dc6f06f1de91480d53485b Author: Gayatri Kammela Date: Thu Feb 2 17:17:16 2023 -0800 platform/x86/intel/vsec: Add support for Meteor Lake Add Meteor Lake PMT telemetry support. Signed-off-by: Gayatri Kammela Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20230203011716.1078003-1-david.e.box@linux.intel.com Signed-off-by: Hans de Goede commit 44e4c5684fcc82d8f099656c4ea39d9571e2a8ac Author: Aravind Iddamsetty Date: Fri Feb 3 19:22:05 2023 +0530 drm/i915: Initialize the obj flags for shmem objects Obj flags for shmem objects is not being set correctly. Fixes in setting BO_ALLOC_USER flag which applies to shmem objs as well. v2: Add fixes tag (Tvrtko, Matt A) Fixes: 13d29c823738 ("drm/i915/ehl: unconditionally flush the pages on acquire") Cc: # v5.15+ Cc: Matthew Auld Cc: Tvrtko Ursulin Reviewed-by: Matthew Auld Signed-off-by: Aravind Iddamsetty Reviewed-by: Andrzej Hajda Signed-off-by: Tvrtko Ursulin [tursulin: Grouped all tags together.] Link: https://patchwork.freedesktop.org/patch/msgid/20230203135205.4051149-1-aravind.iddamsetty@intel.com (cherry picked from commit bca0d1d3ceeb07be45a51c0fa4d57a0ce31b6aed) Signed-off-by: Rodrigo Vivi commit 251e8c5b1b1fadcc387a8e618c7437d330bdac3e Author: Rob Clark Date: Fri Feb 3 08:49:20 2023 -0800 drm/i915: Move fd_install after last use of fence Because eb_composite_fence_create() drops the fence_array reference after creation of the sync_file, only the sync_file holds a ref to the fence. But fd_install() makes that reference visable to userspace, so it must be the last thing we do with the fence. Signed-off-by: Rob Clark Fixes: 00dae4d3d35d ("drm/i915: Implement SINGLE_TIMELINE with a syncobj (v4)") Cc: # v5.15+ [tursulin: Added stable tag.] Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230203164937.4035503-1-robdclark@gmail.com (cherry picked from commit 960dafa30455450d318756a9896a02727f2639e0) Signed-off-by: Rodrigo Vivi commit 039a72ce7e570c56713fe7758a0658034dc48c9b Author: Jouni Högander Date: Mon Jan 23 09:44:37 2023 +0200 drm/i915/fbdev: Implement fb_dirty for intel custom fb helper After disconnecting damage worker from update logic it's left to fbdev emulation implementation to have fb_dirty function. Currently intel fbdev doesn't have it. This is causing problems to features (PSR, FBC, DRRS) relying on dirty callback. Implement simple fb_dirty callback to deliver notifications about updates in fb console. v4: Add proper Fixes tag and modify commit message v3: Check damage clip v2: Improved commit message and added Fixes tag Fixes: f231af498c29 ("drm/fb-helper: Disconnect damage worker from update logic") Cc: Ville Syrjälä Cc: Thomas Zimmermann Cc: Jani Nikula Signed-off-by: Jouni Högander Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230123074437.475103-1-jouni.hogander@intel.com (cherry picked from commit 1af546c2cec6e28b6bbe01a4ad0c38e96e54fcb4) Signed-off-by: Rodrigo Vivi commit 90d5e8301ac24550be80d193aa5582cab56c29fc Author: Ville Syrjälä Date: Tue Jan 31 02:21:24 2023 +0200 drm/i915: Don't do the WM0->WM1 copy w/a if WM1 is already enabled Due to a workaround we have to make sure the WM1 watermarks block/lines values are sensible even when WM1 is disabled. To that end we copy those values from WM0. However since we now keep each wm level enabled on a per-plane basis it doesn't seem necessary to do that copy when we already have an enabled WM1 on the current plane. That is, we might be in a situation where another plane can only do WM0 (and thus needs the copy) but the current plane's WM1 is still perfectly valid (ie. fits into the current DDB allocation). Skipping the copy could avoid reprogramming the plane's registers needlessly in some cases. Fixes: a301cb0fca2d ("drm/i915: Keep plane watermarks enabled more aggressively") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230131002127.29305-1-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy (cherry picked from commit c580c2d27ac8754cc6f01da1d715b7272f5f9cbb) Signed-off-by: Rodrigo Vivi commit fe1e7e8ce2c47bd8fd9885eab63fca0a522e94c9 Author: Alexey Firago Date: Sat Feb 4 22:51:06 2023 +0300 ASoC: codecs: es8326: Fix DTS properties reading Seems like properties parsing and reading was copy-pasted, so "everest,interrupt-src" and "everest,interrupt-clk" are saved into the es8326->jack_pol variable. This might lead to wrong settings being saved into the reg 57 (ES8326_HP_DET). Fix this by using proper variables while reading properties. Signed-off-by: Alexey Firago Reviewed-by: Yang Yingliang commit e0576cd642ced1ac65370b4516b7be9f536a0498 Author: Daniel Beer Date: Thu Oct 27 21:38:38 2022 +1300 ASoC: tas5805m: add missing page switch. In tas5805m_refresh, we switch pages to update the DSP volume control, but we need to switch back to page 0 before trying to alter the soft-mute control. This latter page-switch was missing. Fixes: ec45268467f4 ("ASoC: add support for TAS5805M digital amplifier") Signed-off-by: Daniel Beer Link: https://lore.kernel.org/r/1fea38a71ea6ab0225d19ab28d1fa12828d762d0.1675497326.git.daniel.beer@igorinstitute.com Signed-off-by: Mark Brown commit 147323792693bf013f60dca160be1d32bd4d180a Author: Daniel Beer Date: Thu Oct 27 21:28:31 2022 +1300 ASoC: tas5805m: rework to avoid scheduling while atomic. There's some setup we need to do in order to get the DSP initialized, and this can't be done until a bit-clock is ready. In an earlier version of this driver, this work was done in a DAPM callback. The DAPM callback doesn't guarantee that the bit-clock is running, so the work was moved instead to the trigger callback. Unfortunately this callback runs in atomic context, and the setup code needs to do I2C transactions. Here we use a work_struct to kick off the setup in a thread instead. Fixes: ec45268467f4 ("ASoC: add support for TAS5805M digital amplifier") Signed-off-by: Daniel Beer Link: https://lore.kernel.org/r/85d8ba405cb009a7a3249b556dc8f3bdb1754fdf.1675497326.git.daniel.beer@igorinstitute.com Signed-off-by: Mark Brown commit 5921b250f43870e7d8044ca14e402292ceb3e3a8 Author: Krzysztof Kozlowski Date: Fri Feb 3 17:50:54 2023 +0100 pinctrl: qcom: sm8450-lpass-lpi: correct swr_rx_data group According to hardware programming guide, the swr_rx_data pin group has only two pins (GPIO5 and GPIO6). This is also visible in "struct sm8450_groups" in the driver - GPIO15 does not have swr_rx_data function. Fixes: ec1652fc4d56 ("pinctrl: qcom: Add sm8450 lpass lpi pinctrl driver") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230203165054.390762-1-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 97e45d469eb180a7bd2809e4e079331552c73e42 Author: Randy Dunlap Date: Sat Feb 4 09:22:06 2023 -0800 powerpc/kexec_file: fix implicit decl error kexec (PPC64) code calls memory_hotplug_max(). Add the header declaration for it from . Using does not work since the #include for depends on CONFIG_NUMA=y, which is not always set. Fixes this build error/warning: arch/powerpc/kexec/file_load_64.c: In function 'kexec_extra_fdt_size_ppc64': arch/powerpc/kexec/file_load_64.c:993:33: error: implicit declaration of function 'memory_hotplug_max' 993 | usm_entries = ((memory_hotplug_max() / drmem_lmb_size()) + | ^~~~~~~~~~~~~~~~~~ Fixes: fc546faa5595 ("powerpc/kexec_file: Count hot-pluggable memory in FDT estimate") Signed-off-by: Randy Dunlap Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230204172206.7662-1-rdunlap@infradead.org commit 563ca0e9eab8acc8a1309e8b440108ff8d23e951 Author: Dan Carpenter Date: Tue Jan 24 18:20:54 2023 +0300 RDMA/mana_ib: Prevent array underflow in mana_ib_create_qp_raw() The "port" comes from the user and if it is zero then the: ndev = mc->ports[port - 1]; assignment does an out of bounds read. I have changed the if statement to fix this and to mirror how it is done in mana_ib_create_qp_rss(). Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Y8/3Vn8qx00kE9Kk@kili Acked-by: Long Li Signed-off-by: Leon Romanovsky commit 7bcfdab3f0c6672ca52be3cb65a0550d8b99554b Author: Mario Limonciello Date: Fri Feb 3 16:08:49 2023 -0600 HID: amd_sfh: if no sensors are enabled, clean up It was reported that commit b300667b33b2 ("HID: amd_sfh: Disable the interrupt for all command") had caused increased resume time on HP Envy x360. Before this commit 3 sensors were reported, but they were not actually functional. After this commit the sensors are no longer reported, but also the resume time increased. To avoid this problem explicitly look for the number of disabled sensors. If all the sensors are disabled, clean everything up. Fixes: b300667b33b2 ("HID: amd_sfh: Disable the interrupt for all command") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2115 Reported-by: Xaver Hugl Signed-off-by: Mario Limonciello Acked-by: Basavaraj Natikar Link: https://lore.kernel.org/r/20230203220850.13924-1-mario.limonciello@amd.com Signed-off-by: Benjamin Tissoires commit 811d581194f7412eda97acc03d17fc77824b561f Author: Alan Stern Date: Fri Feb 3 14:32:09 2023 -0500 net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In modern kernels this error provokes a WARNING: usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 1 PID: 4645 Comm: dhcpcd Not tainted 6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 ... Call Trace: usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068 pl_vendor_req drivers/net/usb/plusb.c:60 [inline] pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline] pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889 __dev_open+0x297/0x4d0 net/core/dev.c:1417 __dev_change_flags+0x587/0x750 net/core/dev.c:8530 dev_change_flags+0x97/0x170 net/core/dev.c:8602 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979 sock_do_ioctl+0xcc/0x230 net/socket.c:1169 sock_ioctl+0x1f8/0x680 net/socket.c:1286 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and remove the USB_DIR_IN flag. Reported-and-tested-by: syzbot+2a0e7abd24f1eb90ce25@syzkaller.appspotmail.com Signed-off-by: Alan Stern Fixes: 090ffa9d0e90 ("[PATCH] USB: usbnet (9/9) module for pl2301/2302 cables") CC: stable@vger.kernel.org Link: https://lore.kernel.org/r/00000000000052099f05f3b3e298@google.com/ Signed-off-by: David S. Miller commit 690eb7dec72ae52d1d710d14a451844b4d0f4f19 Author: Bastien Nocera Date: Fri Feb 3 11:18:00 2023 +0100 HID: logitech: Disable hi-res scrolling on USB On some Logitech mice, such as the G903, and possibly the G403, the HID events are generated on a different interface to the HID++ one. If we enable hi-res through the HID++ interface, the HID interface wouldn't know anything about it, and handle the events as if they were regular scroll events, making the mouse unusable. Disable hi-res scrolling on those devices until we implement scroll events through HID++. Signed-off-by: Bastien Nocera Tested-by: Tobias Klausmann Link: https://bugzilla.kernel.org/show_bug.cgi?id=216885 Fixes: 908d325e1665 ("HID: logitech-hidpp: Detect hi-res scrolling support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230203101800.139380-1-hadess@hadess.net Signed-off-by: Benjamin Tissoires commit ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c Author: Xin Zhao Date: Mon Jan 30 21:29:47 2023 +0000 HID: core: Fix deadloop in hid_apply_multiplier. The initial value of hid->collection[].parent_idx if 0. When Report descriptor doesn't contain "HID Collection", the value remains as 0. In the meanwhile, when the Report descriptor fullfill all following conditions, it will trigger hid_apply_multiplier function call. 1. Usage page is Generic Desktop Ctrls (0x01) 2. Usage is RESOLUTION_MULTIPLIER (0x48) 3. Contain any FEATURE items The while loop in hid_apply_multiplier will search the top-most collection by searching parent_idx == -1. Because all parent_idx is 0. The loop will run forever. There is a Report Descriptor triggerring the deadloop 0x05, 0x01, // Usage Page (Generic Desktop Ctrls) 0x09, 0x48, // Usage (0x48) 0x95, 0x01, // Report Count (1) 0x75, 0x08, // Report Size (8) 0xB1, 0x01, // Feature Signed-off-by: Xin Zhao Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.com Signed-off-by: Benjamin Tissoires commit d7d94b2612f5dc25d61dc7bf58aafe7b31f40191 Author: Casper Andersson Date: Fri Feb 3 09:55:57 2023 +0100 net: microchip: sparx5: fix PTP init/deinit not checking all ports Check all ports instead of just port_count ports. PTP init was only checking ports 0 to port_count. If the hardware ports are not mapped starting from 0 then they would be missed, e.g. if only ports 20-30 were mapped it would attempt to init ports 0-10, resulting in NULL pointers when attempting to timestamp. Now it will init all mapped ports. Fixes: 70dfe25cd866 ("net: sparx5: Update extraction/injection for timestamping") Signed-off-by: Casper Andersson Reviewed-by: Horatiu Vultur Signed-off-by: David S. Miller commit 03702d4d29be4e2510ec80b248dbbde4e57030d9 Author: Herton R. Krzesinski Date: Fri Feb 3 13:04:48 2023 -0300 uapi: add missing ip/ipv6 header dependencies for linux/stddef.h Since commit 58e0be1ef6118 ("net: use struct_group to copy ip/ipv6 header addresses"), ip and ipv6 headers started to use the __struct_group definition, which is defined at include/uapi/linux/stddef.h. However, linux/stddef.h isn't explicitly included in include/uapi/linux/{ip,ipv6}.h, which breaks build of xskxceiver bpf selftest if you install the uapi headers in the system: $ make V=1 xskxceiver -C tools/testing/selftests/bpf ... make: Entering directory '(...)/tools/testing/selftests/bpf' gcc -g -O0 -rdynamic -Wall -Werror (...) In file included from xskxceiver.c:79: /usr/include/linux/ip.h:103:9: error: expected specifier-qualifier-list before ‘__struct_group’ 103 | __struct_group(/* no tag */, addrs, /* no attrs */, | ^~~~~~~~~~~~~~ ... Include the missing dependency in ip.h and do the same for the ipv6.h header. Fixes: 58e0be1ef611 ("net: use struct_group to copy ip/ipv6 header addresses") Signed-off-by: Herton R. Krzesinski Reviewed-by: Carlos O'Donell Tested-by: Carlos O'Donell Signed-off-by: David S. Miller commit c1d2ecdf5e38e3489ce8328238b558b3b2866fe1 Author: Julian Anastasov Date: Thu Feb 2 17:25:51 2023 +0200 neigh: make sure used and confirmed times are valid Entries can linger in cache without timer for days, thanks to the gc_thresh1 limit. As result, without traffic, the confirmed time can be outdated and to appear to be in the future. Later, on traffic, NUD_STALE entries can switch to NUD_DELAY and start the timer which can see the invalid confirmed time and wrongly switch to NUD_REACHABLE state instead of NUD_PROBE. As result, timer is set many days in the future. This is more visible on 32-bit platforms, with higher HZ value. Why this is a problem? While we expect unused entries to expire, such entries stay in REACHABLE state for too long, locked in cache. They are not expired normally, only when cache is full. Problem and the wrong state change reported by Zhang Changzhong: 172.16.1.18 dev bond0 lladdr 0a:0e:0f:01:12:01 ref 1 used 350521/15994171/350520 probes 4 REACHABLE 350520 seconds have elapsed since this entry was last updated, but it is still in the REACHABLE state (base_reachable_time_ms is 30000), preventing lladdr from being updated through probe. Fix it by ensuring timer is started with valid used/confirmed times. Considering the valid time range is LONG_MAX jiffies, we try not to go too much in the past while we are in DELAY/PROBE state. There are also places that need used/updated times to be validated while timer is not running. Reported-by: Zhang Changzhong Signed-off-by: Julian Anastasov Tested-by: Zhang Changzhong Signed-off-by: David S. Miller commit 9a6804aa1c92cd28e89e746ace44d5ba101db76c Author: Elvis Angelaccio Date: Sun Feb 5 19:56:18 2023 +0100 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 The HP Elitebook 645 G9 laptop (with motherboard model 89D2) uses the ALC236 codec and requires the alc236_fixup_hp_mute_led_micmute_vref fixup in order to enable mute/micmute LEDs. Note: the alc236_fixup_hp_gpio_led fixup, which is used by the Elitebook 640 G9, does not work with the 645 G9. [ rearranged the entry in SSID order -- tiwai ] Signed-off-by: Elvis Angelaccio Cc: Link: https://lore.kernel.org/r/4055cb48-e228-8a13-524d-afbb7aaafebe@kde.org Signed-off-by: Takashi Iwai commit 51be2fffd65d9f9cb427030ab0ee85d791b4437d Author: Douglas Anderson Date: Thu Feb 2 14:00:23 2023 -0800 cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems On a sc7180-based Chromebook, when I go to /sys/devices/system/cpu/cpu0/cpufreq I can see: cpuinfo_cur_freq:2995200 cpuinfo_max_freq:1804800 scaling_available_frequencies:300000 576000 ... 1708800 1804800 scaling_cur_freq:1804800 scaling_max_freq:1804800 As you can see the `cpuinfo_cur_freq` is bogus. It turns out that this bogus info started showing up as of commit c72cf0cb1d77 ("cpufreq: qcom-hw: Fix the frequency returned by cpufreq_driver->get()"). That commit seems to assume that everyone is on the LMH bandwagon, but sc7180 isn't. Let's go back to the old code in the case where LMH isn't used. Fixes: c72cf0cb1d77 ("cpufreq: qcom-hw: Fix the frequency returned by cpufreq_driver->get()") Signed-off-by: Douglas Anderson Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam [ Viresh: Fixed the 'fixes' tag ] Signed-off-by: Viresh Kumar commit d2d11f342b179f1894a901f143ec7c008caba43e Merge: 4ec5183ec4865 9c7417b5ec440 Author: Linus Torvalds Date: Sun Feb 5 17:17:10 2023 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ELF fix from Al Viro: "One of the many equivalent build warning fixes for !CONFIG_ELF_CORE configs. Geert's is the earliest one I've been able to find" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: coredump: Move dump_emit_page() to kill unused warning commit 4ec5183ec48656cec489c49f989c508b68b518e3 Author: Linus Torvalds Date: Sun Feb 5 13:13:28 2023 -0800 Linux 6.2-rc7 commit c608f6b58f306ce0e4f459af69a196f5ed6ccf45 Merge: dc0ce181af6d1 f82060da749c6 Author: Linus Torvalds Date: Sun Feb 5 12:19:55 2023 -0800 Merge tag 'usb-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes that resolve some reported problems. These include: - gadget driver fixes - dwc3 driver fix - typec driver fix - MAINTAINERS file update. All of these have been in linux-next with no reported problems" * tag 'usb-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: ucsi: Don't attempt to resume the ports before they exist usb: gadget: udc: do not clear gadget driver.bus usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait usb: dwc3: qcom: enable vbus override when in OTG dr-mode MAINTAINERS: Add myself as UVC Gadget Maintainer commit dc0ce181af6d1989192b973eae5f916cb6ce47f0 Merge: d3feaff4d9492 226fae124b2da Author: Linus Torvalds Date: Sun Feb 5 12:06:29 2023 -0800 Merge tag 'tty-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small serial and vt fixes. These include: - 8250 driver fixes relating to dma issues - stm32 serial driver fix for threaded irqs - vc_screen bugfix for reported problems. All have been in linux-next for a while with no reported problems" * tag 'tty-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF serial: 8250_dma: Fix DMA Rx rearm race serial: 8250_dma: Fix DMA Rx completion race serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler commit d3feaff4d9492aa05b94167e170858da81159654 Merge: 870c3a9a2bc48 d83d7ed260283 Author: Linus Torvalds Date: Sun Feb 5 11:52:23 2023 -0800 Merge tag 'char-misc-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/whatever driver fixes. They include: - IIO driver fixes for some reported problems - nvmem driver fixes - fpga driver fixes - debugfs memory leak fix in the hv_balloon and irqdomain code (irqdomain change was acked by the maintainer) All have been in linux-next with no reported problems" * tag 'char-misc-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (33 commits) kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() HV: hv_balloon: fix memory leak with using debugfs_lookup() nvmem: qcom-spmi-sdam: fix module autoloading nvmem: core: fix return value nvmem: core: fix cell removal on error nvmem: core: fix device node refcounting nvmem: core: fix registration vs use race nvmem: core: fix cleanup after dev_set_name() nvmem: core: remove nvmem_config wp_gpio nvmem: core: initialise nvmem->id early nvmem: sunxi_sid: Always use 32-bit MMIO reads nvmem: brcm_nvram: Add check for kzalloc iio: imu: fxos8700: fix MAGN sensor scale and unit iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: fix incorrect ODR mode readback iio: light: cm32181: Fix PM support on system with 2 I2C resources iio: hid: fix the retval in gyro_3d_capture_sample iio: hid: fix the retval in accel_3d_capture_sample iio: imu: st_lsm6dsx: fix build when CONFIG_IIO_TRIGGERED_BUFFER=m ... commit 870c3a9a2bc48bea0f954172aaff7ed489acaf64 Merge: 9e482602c5945 2b09d5d364986 Author: Linus Torvalds Date: Sun Feb 5 11:43:00 2023 -0800 Merge tag 'fbdev-for-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - fix fbcon to prevent fonts bigger than 32x32 pixels to avoid overflows reported by syzbot - switch omapfb to use kstrtobool() - switch some fbdev drivers to use the backlight helpers * tag 'fbdev-for-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbcon: Check font dimension limits fbdev: omapfb: Use kstrtobool() instead of strtobool() fbdev: fbmon: fix function name in kernel-doc fbdev: atmel_lcdfb: Rework backlight status updates fbdev: riva: Use backlight helper fbdev: omapfb: panel-dsi-cm: Use backlight helper fbdev: nvidia: Use backlight helper fbdev: mx3fb: Use backlight helper fbdev: radeon: Use backlight helper fbdev: atyfb: Use backlight helper fbdev: aty128fb: Use backlight helper commit 9e482602c59457374916d942b4ba6ff602b14fa4 Merge: de506eec89d84 9d2c7203ffdb8 Author: Linus Torvalds Date: Sun Feb 5 11:28:42 2023 -0800 Merge tag 'x86_urgent_for_v6.2_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Prevent the compiler from reordering accesses to debug regs which could cause a #VC exception in SEV-ES guests at the wrong place in the NMI handling path * tag 'x86_urgent_for_v6.2_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses commit de506eec89d8456dfe344fac5b72afce0dce07a3 Merge: 837c07cf68fec 4f64a6c9f6f11 Author: Linus Torvalds Date: Sun Feb 5 11:03:56 2023 -0800 Merge tag 'perf_urgent_for_v6.2_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Lock the proper critical section when dealing with perf event context * tag 'perf_urgent_for_v6.2_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix perf_event_pmu_context serialization commit 837c07cf68fec9cad455d5fc86aab5350cc06c53 Merge: 95078069c1e70 1665c027afb22 Author: Linus Torvalds Date: Sat Feb 4 18:40:51 2023 -0800 Merge tag 'powerpc-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "It's a bit of a big batch for rc6, but just because I didn't send any fixes the last week or two while I was on vacation, next week should be quieter: - Fix a few objtool warnings since we recently enabled objtool. - Fix a deadlock with the hash MMU vs perf record. - Fix perf profiling of asynchronous interrupt handlers. - Revert the IMC PMU nest_init_lock to being a mutex. - Two commits fixing problems with the kexec_file FDT size estimation. - Two commits fixing problems with strict RWX vs kernels running at non-zero. - Reconnect tlb_flush() to hash__tlb_flush() Thanks to Kajol Jain, Nicholas Piggin, Sachin Sant Sathvika Vasireddy, and Sourabh Jain" * tag 'powerpc-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s: Reconnect tlb_flush() to hash__tlb_flush() powerpc/kexec_file: Count hot-pluggable memory in FDT estimate powerpc/64s/radix: Fix RWX mapping with relocated kernel powerpc/64s/radix: Fix crash with unaligned relocated kernel powerpc/kexec_file: Fix division by zero in extra size estimation powerpc/imc-pmu: Revert nest_init_lock to being a mutex powerpc/64: Fix perf profiling asynchronous interrupt handlers powerpc/64s: Fix local irq disable when PMIs are disabled powerpc/kvm: Fix unannotated intra-function call warning powerpc/85xx: Fix unannotated intra-function call warning commit 95078069c1e70d1b3b141132d18d0c563acedd0c Merge: db27c22251e7c 08279468a294d Author: Linus Torvalds Date: Sat Feb 4 13:46:37 2023 -0800 Merge tag 'rtc-6.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "Here are a few fixes for 6.2. The EFI one is the most important as it allows some RTCs to actually work. The other two are warnings that are worth fixing. - efi: make WAKEUP services optional - sunplus: fix format string warning" * tag 'rtc-6.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: sunplus: fix format string for printing resource dt-bindings: rtc: qcom-pm8xxx: allow 'wakeup-source' property rtc: efi: Enable SET/GET WAKEUP services as optional commit db27c22251e7c8f3a9d5bfb55c9c8c701a70bbb3 Merge: c00f4ddde0943 22e46f6480e83 Author: Linus Torvalds Date: Sat Feb 4 11:30:23 2023 -0800 Merge tag 'kbuild-fixes-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix two bugs (for building and for signing) when MODULE_SIG_KEY contains a PKCS#11 URI * tag 'kbuild-fixes-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI certs: Fix build error when PKCS#11 URI contains semicolon commit c00f4ddde0943cf54499bc380ffca6376af2d945 Merge: 2ab2ba494db2d 25b72cf7da9f0 Author: Linus Torvalds Date: Sat Feb 4 11:21:27 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM64: - Yet another fix for non-CPU accesses to the memory backing the VGICv3 subsystem - A set of fixes for the setlftest checking for the S1PTW behaviour after the fix that went in ealier in the cycle" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: aarch64: Test read-only PT memory regions KVM: selftests: aarch64: Fix check of dirty log PT write KVM: selftests: aarch64: Do not default to dirty PTE pages on all S1PTWs KVM: selftests: aarch64: Relax userfaultfd read vs. write checks KVM: arm64: Allow no running vcpu on saving vgic3 pending table KVM: arm64: Allow no running vcpu on restoring vgic3 LPI pending status KVM: arm64: Add helper vgic_write_guest_lock() commit 2ab2ba494db2dbfbb541ae27f69317e1c089ea51 Merge: 583472ef2d176 316f1f42b5cc1 Author: Linus Torvalds Date: Sat Feb 4 11:15:00 2023 -0800 Merge tag 'parisc-for-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - Fix PTRACE_GETREGS/PTRACE_SETREGS for 32-bit userspace on a 64-bit kernel - pdc_iodc_print() dropped chars for newline in strings - Drop constants in favour of PRIV_USER - use safer strscpy() function in pdc_stable driver * tag 'parisc-for-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case parisc: Replace hardcoded value with PRIV_USER constant in ptrace.c parisc: Fix return code of pdc_iodc_print() parisc: pdc_stable: use strscpy() to instead of strncpy() commit 583472ef2d176883596637a690602e6d76c5fee5 Merge: 0136d86b78522 0a2742bf5899b Author: Linus Torvalds Date: Sat Feb 4 10:14:50 2023 -0800 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC mailing list update from Stafford Horne: "The old mailing list for OpenRISC died due to some infrastructure issues and the people in charge decided not to keep it running. We have migrated this and the users over to kernel.org infrastructure. Sending this out now to avoid kernel developers getting lots of bounced mails for using the old list" * tag 'for-linus' of https://github.com/openrisc/linux: MAINTAINERS: Update OpenRISC mailing list commit 25b72cf7da9f0d66eef3979187ddfda98d4efcd0 Merge: c2c46b10d5262 08ddbbdf0b558 Author: Paolo Bonzini Date: Sat Feb 4 08:57:43 2023 -0500 Merge tag 'kvmarm-fixes-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.2, take #3 - Yet another fix for non-CPU accesses to the memory backing the VGICv3 subsystem - A set of fixes for the setlftest checking for the S1PTW behaviour after the fix that went in ealier in the cycle commit 2b09d5d364986f724f17001ccfe4126b9b43a0be Author: Samuel Thibault Date: Sun Jan 29 16:17:40 2023 +0100 fbcon: Check font dimension limits blit_x and blit_y are u32, so fbcon currently cannot support fonts larger than 32x32. The 32x32 case also needs shifting an unsigned int, to properly set bit 31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font", as reported on: http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com Kernel Branch: 6.2.0-rc5-next-20230124 Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing Reported-by: Sanan Hasanov Signed-off-by: Samuel Thibault Fixes: 2d2699d98492 ("fbcon: font setting should check limitation of driver") Cc: stable@vger.kernel.org Tested-by: Miko Larsson Reviewed-by: Greg Kroah-Hartman Signed-off-by: Helge Deller commit a05e7a67986c6be900f7d3310fa5bb1e0c55bb4c Merge: 69ff53e4a4c94 b69585bfcecee Author: Jakub Kicinski Date: Fri Feb 3 19:58:56 2023 -0800 Merge branch 'ionic-code-maintenance' Shannon Nelson says: ==================== ionic: code maintenance These are a few fixes for a hardware bug, a couple of sw bugs, and a little code cleanup. ==================== Link: https://lore.kernel.org/r/20230202215537.69756-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski commit b69585bfceceeffda940906cabfdaee4b47bde92 Author: Allen Hubbe Date: Thu Feb 2 13:55:37 2023 -0800 ionic: missed doorbell workaround In one version of the HW there is a remote possibility that it will miss the doorbell ring. This adds a bit of protection to be sure we don't stall a queue from a missed doorbell. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Allen Hubbe Signed-off-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 1fffb0254178de1d4d9e67f467a3460d10680b10 Author: Shannon Nelson Date: Thu Feb 2 13:55:36 2023 -0800 ionic: clear up notifyq alloc commentary Make sure the q+cq alloc for NotifyQ is clearly documented and don't bother with unnecessary local variables. Signed-off-by: Shannon Nelson Reviewed-by: Leon Romanovsky Signed-off-by: Jakub Kicinski commit e8797a058466b60fc5a3291b92430c93ba90eaff Author: Neel Patel Date: Thu Feb 2 13:55:35 2023 -0800 ionic: clean interrupt before enabling queue to avoid credit race Clear the interrupt credits before enabling the queue rather than after to be sure that the enabled queue starts at 0 and that we don't wipe away possible credits after enabling the queue. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Neel Patel Signed-off-by: Shannon Nelson Reviewed-by: Leon Romanovsky Signed-off-by: Jakub Kicinski commit 69ff53e4a4c9498eeed7d1441f68a1481dc69251 Author: Heiner Kallweit Date: Thu Feb 2 21:45:36 2023 +0100 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY Jerome provided the information that also the GXL internal PHY doesn't support MMD register access and EEE. MMD reads return 0xffff, what results in e.g. completely wrong ethtool --show-eee output. Therefore use the MMD dummy stubs. Fixes: d853d145ea3e ("net: phy: add an option to disable EEE advertisement") Suggested-by: Jerome Brunet Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/84432fe4-0be4-bc82-4e5c-557206b40f56@gmail.com Signed-off-by: Jakub Kicinski commit c9011b028e956c3b6baa6f131d9eec43e4e52020 Author: Radhey Shyam Pandey Date: Thu Feb 2 17:56:19 2023 +0530 net: macb: Perform zynqmp dynamic configuration only for SGMII interface In zynqmp platforms where firmware supports dynamic SGMII configuration but has other non-SGMII ethernet devices, it fails them with no packets received at the RX interface. To fix this behaviour perform SGMII dynamic configuration only for the SGMII phy interface. Fixes: 32cee7818111 ("net: macb: Add zynqmp SGMII dynamic configuration support") Signed-off-by: Radhey Shyam Pandey Reviewed-by: Jiri Pirko Reported-by: Michal Simek Tested-by: Michal Simek Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/1675340779-27499-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Jakub Kicinski commit cbe83191d40d8925b7a99969d037d2a0caf69294 Author: Qi Zheng Date: Thu Feb 2 17:32:55 2023 +0800 bonding: fix error checking in bond_debug_reregister() Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), we should also check error values instead of NULL. Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Signed-off-by: Qi Zheng Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20230202093256.32458-1-zhengqi.arch@bytedance.com Signed-off-by: Jakub Kicinski commit a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 Author: Andrew Morton Date: Thu Feb 2 18:07:35 2023 -0800 revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" This fix was nacked by Philip, for reasons identified in the email linked below. Link: https://lkml.kernel.org/r/68f15d67-8945-2728-1f17-5b53a80ec52d@squashfs.org.uk Fixes: 72e544b1b28325 ("squashfs: harden sanity check in squashfs_read_xattr_id_table") Cc: Alexey Khoroshilov Cc: Fedor Pchelkin Cc: Phillip Lougher Signed-off-by: Andrew Morton commit 388bc034d91d480efa88abc5c8d6e6c8a878b1ab Author: Shiyang Ruan Date: Thu Feb 2 12:33:47 2023 +0000 fsdax: dax_unshare_iter() should return a valid length The copy_mc_to_kernel() will return 0 if it executed successfully. Then the return value should be set to the length it copied. [akpm@linux-foundation.org: don't mess up `ret', per Matthew] Link: https://lkml.kernel.org/r/1675341227-14-1-git-send-email-ruansy.fnst@fujitsu.com Fixes: d984648e428b ("fsdax,xfs: port unshare to fsdax") Signed-off-by: Shiyang Ruan Cc: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit aa1e6a932ca652a50a5df458399724a80459f521 Author: Kuan-Ying Lee Date: Tue Jan 31 14:32:06 2023 +0800 mm/gup: add folio to list when folio_isolate_lru() succeed If we call folio_isolate_lru() successfully, we will get return value 0. We need to add this folio to the movable_pages_list. Link: https://lkml.kernel.org/r/20230131063206.28820-1-Kuan-Ying.Lee@mediatek.com Fixes: 67e139b02d99 ("mm/gup.c: refactor check_and_migrate_movable_pages()") Signed-off-by: Kuan-Ying Lee Reviewed-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Baolin Wang Cc: Andrew Yang Cc: Chinwen Chang Cc: John Hubbard Cc: Matthias Brugger Signed-off-by: Andrew Morton commit 81e9d6f8647650a7bead74c5f926e29970e834d1 Author: Seth Jenkins Date: Tue Jan 31 12:25:55 2023 -0500 aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL. [jmoyer@redhat.com: fix 80 column issue] Link: https://lkml.kernel.org/r/x49sffq4nvg.fsf@segfault.boston.devel.redhat.com Fixes: e4a0d3e720e7 ("aio: Make it possible to remap aio ring") Signed-off-by: Seth Jenkins Signed-off-by: Jeff Moyer Cc: Alexander Viro Cc: Benjamin LaHaise Cc: Jann Horn Cc: Pavel Emelyanov Cc: Signed-off-by: Andrew Morton commit ca2b1a5cd107d451e71e7ef463c2a2141ec078d2 Author: Alexander Mikhalitsyn Date: Tue Jan 31 13:34:56 2023 +0100 mailmap: add entry for Alexander Mikhalitsyn My old email isn't working anymore. Link: https://lkml.kernel.org/r/20230131123456.192657-1-aleksandr.mikhalitsyn@canonical.com Signed-off-by: Alexander Mikhalitsyn Signed-off-by: Andrew Morton commit 3770e52fd4ec40ebee16ba19ad6c09dc0b52739b Author: Arnd Bergmann Date: Mon Jan 30 14:07:26 2023 +0100 mm: extend max struct page size for kmsan After x86 enabled support for KMSAN, it has become possible to have larger 'struct page' than was expected when commit 5470dea49f53 ("mm: use mm_zero_struct_page from SPARC on all 64b architectures") was merged: include/linux/mm.h:156:10: warning: no case matching constant switch condition '96' switch (sizeof(struct page)) { Extend the maximum accordingly. Link: https://lkml.kernel.org/r/20230130130739.563628-1-arnd@kernel.org Fixes: 5470dea49f53 ("mm: use mm_zero_struct_page from SPARC on all 64b architectures") Fixes: 4ca8cc8d1bbe ("x86: kmsan: enable KMSAN builds for x86") Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core") Signed-off-by: Arnd Bergmann Acked-by: Michal Hocko Reviewed-by: Pasha Tatashin Cc: Alexander Duyck Cc: Alexander Potapenko Cc: Alex Sierra Cc: David Hildenbrand Cc: Hugh Dickins Cc: John Hubbard Cc: Liam R. Howlett Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 0136d86b78522bbd5755f8194c97a987f0586ba5 Merge: 7b753a909f426 e02bbac74cdde Author: Linus Torvalds Date: Fri Feb 3 11:35:42 2023 -0800 Merge tag 'block-6.2-2023-02-03' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A bit bigger than I'd like at this point, but mostly a bunch of little fixes. In detail: - NVMe pull request via Christoph: - Fix a missing queue put in nvmet_fc_ls_create_association (Amit Engel) - Clear queue pointers on tag_set initialization failure (Maurizio Lombardi) - Use workqueue dedicated to authentication (Shin'ichiro Kawasaki) - Fix for an overflow in ublk (Liu) - Fix for leaking a queue reference in block cgroups (Ming) - Fix for a use-after-free in BFQ (Yu)" * tag 'block-6.2-2023-02-03' of git://git.kernel.dk/linux: blk-cgroup: don't update io stat for root cgroup nvme-auth: use workqueue dedicated to authentication nvme: clear the request_queue pointers on failure in nvme_alloc_io_tag_set nvme: clear the request_queue pointers on failure in nvme_alloc_admin_tag_set nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association block: Fix the blk_mq_destroy_queue() documentation block: ublk: extending queue_size to fix overflow block, bfq: fix uaf for bfqq in bic_set_bfqq() commit 9f8b3706eb23bed26f7898af3c6f7fe3858564a1 Author: Bert Karwatzki Date: Thu Feb 2 20:02:36 2023 +0100 drm/amdgpu: fix memory leak in amdgpu_cs_sync_rings amdgpu_sync_get_fence deletes the returned fence from the syncobj, so the refcount of fence needs to lowered to avoid a memory leak. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2360 Reviewed-by: Alex Deucher Tested-by: Mikhail Gavrilov Reviewed-by: Christian König Signed-off-by: Bert Karwatzki Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/3b590ba0f11d24b8c6c39c3d38250129c1116af4.camel@web.de commit 7b753a909f426f2789d9db6f357c3d59180a9354 Merge: a0880c33794ba a68e564adcaa6 Author: Linus Torvalds Date: Fri Feb 3 10:34:07 2023 -0800 Merge tag 'ceph-for-6.2-rc7' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A safeguard to prevent the kernel client from further damaging the filesystem after running into a case of an invalid snap trace. The root cause of this metadata corruption is still being investigated but it appears to be stemming from the MDS. As such, this is the best we can do for now" * tag 'ceph-for-6.2-rc7' of https://github.com/ceph/ceph-client: ceph: blocklist the kclient when receiving corrupted snap trace ceph: move mount state enum to super.h commit a0880c33794ba417687822482ffb0d3b797f0a04 Merge: a30df1ea94ad3 966d47e1f27c4 Author: Linus Torvalds Date: Fri Feb 3 10:25:41 2023 -0800 Merge tag 'efi-fixes-for-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - handle potential mremap() failure gracefully - don't reject EFI memory attributes table version 2 * tag 'efi-fixes-for-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: fix potential NULL deref in efi_mem_reserve_persistent efi: Accept version 2 of memory attributes table commit a30df1ea94ad35c7b42d44199fe1376b4d648862 Merge: bffede38f82c2 2f394c0e7d112 Author: Linus Torvalds Date: Fri Feb 3 10:18:39 2023 -0800 Merge tag 'riscv-for-linus-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A build fix to avoid static branches in cpu_relax(), which greatly inflates the jump tables and breaks at least CONFIG_CC_OPTIMIZE_FOR_SIZE=y. - A fix for a kernel panic when probing impossible instruction positions. - A fix to disable unwind tables, which are enabled by default for GCC-13 and result in unhandled relocations in modules. * tag 'riscv-for-linus-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: disable generation of unwind tables riscv: kprobe: Fixup kernel panic when probing an illegal position riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y commit bffede38f82c27cf5e203a2c659fcc9b581dd7b8 Merge: 0c272a1d33965 f1a9e82a12038 Author: Linus Torvalds Date: Fri Feb 3 10:09:55 2023 -0800 Merge tag 'drm-fixes-2023-02-03' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "A few more fixes this week, a bit more spread out though. We have a bunch of nouveau regression and stabilisation fixes, along with usual amdgpu, and i915. Otherwise just some minor misc ones: dma-fence: - fix signaling bit for private fences panel: - boe-tv101wum-nl6 disable fix nouveau: - gm20b acr regression fix - tu102 scrub status fix - tu102 wait for firmware fix i915: - Fixes for potential use-after-free and double-free - GuC locking and refcount fixes - Display's reference clock value fix amdgpu: - GC11 fixes - DCN 3.1.4 fixes - NBIO 4.3 fix - DCN 3.2 fixes - Properly handle additional cases where DCN is not supported - SMU13 fixes vc4: - fix CEC adapter names ssd130x: - fix display init regression" * tag 'drm-fixes-2023-02-03' of git://anongit.freedesktop.org/drm/drm: (23 commits) drm/amd/display: Properly handle additional cases where DCN is not supported drm/amdgpu: Enable vclk dclk node for gc11.0.3 drm/amd: Fix initialization for nbio 4.3.0 drm/amdgpu: enable HDP SD for gfx 11.0.3 drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11 drm/amd/display: Reset DMUB mailbox SW state after HW reset drm/amd/display: Unassign does_plane_fit_in_mall function from dcn3.2 drm/amd/display: Adjust downscaling limits for dcn314 drm/amd/display: Add missing brackets in calculation drm/amdgpu: update wave data type to 3 for gfx11 drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable drm/nouveau/acr/gm20b: regression fixes drm/nouveau/fb/tu102-: fix register used to determine scrub status drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED drm/i915/adlp: Fix typo for reference clock drm/i915: Fix potential bit_17 double-free drm/i915: Fix up locking around dumping requests lists drm/i915: Fix request ref counting during error capture & debugfs dump drm/i915/guc: Fix locking when searching for a hung request drm/i915: Avoid potential vm use-after-free ... commit 0c272a1d33965627653f4fafd6eab55d0d50f21f Merge: 66a87fff1a87c ac86f547ca100 Author: Linus Torvalds Date: Fri Feb 3 10:01:57 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-02-02-19-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "25 hotfixes, mainly for MM. 13 are cc:stable" * tag 'mm-hotfixes-stable-2023-02-02-19-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (26 commits) mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() Kconfig.debug: fix the help description in SCHED_DEBUG mm/swapfile: add cond_resched() in get_swap_pages() mm: use stack_depot_early_init for kmemleak Squashfs: fix handling and sanity checking of xattr_ids count sh: define RUNTIME_DISCARD_EXIT highmem: round down the address passed to kunmap_flush_on_unmap() migrate: hugetlb: check for hugetlb shared PMD in node migration mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups Revert "mm: kmemleak: alloc gray object for reserved region with direct map" freevxfs: Kconfig: fix spelling maple_tree: should get pivots boundary by type .mailmap: update e-mail address for Eugen Hristev mm, mremap: fix mremap() expanding for vma's with vm_ops->close() squashfs: harden sanity check in squashfs_read_xattr_id_table ia64: fix build error due to switch case label appearing next to declaration mm: multi-gen LRU: fix crash during cgroup migration Revert "mm: add nodes= arg to memory.reclaim" zsmalloc: fix a race with deferred_handles storing ... commit 966d47e1f27c45507c5df82b2a2157e5a4fd3909 Author: Anton Gusev Date: Fri Feb 3 16:22:13 2023 +0300 efi: fix potential NULL deref in efi_mem_reserve_persistent When iterating on a linked list, a result of memremap is dereferenced without checking it for NULL. This patch adds a check that falls back on allocating a new page in case memremap doesn't succeed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 18df7577adae ("efi/memreserve: deal with memreserve entries in unmapped memory") Signed-off-by: Anton Gusev [ardb: return -ENOMEM instead of breaking out of the loop] Signed-off-by: Ard Biesheuvel commit 4722dd4029c63f10414ffd8d3ffdd6c748391cd7 Author: Dmitry Torokhov Date: Fri Sep 30 09:00:41 2022 -0700 ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port According to c8sectpfe driver code we first drive reset line low and then high to reset the port, therefore the reset line is supposed to be annotated as "active low". This will be important when we convert the driver to gpiod API. Reviewed-by: Patrice Chotard Signed-off-by: Dmitry Torokhov Signed-off-by: Patrice Chotard commit 97801cfcf9565247bcc53b67ea47fa87b1704375 Author: Chen-Yu Tsai Date: Thu Feb 2 18:40:14 2023 +0800 arm64: dts: mediatek: mt8195: Fix vdosys* compatible strings When vdosys1 was initially added, it was incorrectly assumed to be compatible with vdosys0, and thus both had the same mt8195-mmsys compatible attached. This has since been corrected in commit b237efd47df7 ("dt-bindings: arm: mediatek: mmsys: change compatible for MT8195") and commit 82219cfbef18 ("dt-bindings: arm: mediatek: mmsys: add vdosys1 compatible for MT8195"). The device tree needs to be fixed as well, otherwise the vdosys1 block fails to work, and causes its dependent power domain controller to not work either. Change the compatible string of vdosys1 to "mediatek,mt8195-vdosys1". While at it, also add the new "mediatek,mt8195-vdosys0" compatible to vdosys0. Fixes: 6aa5b46d1755 ("arm64: dts: mt8195: Add vdosys and vppsys clock nodes") Signed-off-by: Chen-Yu Tsai Tested-by: AngeloGioacchino Del Regno Reviewed-by: AngeloGioacchino Del Regno Acked-by: Matthias Brugger Link: https://lore.kernel.org/r/20230202104014.2931517-1-wenst@chromium.org Signed-off-by: Arnd Bergmann commit 07975ef0faae2cf49aded78f907c84ee7d238ad6 Merge: 6d796c50f84ca b67b09733d8a4 Author: Arnd Bergmann Date: Fri Feb 3 14:18:41 2023 +0100 Merge tag 'v6.2-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Fixes to adapt to correct binding behaviour and fixes for devices on some boards Most notably may be the adaption of lower thermal limits for the pinephone pro, where the original hiher ones could result in (possibly permanent) display issues. * tag 'v6.2-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: align rk3399 DMC OPP table with bindings arm64: dts: rockchip: set sdmmc0 speed to sd-uhs-sdr50 on rock-3a arm64: dts: rockchip: fix probe of analog sound card on rock-3a arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1 arm64: dts: rockchip: fix input enable pinconf on rk3399 ARM: dts: rockchip: add power-domains property to dp node on rk3288 arm64: dts: rockchip: add io domain setting to rk3566-box-demo arm64: dts: rockchip: remove unsupported property from sdmmc2 for rock-3a arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro arm64: dts: rockchip: use correct reset names for rk3399 crypto nodes Link: https://lore.kernel.org/r/3514663.mvXUDI8C0e@phil Signed-off-by: Arnd Bergmann commit ce93fdb5f2ca5c9e2a9668411cc39091507f8dc9 Author: Clément Léger Date: Tue Jan 31 11:02:42 2023 +0100 net: phylink: move phy_device_free() to correctly release phy device After calling fwnode_phy_find_device(), the phy device refcount is incremented. Then, when the phy device is attached to a netdev with phy_attach_direct(), the refcount is also incremented but only decremented in the caller if phy_attach_direct() fails. Move phy_device_free() before the "if" to always release it correctly. Indeed, either phy_attach_direct() failed and we don't want to keep a reference to the phydev or it succeeded and a reference has been taken internally. Fixes: 25396f680dd6 ("net: phylink: introduce phylink_fwnode_phy_connect()") Signed-off-by: Clément Léger Signed-off-by: David S. Miller commit d83d7ed260283560700d4034a80baad46620481b Author: Greg Kroah-Hartman Date: Thu Feb 2 16:15:54 2023 +0100 kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Thomas Gleixner Cc: stable Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230202151554.2310273-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 6dfb0771429a63db8561d44147f2bb76f93e1c86 Author: Greg Kroah-Hartman Date: Thu Feb 2 15:09:18 2023 +0100 HV: hv_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Fixes: d180e0a1be6c ("Drivers: hv: Create debugfs file with hyper-v balloon usage information") Cc: stable Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20230202140918.2289522-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit cb80242cc679d6397e77d8a964deeb3ff218d2b5 Author: Liu Shixin Date: Wed Dec 7 10:50:38 2022 +0800 riscv: stacktrace: Fix missing the first frame When running kfence_test, I found some testcases failed like this: # test_out_of_bounds_read: EXPECTATION FAILED at mm/kfence/kfence_test.c:346 Expected report_matches(&expect) to be true, but is false not ok 1 - test_out_of_bounds_read The corresponding call-trace is: BUG: KFENCE: out-of-bounds read in kunit_try_run_case+0x38/0x84 Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#10): kunit_try_run_case+0x38/0x84 kunit_generic_run_threadfn_adapter+0x12/0x1e kthread+0xc8/0xde ret_from_exception+0x0/0xc The kfence_test using the first frame of call trace to check whether the testcase is succeed or not. Commit 6a00ef449370 ("riscv: eliminate unreliable __builtin_frame_address(1)") skip first frame for all case, which results the kfence_test failed. Indeed, we only need to skip the first frame for case (task==NULL || task==current). With this patch, the call-trace will be: BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x88/0x19e Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#7): test_out_of_bounds_read+0x88/0x19e kunit_try_run_case+0x38/0x84 kunit_generic_run_threadfn_adapter+0x12/0x1e kthread+0xc8/0xde ret_from_exception+0x0/0xc Fixes: 6a00ef449370 ("riscv: eliminate unreliable __builtin_frame_address(1)") Signed-off-by: Liu Shixin Tested-by: Samuel Holland Link: https://lore.kernel.org/r/20221207025038.1022045-1-liushixin2@huawei.com Signed-off-by: Palmer Dabbelt commit f1a9e82a1203802df3c917dd7ab1b5a5ded55793 Merge: 74d6c8ea183e7 6fc547a5a2ef5 Author: Dave Airlie Date: Fri Feb 3 13:28:05 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-02-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-02-01: amdgpu: - GC11 fixes - DCN 3.1.4 fixes - NBIO 4.3 fix - DCN 3.2 fixes - Properly handle additional cases where DCN is not supported - SMU13 fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230202042309.24144-1-alexander.deucher@amd.com commit 74d6c8ea183e73031db635a96f67bc30ae1fc2ee Merge: abf301e14e427 47a2bd9d985bf Author: Dave Airlie Date: Fri Feb 3 12:28:28 2023 +1000 Merge tag 'drm-intel-fixes-2023-02-02' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fixes for potential use-after-free and double-free (Rob) - GuC locking and refcount fixes (John) - Display's reference clock value fix (Chaitanya) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y9u5pHjOYcxzS5Z7@intel.com commit abf301e14e42702c11ab20331aa4d0ab87a777ca Merge: 6d796c50f84ca a3ee9e0b57f8e Author: Dave Airlie Date: Fri Feb 3 11:57:23 2023 +1000 Merge tag 'drm-misc-fixes-2023-02-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A fix for a non-unique CEC adapter name registration in vc4, a regression breaking the display in ssd130x, a signaling bit issue in dma-fence, a couple of fixes in nouveau for Turing and Ampere, and a disable fix for the boe-tv101wum-nl6 panel. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230202085724.pz22m7bmei3wyuzp@houat commit 66a87fff1a87c260452f5a57123891ca5258c449 Merge: edb9b8f380c34 69f2c9346313b Author: Linus Torvalds Date: Thu Feb 2 16:44:07 2023 -0800 Merge tag 'ata-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull libata fix from Damien Le Moal: "Fix device probe issues with some combination of adapters & devices that do not report a current link speed, leading to device probe failures if a link speed was not previously reported and saved (me)" * tag 'ata-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata: Fix sata_down_spd_limit() when no link speed is reported commit 707344c8a188bb1d6704d3546229fc7a07c01a63 Author: Lad Prabhakar Date: Mon Jan 30 23:43:35 2023 +0000 dt-bindings: interrupt-controller: arm,gic-v3: Fix typo in description of msi-controller property Fix typo functionnality -> functionality. Signed-off-by: Lad Prabhakar Link: https://lore.kernel.org/r/20230130234335.13952-1-prabhakar.csengg@gmail.com Signed-off-by: Rob Herring commit 08f379d98731a7014ee6987508d1228cb56ce694 Author: Andy Shevchenko Date: Fri Jan 27 17:02:25 2023 +0200 dt-bindings: Fix .gitignore The tracked files should not be ignored. Fixes: 44ec8b20d1e9 ("dt-bindings: Add running yamllint to dt_binding_check") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230127150225.18148-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rob Herring commit f6933c01e42d2fc83b9133ed755609e4aac6eadd Author: Mark Brown Date: Sat Jan 28 17:47:50 2023 +0000 of/address: Return an error when no valid dma-ranges are found Commit 7a8b64d17e35 ("of/address: use range parser for of_dma_get_range") converted the parsing of dma-range properties to use code shared with the PCI range parser. The intent was to introduce no functional changes however in the case where we fail to translate the first resource instead of returning -EINVAL the new code we return 0. Restore the previous behaviour by returning an error if we find no valid ranges, the original code only handled the first range but subsequently support for parsing all supplied ranges was added. This avoids confusing code using the parsed ranges which doesn't expect to successfully parse ranges but have only a list terminator returned, this fixes breakage with so far as I can tell all DMA for on SoC devices on the Socionext Synquacer platform which has a firmware supplied DT. A bisect identified the original conversion as triggering the issues there. Fixes: 7a8b64d17e35 ("of/address: use range parser for of_dma_get_range") Signed-off-by: Mark Brown Cc: Luca Di Stefano Cc: 993612@bugs.debian.org Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230126-synquacer-boot-v2-1-cb80fd23c4e2@kernel.org Signed-off-by: Rob Herring commit 241d2fb56a18473af5f2ff0d512992a996eb64dd Author: Michal Suchanek Date: Wed Feb 1 10:22:47 2023 -0600 of: Make OF framebuffer device names unique Since Linux 5.19 this error is observed: sysfs: cannot create duplicate filename '/devices/platform/of-display' This is because multiple devices with the same name 'of-display' are created on the same bus. Update the code to create numbered device names for the displays. Also, fix a node refcounting issue when exiting the boot display loop. cc: linuxppc-dev@lists.ozlabs.org References: https://bugzilla.kernel.org/show_bug.cgi?id=216095 Fixes: 52b1b46c39ae ("of: Create platform devices for OF framebuffers") Reported-by: Erhard F. Suggested-by: Thomas Zimmermann Signed-off-by: Michal Suchanek Link: https://lore.kernel.org/r/20230201162247.3575506-1-robh@kernel.org [robh: Rework to avoid node refcount leaks] Signed-off-by: Rob Herring commit edb9b8f380c3413bf783475279b1a941c7e5cec1 Merge: e7368fd30165c 9983a2c986534 Author: Linus Torvalds Date: Thu Feb 2 14:03:31 2023 -0800 Merge tag 'net-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, can and netfilter. Current release - regressions: - phy: fix null-deref in phy_attach_direct - mac802154: fix possible double free upon parsing error Previous releases - regressions: - bpf: preserve reg parent/live fields when copying range info, prevent mis-verification of programs as safe - ip6: fix GRE tunnels not generating IPv6 link local addresses - phy: dp83822: fix null-deref on DP83825/DP83826 devices - sctp: do not check hb_timer.expires when resetting hb_timer - eth: mtk_sock: fix SGMII configuration after phylink conversion Previous releases - always broken: - eth: xdp: execute xdp_do_flush() before napi_complete_done() - skb: do not mix page pool and page referenced frags in GRO - bpf: - fix a possible task gone issue with bpf_send_signal[_thread]() - fix an off-by-one bug in bpf_mem_cache_idx() to select the right cache - add missing btf_put to register_btf_id_dtor_kfuncs - sockmap: fon't let sock_map_{close,destroy,unhash} call itself - gso: fix null-deref in skb_segment_list() - mctp: purge receive queues on sk destruction - fix UaF caused by accept on already connected socket in exotic socket families - tls: don't treat list head as an entry in tls_is_tx_ready() - netfilter: br_netfilter: disable sabotage_in hook after first suppression - wwan: t7xx: fix runtime PM implementation Misc: - MAINTAINERS: spring cleanup of networking maintainers" * tag 'net-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (65 commits) mtk_sgmii: enable PCS polling to allow SFP work net: mediatek: sgmii: fix duplex configuration net: mediatek: sgmii: ensure the SGMII PHY is powered down on configuration MAINTAINERS: update SCTP maintainers MAINTAINERS: ipv6: retire Hideaki Yoshifuji mailmap: add John Crispin's entry MAINTAINERS: bonding: move Veaceslav Falico to CREDITS net: openvswitch: fix flow memory leak in ovs_flow_cmd_new net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC virtio-net: Keep stop() to follow mirror sequence of open() selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq can: isotp: split tx timer into transmission and timeout can: isotp: handle wait_event_interruptible() return values can: raw: fix CAN FD frame transmissions over CAN XL devices can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() ... commit 3e46d910d8acf94e5360126593b68bf4fee4c4a1 Author: Shiju Jose Date: Thu Feb 2 18:23:09 2023 +0000 tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw poll() and select() on per_cpu trace_pipe and trace_pipe_raw do not work since kernel 6.1-rc6. This issue is seen after the commit 42fb0a1e84ff525ebe560e2baf9451ab69127e2b ("tracing/ring-buffer: Have polling block on watermark"). This issue is firstly detected and reported, when testing the CXL error events in the rasdaemon and also erified using the test application for poll() and select(). This issue occurs for the per_cpu case, when calling the ring_buffer_poll_wait(), in kernel/trace/ring_buffer.c, with the buffer_percent > 0 and then wait until the percentage of pages are available. The default value set for the buffer_percent is 50 in the kernel/trace/trace.c. As a fix, allow userspace application could set buffer_percent as 0 through the buffer_percent_fops, so that the task will wake up as soon as data is added to any of the specific cpu buffer. Link: https://lore.kernel.org/linux-trace-kernel/20230202182309.742-2-shiju.jose@huawei.com Cc: Cc: Cc: Cc: stable@vger.kernel.org Fixes: 42fb0a1e84ff5 ("tracing/ring-buffer: Have polling block on watermark") Signed-off-by: Shiju Jose Signed-off-by: Steven Rostedt (Google) commit e7368fd30165ced757d64da48e2091c83815ce5c Merge: 42c78a5b29c47 254c71374a700 Author: Linus Torvalds Date: Thu Feb 2 13:08:18 2023 -0800 Merge tag 'linux-kselftest-kunit-fixes-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit fixes from Shuah Khan: "Three fixes to bugs that cause kernel crash, link error during build, and a third to fix kunit_test_init_section_suites() extra indirection issue" * tag 'linux-kselftest-kunit-fixes-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: fix kunit_test_init_section_suites(...) kunit: fix bug in KUNIT_EXPECT_MEMEQ kunit: Export kunit_running() commit 42c78a5b29c47ad913993bcf845bfc39e2ed8c8b Merge: addfba11b3148 5efb648042a1c Author: Linus Torvalds Date: Thu Feb 2 13:02:45 2023 -0800 Merge tag 'soc-fixes-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "The majority of bugfixes is once more for the NXP i.MX platform, addressing issue with i.MX8M (UART, watchdog and ethernet) as well as imx8dxl power button and the USB modem on an imx7 board. The reason that i.MX always shows up here is obviously not that they are more buggy than the others, but they have the most boards and are good about getting fixes in quickly. The other DT fixes are for the Nuvoton wpcm450 flash controller and the i2c mux on an ASpeed board. Lastly, there are updates to the MAINTAINERS entries for Mediatek, AMD/Seattle and NXP SoCs, as well as a lone code fix for error handling in the allwinner 'rsb' bus driver" * tag 'soc-fixes-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: dts: wpcm450: Add nuvoton,shm = <&shm> to FIU node MAINTAINERS: Update entry for MediaTek SoC support MAINTAINERS: amd: drop inactive Brijesh Singh ARM: dts: imx7d-smegw01: Fix USB host over-current polarity arm64: dts: imx8mm-verdin: Do not power down eth-phy MAINTAINERS: match freescale ARM64 DT directory in i.MX entry arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX ARM: dts: aspeed: Fix pca9849 compatible arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm: Reinstate GPIO watchdog always-running property on eDM SBC bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() commit addfba11b314824e3b4fb70448b339dcb21be5bf Merge: 870bb7656ab24 7ab41c2c08a32 Author: Linus Torvalds Date: Thu Feb 2 12:52:47 2023 -0800 Merge tag 's390-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - With CONFIG_VMAP_STACK enabled it is not possible to load the s390 specific diag288_wdt watchdog module. The reason is that a pointer to a string is passed to an inline assembly; this string however is located on the stack, while the instruction within the inline assembly expects a physicial address. Fix this by copying the string to a kmalloc'ed buffer. - The diag288_wdt watchdog module does not indicate that it accesses memory from an inline assembly, which it does. Add "memory" to the clobber list to prevent the compiler from optimizing code incorrectly away. - Pass size of the uncompressed kernel image to __decompress() call. Otherwise the kernel image decompressor may corrupt/overwrite an initrd. This was reported to happen on s390 after commit 2aa14b1ab2c4 ("zstd: import usptream v1.5.2"). * tag 's390-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/decompressor: specify __decompress() buf len to avoid overflow watchdog: diag288_wdt: fix __diag288() inline assembly watchdog: diag288_wdt: do not use stack buffers for hardware data commit 870bb7656ab247c000e9627e0da0db7ef8e9cf0c Merge: 9f266ccaa2f52 eecf2acd4a580 Author: Linus Torvalds Date: Thu Feb 2 12:47:08 2023 -0800 Merge tag 'platform-drivers-x86-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "A set of AMD PMF fixes + a few other small fixes" * tag 'platform-drivers-x86-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255 platform/x86/amd: pmc: add CONFIG_SERIO dependency platform/x86/amd/pmf: Ensure mutexes are initialized before use platform/x86/amd/pmf: Fix to update SPS thermals when power supply change platform/x86/amd/pmf: Fix to update SPS default pprof thermals platform/x86/amd/pmf: update to auto-mode limits only after AMT event platform/x86/amd/pmf: Add helper routine to check pprof is balanced platform/x86/amd/pmf: Add helper routine to update SPS thermals commit 9983a2c986534db004b50d95b7fe64bb9b925dca Merge: b0de13d3070bb 3337a6e04ddf2 Author: Jakub Kicinski Date: Thu Feb 2 11:55:55 2023 -0800 Merge branch 'fixes-for-mtk_eth_soc' Bjørn Mork says: ==================== Fix mtk_eth_soc sgmii configuration. This has been tested on a MT7986 with a Maxlinear GPY211C phy permanently attached to the second SoC mac. ==================== Link: https://lore.kernel.org/r/20230201182331.943411-1-bjorn@mork.no Signed-off-by: Jakub Kicinski commit 3337a6e04ddf2923a1bdcf3d31b3b52412bf82dd Author: Alexander Couzens Date: Wed Feb 1 19:23:31 2023 +0100 mtk_sgmii: enable PCS polling to allow SFP work Currently there is no IRQ handling (even the SGMII supports it). Enable polling to support SFP ports. Fixes: 14a44ab0330d ("net: mtk_eth_soc: partially convert to phylink_pcs") Reviewed-by: Russell King (Oracle) Signed-off-by: Alexander Couzens [ bmork: changed "1" => "true" ] Signed-off-by: Bjørn Mork Acked-by: Daniel Golle Tested-by: Daniel Golle Signed-off-by: Jakub Kicinski commit 9d32637122de88f1ef614c29703f0e050cad342e Author: Bjørn Mork Date: Wed Feb 1 19:23:30 2023 +0100 net: mediatek: sgmii: fix duplex configuration The logic of the duplex bit is inverted. Setting it means half duplex, not full duplex. Fix and rename macro to avoid confusion. Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII") Reviewed-by: Russell King (Oracle) Signed-off-by: Bjørn Mork Acked-by: Daniel Golle Tested-by: Daniel Golle Signed-off-by: Jakub Kicinski commit 7ff82416de8295c61423ef6fd75f052d3837d2f7 Author: Alexander Couzens Date: Wed Feb 1 19:23:29 2023 +0100 net: mediatek: sgmii: ensure the SGMII PHY is powered down on configuration The code expect the PHY to be in power down which is only true after reset. Allow changes of the SGMII parameters more than once. Only power down when reconfiguring to avoid bouncing the link when there's no reason to - based on code from Russell King. There are cases when the SGMII_PHYA_PWD register contains 0x9 which prevents SGMII from working. The SGMII still shows link but no traffic can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was taken from a good working state of the SGMII interface. Fixes: 42c03844e93d ("net-next: mediatek: add support for MediaTek MT7622 SoC") Suggested-by: Russell King (Oracle) Signed-off-by: Alexander Couzens [ bmork: rebased and squashed into one patch ] Reviewed-by: Russell King (Oracle) Signed-off-by: Bjørn Mork Acked-by: Daniel Golle Tested-by: Daniel Golle Signed-off-by: Jakub Kicinski commit b0de13d3070bb1daab6e0d9410309fa5fa9d6295 Merge: 4b6e135e6bee0 1613fff7a32e1 Author: Jakub Kicinski Date: Thu Feb 2 11:51:24 2023 -0800 Merge tag 'linux-can-fixes-for-6.2-20230202' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== can 2023-02-02 The first patch is by Ziyang Xuan and removes a errant WARN_ON_ONCE() in the CAN J1939 protocol. The next 3 patches are by Oliver Hartkopp. The first 2 target the CAN ISO-TP protocol and fix the state machine with respect to signals and a regression found by the syzbot. The last patch is by me an missing assignment during the ethtool ring configuration callback. * tag 'linux-can-fixes-for-6.2-20230202' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq can: isotp: split tx timer into transmission and timeout can: isotp: handle wait_event_interruptible() return values can: raw: fix CAN FD frame transmissions over CAN XL devices can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ==================== Link: https://lore.kernel.org/r/20230202094135.2293939-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 4b6e135e6bee02e29d27911ba0b9a045c9e489e8 Merge: 0c598aed445eb cd101f40a419f Author: Jakub Kicinski Date: Thu Feb 2 11:35:35 2023 -0800 Merge branch 'maintainers-spring-refresh-of-networking-maintainers' Jakub Kicinski says: ==================== MAINTAINERS: spring refresh of networking maintainers Use Jon Corbet's script for generating statistics about maintainer coverage to identify inactive maintainers of relatively active code. Move them to CREDITS. ==================== Link: https://lore.kernel.org/r/20230201182014.2362044-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cd101f40a419f72d54b517bc51ca710bc5b07d55 Author: Jakub Kicinski Date: Wed Feb 1 10:20:14 2023 -0800 MAINTAINERS: update SCTP maintainers Vlad has stepped away from SCTP related duties. Move him to CREDITS and add Xin Long. Subsystem SCTP PROTOCOL Changes 237 / 629 (37%) Last activity: 2022-12-12 Vlad Yasevich : Neil Horman : Author 20a785aa52c8 2020-05-19 00:00:00 4 Tags 20a785aa52c8 2020-05-19 00:00:00 84 Marcelo Ricardo Leitner : Author 557fb5862c92 2021-07-28 00:00:00 41 Tags da05cecc4939 2022-12-12 00:00:00 197 Top reviewers: [15]: lucien.xin@gmail.com INACTIVE MAINTAINER Vlad Yasevich Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit c71a70c267eb40455489c0df10ca986e3969b007 Author: Jakub Kicinski Date: Wed Feb 1 10:20:13 2023 -0800 MAINTAINERS: ipv6: retire Hideaki Yoshifuji We very rarely hear from Hideaki Yoshifuji and the IPv4/IPv6 entry covers a lot of code. Asking people to CC someone who rarely responds feels wrong. Note that Hideaki Yoshifuji already has an entry in CREDITS for IPv6 so not adding another one. Cc: Hideaki YOSHIFUJI Signed-off-by: Jakub Kicinski commit a35965625649b5b65153d51aed466c4b3008ce2e Author: Jakub Kicinski Date: Wed Feb 1 10:20:12 2023 -0800 mailmap: add John Crispin's entry John has not been CCed on some of the fixes which perhaps resulted in the lack of review tags: Subsystem MEDIATEK ETHERNET DRIVER Changes 50 / 295 (16%) Last activity: 2023-01-17 Felix Fietkau : Author 8bd8dcc5e47f 2022-11-18 00:00:00 33 Tags 8bd8dcc5e47f 2022-11-18 00:00:00 38 John Crispin : Sean Wang : Author 880c2d4b2fdf 2019-06-03 00:00:00 7 Tags a5d75538295b 2020-04-07 00:00:00 10 Mark Lee : Author 8d66a8183d0c 2019-11-14 00:00:00 4 Tags 8d66a8183d0c 2019-11-14 00:00:00 4 Lorenzo Bianconi : Author 08a764a7c51b 2023-01-17 00:00:00 68 Tags 08a764a7c51b 2023-01-17 00:00:00 74 Top reviewers: [12]: leonro@nvidia.com [6]: f.fainelli@gmail.com [6]: andrew@lunn.ch INACTIVE MAINTAINER John Crispin map his old address to the up to date one. Acked-by: John Crispin Signed-off-by: Jakub Kicinski commit 57b24f8c30a0bdbe851f4a181d9c9c29f077e0a2 Author: Jakub Kicinski Date: Wed Feb 1 10:20:11 2023 -0800 MAINTAINERS: bonding: move Veaceslav Falico to CREDITS Veaceslav has stepped away from netdev: Subsystem BONDING DRIVER Changes 96 / 319 (30%) Last activity: 2022-12-01 Jay Vosburgh : Author 4f5d33f4f798 2022-08-11 00:00:00 3 Tags e5214f363dab 2022-12-01 00:00:00 48 Veaceslav Falico : Andy Gospodarek : Tags 47f706262f1d 2019-02-24 00:00:00 4 Top reviewers: [42]: jay.vosburgh@canonical.com [18]: jiri@nvidia.com [10]: jtoppins@redhat.com INACTIVE MAINTAINER Veaceslav Falico Signed-off-by: Jakub Kicinski commit 0c598aed445eb45b0ee7ba405f7ece99ee349c30 Author: Fedor Pchelkin Date: Thu Feb 2 00:02:18 2023 +0300 net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails. BUG: memory leak unreferenced object 0xffff888116668000 (size 632): comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline] [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77 [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957 [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739 [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800 [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515 [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339 [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934 [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline] [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671 [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356 [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410 [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 To fix this the patch rearranges the goto labels to reflect the order of object allocations and adds appropriate goto statements on the error paths. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 68bb10101e6b ("openvswitch: Fix flow lookup to use unmasked key") Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Acked-by: Eelco Chaudron Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230201210218.361970-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit a1f47752fd6275b2502fb075945022d6cf264855 Author: Arınç ÜNAL Date: Sat Jan 28 12:42:32 2023 +0300 net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC According to my tests on MT7621AT and MT7623NI SoCs, hardware DSA untagging won't work on the second MAC. Therefore, disable this feature when the second MAC of the MT7621 and MT7623 SoCs is being used. Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") Link: https://lore.kernel.org/netdev/6249fc14-b38a-c770-36b4-5af6d41c21d3@arinc9.com/ Tested-by: Arınç ÜNAL Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230128094232.2451947-1-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit 63b114042d8a9c02d9939889177c36dbdb17a588 Author: Parav Pandit Date: Thu Feb 2 18:35:16 2023 +0200 virtio-net: Keep stop() to follow mirror sequence of open() Cited commit in fixes tag frees rxq xdp info while RQ NAPI is still enabled and packet processing may be ongoing. Follow the mirror sequence of open() in the stop() callback. This ensures that when rxq info is unregistered, no rx packet processing is ongoing. Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") Acked-by: Michael S. Tsirkin Reviewed-by: Jiri Pirko Signed-off-by: Parav Pandit Link: https://lore.kernel.org/r/20230202163516.12559-1-parav@nvidia.com Signed-off-by: Jakub Kicinski commit e02bbac74cdde25f71a80978f5daa1d8a0aa6fc3 Merge: 0416f3be58c6b bd97a59da6a86 Author: Jens Axboe Date: Thu Feb 2 11:02:12 2023 -0700 Merge tag 'nvme-6.2-2023-02-02' of git://git.infradead.org/nvme into block-6.2 Pul NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - fix a missing queue put in nvmet_fc_ls_create_association (Amit Engel) - clear queue pointers on tag_set initialization failure (Maurizio Lombardi) - use workqueue dedicated to authentication (Shin'ichiro Kawasaki)" * tag 'nvme-6.2-2023-02-02' of git://git.infradead.org/nvme: nvme-auth: use workqueue dedicated to authentication nvme: clear the request_queue pointers on failure in nvme_alloc_io_tag_set nvme: clear the request_queue pointers on failure in nvme_alloc_admin_tag_set nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association commit 636ab417a7aec4ee993916e688eb5c5977570836 Author: Ard Biesheuvel Date: Thu Feb 2 18:30:06 2023 +0100 efi: Accept version 2 of memory attributes table UEFI v2.10 introduces version 2 of the memory attributes table, which turns the reserved field into a flags field, but is compatible with version 1 in all other respects. So let's not complain about version 2 if we encounter it. Cc: Signed-off-by: Ard Biesheuvel commit 2e7c6652f9b86c01cbd4e988057a746a3a461969 Author: V sujith kumar Reddy Date: Fri Feb 3 18:02:52 2023 +0530 ASoC: SOF: amd: Fix for handling spurious interrupts from DSP As interrupts are Level-triggered,unless and until we deassert the register the interrupts are generated which causes spurious interrupts unhandled. Now we deasserted the interrupt at top half which solved the below "nobody cared" warning. warning reported in dmesg: irq 80: nobody cared (try booting with the "irqpoll" option) CPU: 5 PID: 2735 Comm: irq/80-AudioDSP Not tainted 5.15.86-15817-g4c19f3e06d49 #1 1bd3fd932cf58caacc95b0504d6ea1e3eab22289 Hardware name: Google Skyrim/Skyrim, BIOS Google_Skyrim.15303.0.0 01/03/2023 Call Trace: dump_stack_lvl+0x69/0x97 __report_bad_irq+0x3a/0xae note_interrupt+0x1a9/0x1e3 handle_irq_event_percpu+0x4b/0x6e handle_irq_event+0x36/0x5b handle_fasteoi_irq+0xae/0x171 __common_interrupt+0x48/0xc4 handlers: acp_irq_handler [snd_sof_amd_acp] threaded [<000000007e089f34>] acp_irq_thread [snd_sof_amd_acp] Disabling IRQ #80 Signed-off-by: V sujith kumar Reddy Link: https://lore.kernel.org/r/20230203123254.1898794-1-Vsujithkumar.Reddy@amd.com Signed-off-by: Mark Brown commit a68e564adcaa69b0930809fb64d9d5f7d9c32ba9 Author: Xiubo Li Date: Wed Feb 1 09:36:45 2023 +0800 ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents. This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself. The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster. Link: https://tracker.ceph.com/issues/57686 Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Signed-off-by: Ilya Dryomov commit b38b17b6a01ca4e738af097a1529910646ef4270 Author: Xiubo Li Date: Wed Feb 1 09:36:44 2023 +0800 ceph: move mount state enum to super.h These flags are only used in ceph filesystem in fs/ceph, so just move it to the place it should be. Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Signed-off-by: Ilya Dryomov commit 329c9cd769c2e306957df031efff656c40922c76 Author: Andrei Gherzan Date: Wed Feb 1 00:16:16 2023 +0000 selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking The test tool can check that the zerocopy number of completions value is valid taking into consideration the number of datagram send calls. This can catch the system into a state where the datagrams are still in the system (for example in a qdisk, waiting for the network interface to return a completion notification, etc). This change adds a retry logic of computing the number of completions up to a configurable (via CLI) timeout (default: 2 seconds). Fixes: 79ebc3c26010 ("net/udpgso_bench_tx: options to exercise TX CMSG") Signed-off-by: Andrei Gherzan Cc: Willem de Bruijn Cc: Paolo Abeni Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230201001612.515730-4-andrei.gherzan@canonical.com Signed-off-by: Paolo Abeni commit dafe93b9ee21028d625dce347118b82659652eff Author: Andrei Gherzan Date: Wed Feb 1 00:16:14 2023 +0000 selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs "udpgro_bench.sh" invokes udpgso_bench_rx/udpgso_bench_tx programs subsequently and while doing so, there is a chance that the rx one is not ready to accept socket connections. This racing bug could fail the test with at least one of the following: ./udpgso_bench_tx: connect: Connection refused ./udpgso_bench_tx: sendmsg: Connection refused ./udpgso_bench_tx: write: Connection refused This change addresses this by making udpgro_bench.sh wait for the rx program to be ready before firing off the tx one - up to a 10s timeout. Fixes: 3a687bef148d ("selftests: udp gso benchmark") Signed-off-by: Andrei Gherzan Cc: Paolo Abeni Cc: Willem de Bruijn Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230201001612.515730-3-andrei.gherzan@canonical.com Signed-off-by: Paolo Abeni commit db9b47ee9f5f375ab0c5daeb20321c75b4fa657d Author: Andrei Gherzan Date: Wed Feb 1 00:16:12 2023 +0000 selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided Leaving unrecognized arguments buried in the output, can easily hide a CLI/script typo. Avoid this by exiting when wrong arguments are provided to the udpgso_bench test programs. Fixes: 3a687bef148d ("selftests: udp gso benchmark") Signed-off-by: Andrei Gherzan Cc: Willem de Bruijn Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230201001612.515730-2-andrei.gherzan@canonical.com Signed-off-by: Paolo Abeni commit c03c80e3a03ffb4f790901d60797e9810539d946 Author: Andrei Gherzan Date: Wed Feb 1 00:16:10 2023 +0000 selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning This change fixes the following compiler warning: /usr/include/x86_64-linux-gnu/bits/error.h:40:5: warning: ‘gso_size’ may be used uninitialized [-Wmaybe-uninitialized] 40 | __error_noreturn (__status, __errnum, __format, __va_arg_pack ()); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ udpgso_bench_rx.c: In function ‘main’: udpgso_bench_rx.c:253:23: note: ‘gso_size’ was declared here 253 | int ret, len, gso_size, budget = 256; Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") Signed-off-by: Andrei Gherzan Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230201001612.515730-1-andrei.gherzan@canonical.com Signed-off-by: Paolo Abeni commit 69f2c9346313ba3d3dfa4091ff99df26c67c9021 Author: Damien Le Moal Date: Mon Jan 30 12:27:41 2023 +0900 ata: libata: Fix sata_down_spd_limit() when no link speed is reported Commit 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if driver has not recorded sstatus speed") changed the behavior of sata_down_spd_limit() to return doing nothing if a drive does not report a current link speed, to avoid reducing the link speed to the lowest 1.5 Gbps speed. However, the change assumed that a speed was recorded before probing (e.g. before a suspend/resume) and set in link->sata_spd. This causes problems with adapters/drives combination failing to establish a link speed during probe autonegotiation. One example reported of this problem is an mvebu adapter with a 3Gbps port-multiplier box: autonegotiation fails, leaving no recorded link speed and no reported current link speed. Probe retries also fail as no action is taken by sata_set_spd() after each retry. Fix this by returning early in sata_down_spd_limit() only if we do have a recorded link speed, that is, if link->sata_spd is not 0. With this fix, a failed probe not leading to a recorded link speed is retried at the lower 1.5 Gbps speed, with the link speed potentially increased later on the second revalidate of the device if the device reports that it supports higher link speeds. Reported-by: Marius Dinu Fixes: 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if driver has not recorded sstatus speed") Reviewed-by: Niklas Cassel Tested-by: Marius Dinu Signed-off-by: Damien Le Moal commit eecf2acd4a580e9364e5087daf0effca60a240b7 Author: Hans de Goede Date: Thu Feb 2 11:34:13 2023 +0100 platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match Add a DMI match for the CWI501 version of the Chuwi Vi8 tablet, pointing to the same chuwi_vi8_data as the existing CWI506 version DMI match. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230202103413.331459-1-hdegoede@redhat.com commit e33416fca8a2313b8650bd5807aaf34354d39a4c Author: Michael Ellerman Date: Thu Feb 2 21:27:35 2023 +1100 powerpc: Don't select ARCH_WANTS_NO_INSTR Commit 41b7a347bf14 ("powerpc: Book3S 64-bit outline-only KASAN support") added a select of ARCH_WANTS_NO_INSTR, because it also added some uses of noinstr. However noinstr is always defined, regardless of ARCH_WANTS_NO_INSTR, so there's no need to select it just for that. As PeterZ says [1]: Note that by selecting ARCH_WANTS_NO_INSTR you effectively state to abide by its rules. As of now the powerpc code does not abide by those rules, and trips some new warnings added by Peter in linux-next. So until the code can be fixed to avoid those warnings, disable ARCH_WANTS_NO_INSTR. Note that ARCH_WANTS_NO_INSTR is also used to gate building KCOV and parts of KCSAN. However none of the noinstr annotations in powerpc were added for KCOV or KCSAN, instead instrumentation is blocked at the file level using KCOV_INSTRUMENT_foo.o := n. [1]: https://lore.kernel.org/linuxppc-dev/Y9t6yoafrO5YqVgM@hirez.programming.kicks-ass.net Reported-by: Sachin Sant Suggested-by: Peter Zijlstra Signed-off-by: Michael Ellerman commit f82060da749c611ed427523b6d1605d87338aac1 Author: Heikki Krogerus Date: Tue Jan 31 16:15:18 2023 +0200 usb: typec: ucsi: Don't attempt to resume the ports before they exist This will fix null pointer dereference that was caused by the driver attempting to resume ports that were not yet registered. Fixes: e0dced9c7d47 ("usb: typec: ucsi: Resume in separate work") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=216697 Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230131141518.78215-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1613fff7a32e1d9e2ac09db73feba0e71a188445 Author: Marc Kleine-Budde Date: Mon Jan 23 09:03:42 2023 +0100 can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq If the a new ring layout is set, the max coalesced frames for RX and TX are re-calculated, too. Add the missing assignment of the newly calculated TX max coalesced frames. Fixes: 656fc12ddaf8 ("can: mcp251xfd: add TX IRQ coalescing ethtool support") Link: https://lore.kernel.org/all/20230130154334.1578518-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 4f027cba8216f42a18b544842efab134f8b1f9f4 Author: Oliver Hartkopp Date: Wed Jan 4 15:57:01 2023 +0100 can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the two above functionalities with separate timer callbacks. The two simplified timers now run in one-shot mode and make the state transitions (especially with isotp_rcv_echo) better understandable. Fixes: 866337865f37 ("can: isotp: fix tx state handling for echo tx processing") Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # >= v6.0 Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230104145701.2422-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 823b2e42720f96f277940c37ea438b7c5ead51a4 Author: Oliver Hartkopp Date: Thu Jan 12 20:23:47 2023 +0100 can: isotp: handle wait_event_interruptible() return values When wait_event_interruptible() has been interrupted by a signal the tx.state value might not be ISOTP_IDLE. Force the state machines into idle state to inhibit the timer handlers to continue working. Fixes: 866337865f37 ("can: isotp: fix tx state handling for echo tx processing") Cc: stable@vger.kernel.org Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230112192347.1944-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 3793301cbaa4a62d83e21f685307da7671f812ab Author: Oliver Hartkopp Date: Tue Jan 31 11:56:13 2023 +0100 can: raw: fix CAN FD frame transmissions over CAN XL devices A CAN XL device is always capable to process CAN FD frames. The former check when sending CAN FD frames relied on the existence of a CAN FD device and did not check for a CAN XL device that would be correct too. With this patch the CAN FD feature is enabled automatically when CAN XL is switched on - and CAN FD cannot be switch off while CAN XL is enabled. This precondition also leads to a clean up and reduction of checks in the hot path in raw_rcv() and raw_sendmsg(). Some conditions are reordered to handle simple checks first. changes since v1: https://lore.kernel.org/all/20230131091012.50553-1-socketcan@hartkopp.net - fixed typo: devive -> device changes since v2: https://lore.kernel.org/all/20230131091824.51026-1-socketcan@hartkopp.net/ - reorder checks in if statements to handle simple checks first Fixes: 626332696d75 ("can: raw: add CAN XL support") Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230131105613.55228-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit d0553680f94c49bbe0e39eb50d033ba563b4212d Author: Ziyang Xuan Date: Mon Sep 6 17:42:00 2021 +0800 can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80 Fixes: 0c71437dd50d ("can: j1939: j1939_session_deactivate(): clarify lifetime of session object") Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan Acked-by: Oleksij Rempel Link: https://lore.kernel.org/all/20210906094200.95868-1-william.xuanziyang@huawei.com Signed-off-by: Marc Kleine-Budde commit 30d09b3131f5b1b9d54ad9b7ee171a45e21362b3 Author: Aaro Koskinen Date: Thu Feb 2 00:01:25 2023 +0200 usb: gadget: udc: do not clear gadget driver.bus Before the commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget driver.bus was unused. For whatever reason, many UDC drivers set this field explicitly to NULL in udc_start(). With the newly added gadget bus, doing this will crash the driver during the attach. The problem was first reported, fixed and tested with OMAP UDC and g_ether. Other drivers are changed based on code analysis only. Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") Cc: stable Signed-off-by: Aaro Koskinen Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230201220125.GD2415@darkstar.musicnaut.iki.fi Signed-off-by: Greg Kroah-Hartman commit 99f1c46011cc0feb47d4f4f7bee70a0341442d14 Author: Michael Kelley Date: Mon Jan 30 19:33:06 2023 -0800 hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() netvsc_dma_map() and netvsc_dma_unmap() currently check the cp_partial flag and adjust the page_count so that pagebuf entries for the RNDIS portion of the message are skipped when it has already been copied into a send buffer. But this adjustment has already been made by code in netvsc_send(). The duplicate adjustment causes some pagebuf entries to not be mapped. In a normal VM, this doesn't break anything because the mapping doesn’t change the PFN. But in a Confidential VM, dma_map_single() does bounce buffering and provides a different PFN. Failing to do the mapping causes the wrong PFN to be passed to Hyper-V, and various errors ensue. Fix this by removing the duplicate adjustment in netvsc_dma_map() and netvsc_dma_unmap(). Fixes: 846da38de0e8 ("net: netvsc: Add Isolation VM support for netvsc driver") Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley Reviewed-by: Haiyang Zhang Link: https://lore.kernel.org/r/1675135986-254490-1-git-send-email-mikelley@microsoft.com Signed-off-by: Paolo Abeni commit 917d5e04d4dd2bbbf36fc6976ba442e284ccc42d Author: Ratheesh Kannoth Date: Tue Jan 31 11:46:59 2023 +0530 octeontx2-af: Fix devlink unregister Exact match feature is only available in CN10K-B. Unregister exact match devlink entry only for this silicon variant. Fixes: 87e4ea29b030 ("octeontx2-af: Debugsfs support for exact match.") Signed-off-by: Ratheesh Kannoth Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230131061659.1025137-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit a2df8463e15c10a8a882090f3d7a760fdb7b189d Author: Tom Rix Date: Tue Jan 31 13:54:37 2023 -0800 igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() clang static analysis reports drivers/net/ethernet/intel/igc/igc_ptp.c:673:3: warning: The left operand of '+' is a garbage value [core.UndefinedBinaryOperatorResult] ktime_add_ns(shhwtstamps.hwtstamp, adjust); ^ ~~~~~~~~~~~~~~~~~~~~ igc_ptp_systim_to_hwtstamp() silently returns without setting the hwtstamp if the mac type is unknown. This should be treated as an error. Fixes: 81b055205e8b ("igc: Add support for RX timestamping") Signed-off-by: Tom Rix Reviewed-by: Simon Horman Acked-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230131215437.1528994-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f0293cd1f4fcc4fbdcd65a5a7b3b318a6d471f78 Author: Mayuresh Chitale Date: Mon Jan 30 13:18:15 2023 +0530 riscv: mm: Implement pmdp_collapse_flush for THP When THP is enabled, 4K pages are collapsed into a single huge page using the generic pmdp_collapse_flush() which will further use flush_tlb_range() to shoot-down stale TLB entries. Unfortunately, the generic pmdp_collapse_flush() only invalidates cached leaf PTEs using address specific SFENCEs which results in repetitive (or unpredictable) page faults on RISC-V implementations which cache non-leaf PTEs. Provide a RISC-V specific pmdp_collapse_flush() which ensures both cached leaf and non-leaf PTEs are invalidated by using non-address specific SFENCEs as recommended by the RISC-V privileged specification. Fixes: e88b333142e4 ("riscv: mm: add THP support on 64-bit") Signed-off-by: Mayuresh Chitale Link: https://lore.kernel.org/r/20230130074815.1694055-1-mchitale@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 2f394c0e7d1129a35156e492bc8f445fb20f43ac Author: Andreas Schwab Date: Wed Feb 1 10:29:45 2023 +0100 riscv: disable generation of unwind tables GCC 13 will enable -fasynchronous-unwind-tables by default on riscv. In the kernel, we don't have any use for unwind tables yet, so disable them. More importantly, the .eh_frame section brings relocations (R_RISC_32_PCREL, R_RISCV_SET{6,8,16}, R_RISCV_SUB{6,8,16}) into modules that we are not prepared to handle. Signed-off-by: Andreas Schwab Link: https://lore.kernel.org/r/mvmzg9xybqu.fsf@suse.de Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 87f48c7ccc73afc78630530d9af51f458f58cab8 Author: Guo Ren Date: Tue Jan 31 23:06:04 2023 -0500 riscv: kprobe: Fixup kernel panic when probing an illegal position The kernel would panic when probed for an illegal position. eg: (CONFIG_RISCV_ISA_C=n) echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events echo 1 > events/kprobes/hello/enable cat trace Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 CPU: 0 PID: 111 Comm: sh Not tainted 6.2.0-rc1-00027-g2d398fe49a4d #490 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x38/0x48 [] show_stack+0x50/0x68 [] dump_stack_lvl+0x60/0x84 [] dump_stack+0x20/0x30 [] panic+0x160/0x374 [] generic_handle_arch_irq+0x0/0xa8 [] sys_newstat+0x0/0x30 [] sys_clone+0x20/0x30 [] ret_from_syscall+0x0/0x4 ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]--- That is because the kprobe's ebreak instruction broke the kernel's original code. The user should guarantee the correction of the probe position, but it couldn't make the kernel panic. This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an illegal position (Such as the middle of an instruction). Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") Signed-off-by: Guo Ren Signed-off-by: Guo Ren Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230201040604.3390509-1-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 9c6b9cbafdc010b38f4077c8252654381eb46028 Author: Yanguo Li Date: Tue Jan 31 09:03:13 2023 +0100 nfp: flower: avoid taking mutex in atomic context A mutex may sleep, which is not permitted in atomic context. Avoid a case where this may arise by moving the to nfp_flower_lag_get_info_from_netdev() in nfp_tun_write_neigh() spinlock. Fixes: abc210952af7 ("nfp: flower: tunnel neigh support bond offload") Reported-by: Dan Carpenter Signed-off-by: Yanguo Li Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20230131080313.2076060-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit cca6e9ff22f79e37da3d73f60c38a84d8ed0c162 Merge: 64466c407a73e 30e2291f61f93 Author: Jakub Kicinski Date: Wed Feb 1 19:52:35 2023 -0800 Merge branch 'ip-ip6_gre-fix-gre-tunnels-not-generating-ipv6-link-local-addresses' Thomas Winter says: ==================== ip/ip6_gre: Fix GRE tunnels not generating IPv6 link local addresses For our point-to-point GRE tunnels, they have IN6_ADDR_GEN_MODE_NONE when they are created then we set IN6_ADDR_GEN_MODE_EUI64 when they come up to generate the IPv6 link local address for the interface. Recently we found that they were no longer generating IPv6 addresses. Also, non-point-to-point tunnels were not generating any IPv6 link local address and instead generating an IPv6 compat address, breaking IPv6 communication on the tunnel. These failures were caused by commit e5dd729460ca and this patch set aims to resolve these issues. ==================== Link: https://lore.kernel.org/r/20230131034646.237671-1-Thomas.Winter@alliedtelesis.co.nz Signed-off-by: Jakub Kicinski commit 30e2291f61f93f7132c060190f8360df52644ec1 Author: Thomas Winter Date: Tue Jan 31 16:46:46 2023 +1300 ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address We recently found that our non-point-to-point tunnels were not generating any IPv6 link local address and instead generating an IPv6 compat address, breaking IPv6 communication on the tunnel. Previously, addrconf_gre_config always would call addrconf_addr_gen and generate a EUI64 link local address for the tunnel. Then commit e5dd729460ca changed the code path so that add_v4_addrs is called but this only generates a compat IPv6 address for non-point-to-point tunnels. I assume the compat address is specifically for SIT tunnels so have kept that only for SIT - GRE tunnels now always generate link local addresses. Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") Signed-off-by: Thomas Winter Signed-off-by: Jakub Kicinski commit 23ca0c2c93406bdb1150659e720bda1cec1fad04 Author: Thomas Winter Date: Tue Jan 31 16:46:45 2023 +1300 ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address For our point-to-point GRE tunnels, they have IN6_ADDR_GEN_MODE_NONE when they are created then we set IN6_ADDR_GEN_MODE_EUI64 when they come up to generate the IPv6 link local address for the interface. Recently we found that they were no longer generating IPv6 addresses. This issue would also have affected SIT tunnels. Commit e5dd729460ca changed the code path so that GRE tunnels generate an IPv6 address based on the tunnel source address. It also changed the code path so GRE tunnels don't call addrconf_addr_gen in addrconf_dev_config which is called by addrconf_sysctl_addr_gen_mode when the IN6_ADDR_GEN_MODE is changed. This patch aims to fix this issue by moving the code in addrconf_notify which calls the addr gen for GRE and SIT into a separate function and calling it in the places that expect the IPv6 address to be generated. The previous addrconf_dev_config is renamed to addrconf_eth_config since it only expected eth type interfaces and follows the addrconf_gre/sit_config format. A part of this changes means that the loopback address will be attempted to be configured when changing addr_gen_mode for lo. This should not be a problem because the address should exist anyway and if does already exist then no error is produced. Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") Signed-off-by: Thomas Winter Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 6fc547a5a2ef5ce05b16924106663ab92f8f87a7 Author: Alex Deucher Date: Wed Jan 25 14:35:16 2023 -0500 drm/amd/display: Properly handle additional cases where DCN is not supported There could be boards with DCN listed in IP discovery, but no display hardware actually wired up. In this case the vbios display table will not be populated. Detect this case and skip loading DM when we detect it. v2: Mark DCN as harvested as well so other display checks elsewhere in the driver are handled properly. Cc: Aurabindo Pillai Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit ac7170082c0e140663f0853d3de733a5341ce7b0 Author: Yiqing Yao Date: Tue Jan 31 16:02:47 2023 +0800 drm/amdgpu: Enable vclk dclk node for gc11.0.3 These sysfs nodes are tested supported, so enable them. Signed-off-by: Yiqing Yao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5048fa1ebf89d03cf0ceca13fab8f800399e9ee3 Author: Mario Limonciello Date: Mon Jan 30 10:16:06 2023 -0600 drm/amd: Fix initialization for nbio 4.3.0 A mistake has been made on some boards with NBIO 4.3.0 where some NBIO registers aren't properly set by the hardware. Ensure that they're set during initialization. Cc: Natikar Basavaraj Tested-by: Satyanarayana ReddyTVN Tested-by: Rutvij Gajjar Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit bb25849c0fa550b26cecc9c476c519a927c66898 Author: Evan Quan Date: Sat Jan 28 14:24:34 2023 +0800 drm/amdgpu: enable HDP SD for gfx 11.0.3 Enable HDP clock gating control for gfx 11.0.3. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 1538709c9f1c207d30afd95ea41b3aeb973f67e7 Author: Tim Huang Date: Sat Jan 21 10:35:04 2023 +0800 drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11 PMFW will handle the features disablement properly for gpu reset case, driver involvement may cause some unexpected issues. Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 154711aa5759ef9b45903124fa813c4c29ee681c Author: Nicholas Kazlauskas Date: Fri Jan 20 11:14:30 2023 -0500 drm/amd/display: Reset DMUB mailbox SW state after HW reset [Why] Otherwise we can be out of sync with what's in the hardware, leading to us rerunning every command that's presently in the ringbuffer. [How] Reset software state for the mailboxes in hw_reset callback. This is already done as part of the mailbox init in hw_init, but we do need to remember to reset the last cached wptr value as well here. Reviewed-by: Hansen Dsouza Acked-by: Alex Hung Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 275d8a1db261a1272a818d40ebc61b3b865b60e5 Author: George Shen Date: Thu Jan 19 17:09:54 2023 -0500 drm/amd/display: Unassign does_plane_fit_in_mall function from dcn3.2 [Why] The hwss function does_plane_fit_in_mall not applicable to dcn3.2 asics. Using it with dcn3.2 can result in undefined behaviour. [How] Assign the function pointer to NULL. Reviewed-by: Alvin Lee Acked-by: Alex Hung Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dd2db2dc4bd298f33dea50c80c3c11bee4e3b0a4 Author: Daniel Miess Date: Tue Jan 17 15:45:30 2023 -0500 drm/amd/display: Adjust downscaling limits for dcn314 [Why] Lower max_downscale_ratio and ARGB888 downscale factor to prevent cases where underflow may occur on dcn314 [How] Set max_downscale_ratio to 400 and ARGB downscale factor to 250 for dcn314 Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ea062fd28f922cb118bfb33229f405b81aff7781 Author: Daniel Miess Date: Tue Jan 17 15:34:35 2023 -0500 drm/amd/display: Add missing brackets in calculation [Why] Brackets missing in the calculation for MIN_DST_Y_NEXT_START [How] Add missing brackets for this calculation Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ed8e793c65e4c6633e8577e40d574da8a56d2e0f Author: Graham Sider Date: Mon Jan 16 10:43:11 2023 -0500 drm/amdgpu: update wave data type to 3 for gfx11 SQ_WAVE_INST_DW0 isn't present on gfx11 compared to gfx10, so update wave data type to signify a difference. Signed-off-by: Graham Sider Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 0416f3be58c6b1ea066cd52e354b857693feb01e Author: Ming Lei Date: Thu Feb 2 10:18:04 2023 +0800 blk-cgroup: don't update io stat for root cgroup We source root cgroup stats from the system-wide stats, see blkcg_print_stat and blkcg_rstat_flush, so don't update io state for root cgroup. Fixes blkg leak issue introduced in commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") which starts to grab blkg's reference when adding iostat_cpu into percpu blkcg list, but this state won't be consumed by blkcg_rstat_flush() where the blkg reference is dropped. Tested-by: Bart van Assche Reported-by: Bart van Assche Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") Cc: Tejun Heo Cc: Waiman Long Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230202021804.278582-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 1665c027afb225882a5a0b014c45e84290b826c2 Author: Michael Ellerman Date: Tue Jan 31 22:14:07 2023 +1100 powerpc/64s: Reconnect tlb_flush() to hash__tlb_flush() Commit baf1ed24b27d ("powerpc/mm: Remove empty hash__ functions") removed some empty hash MMU flushing routines, but got a bit overeager and also removed the call to hash__tlb_flush() from tlb_flush(). In regular use this doesn't lead to any noticable breakage, which is a little concerning. Presumably there are flushes happening via other paths such as arch_leave_lazy_mmu_mode(), and/or a bit of luck. Fix it by reinstating the call to hash__tlb_flush(). Fixes: baf1ed24b27d ("powerpc/mm: Remove empty hash__ functions") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230131111407.806770-1-mpe@ellerman.id.au commit 316f1f42b5cc1d95124c1f0387c867c1ba7b6d0e Author: Helge Deller Date: Wed Feb 1 16:41:54 2023 +0100 parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case Wire up the missing ptrace requests PTRACE_GETREGS, PTRACE_SETREGS, PTRACE_GETFPREGS and PTRACE_SETFPREGS when running 32-bit applications on 64-bit kernels. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # 4.7+ commit 3f0c17809a098d3f0c1ec83f1fb3ca61638d3dcd Author: Helge Deller Date: Wed Feb 1 11:04:06 2023 +0100 parisc: Replace hardcoded value with PRIV_USER constant in ptrace.c Prefer usage of the PRIV_USER constant over the hard-coded value to set the lowest 2 bits for the userspace privilege. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # 5.16+ commit 9f266ccaa2f5228bfe67ad58a94ca4e0109b954a Merge: ce18d3aa6a232 6b04456e24876 Author: Linus Torvalds Date: Wed Feb 1 10:31:53 2023 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Just small bugfixes all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vdpa: ifcvf: Do proper cleanup if IFCVF init fails vhost-scsi: unbreak any layout for response tools/virtio: fix the vringh test for virtio ring changes vhost/net: Clear the pending messages when the backend is removed commit ce18d3aa6a232ec80ece60ad5d6eb17bcac1744e Merge: c0b67534c95c5 c7a806d9ce675 Author: Linus Torvalds Date: Wed Feb 1 10:26:23 2023 -0800 Merge tag 'sound-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A bit higher volume of changes than wished, but each change is relatively small and the fix targets are mostly device-specific, so those should be safe as a late stage merge. The most significant LoC is about the memalloc helper fix, which is applied only to Xen PV. The other major parts are ASoC Intel SOF and AVS fixes that are scattered as various small code changes. The rest are device-specific fixes and quirks for HD- and USB-audio, FireWire and ASoC AMD / HDMI" * tag 'sound-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits) ALSA: firewire-motu: fix unreleased lock warning in hwdep device ALSA: memalloc: Workaround for Xen PV ASoC: cs42l56: fix DT probe ASoC: codecs: wsa883x: correct playback min/max rates ALSA: hda/realtek: Add Acer Predator PH315-54 ASoC: amd: yc: Add Xiaomi Redmi Book Pro 15 2022 into DMI table ALSA: hda: Do not unset preset when cleaning up codec ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on sink failure ASoC: hdmi-codec: zero clear HDMI pdata ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() ASoC: Intel: sof_ssp_amp: always set dpcm_capture for amplifiers ASoC: Intel: sof_nau8825: always set dpcm_capture for amplifiers ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless ALSA: hda/realtek: fix mute/micmute LEDs, speaker don't work for a HP platform ASoC: SOF: keep prepare/unprepare widgets in sink path ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0 ... commit 5efb648042a1c3d1734e69ebbae2fe9477f4fc4d Author: Jonathan Neuschäfer Date: Wed Feb 1 15:11:58 2023 +1030 ARM: dts: wpcm450: Add nuvoton,shm = <&shm> to FIU node The Flash Interface Unit (FIU) should have a reference to the Shared Memory controller (SHM) so that flash access from the host (x86 computer managed by the WPCM450 BMC) can be blocked during flash access by the FIU driver. Fixes: 38abcb0d68767 ("ARM: dts: wpcm450: Add FIU SPI controller node") Signed-off-by: Jonathan Neuschäfer Link: https://lore.kernel.org/r/20230129112611.1176517-1-j.neuschaefer@gmx.net Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230201044158.962417-1-joel@jms.id.au Signed-off-by: Arnd Bergmann commit b459861783a909f66120814b34fa38d409d1e6af Author: Matthias Brugger Date: Wed Feb 1 16:22:56 2023 +0100 MAINTAINERS: Update entry for MediaTek SoC support The linux-mediatek IRC channel has moved to liber.chat for quite some time. Apart from that, not all patches are also send to LKML, so add this ML explicitly. And last but not least: Angelo does a wunderfull job in reviewing patches for all kind of devices from MediaTek. Cc: AngeloGioacchino Del Regno Signed-off-by: Matthias Brugger Link: https://lore.kernel.org/r/20230201152256.19514-1-matthias.bgg@kernel.org Signed-off-by: Arnd Bergmann commit bd97a59da6a866e3dee5d2a2d582ec71dbbc84cd Author: Shin'ichiro Kawasaki Date: Tue Jan 31 18:26:44 2023 +0900 nvme-auth: use workqueue dedicated to authentication NVMe In-Band authentication uses two kinds of works: chap->auth_work and ctrl->dhchap_auth_work. The latter work flushes or cancels the former work. However, the both works are queued to the same workqueue nvme-wq. It results in the lockdep WARNING as follows: WARNING: possible recursive locking detected 6.2.0-rc4+ #1 Not tainted -------------------------------------------- kworker/u16:7/69 is trying to acquire lock: ffff902d52e65548 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: start_flush_work+0x2c5/0x380 but task is already holding lock: ffff902d52e65548 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: process_one_work+0x210/0x410 To avoid the WARNING, introduce a new workqueue nvme-auth-wq dedicated to chap->auth_work. Reported-by: Daniel Wagner Link: https://lore.kernel.org/linux-nvme/20230130110802.paafkiipmitwtnwr@carbon.lan/ Fixes: f50fff73d620 ("nvme: implement In-Band authentication") Signed-off-by: Shin'ichiro Kawasaki Tested-by: Daniel Wagner Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit bd401fd730cbcb0717bbc5438f15084db10f9259 Author: Guillaume Pinot Date: Sun Jan 29 18:13:38 2023 +0100 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 Samsung Galaxy Book2 Pro 360 (13" 2022 NP930QED-KA1FR) with codec SSID 144d:ca03 requires the same workaround for enabling the speaker amp like other Samsung models with ALC298 codec. Cc: Signed-off-by: Guillaume Pinot Link: https://lore.kernel.org/r/20230129171338.17249-1-texitoi@texitoi.eu Signed-off-by: Takashi Iwai commit 6fbf13c0e24fd86ab2e4477cd8484a485b687421 Author: Maurizio Lombardi Date: Tue Jan 31 17:38:42 2023 +0100 nvme: clear the request_queue pointers on failure in nvme_alloc_io_tag_set In nvme_alloc_io_tag_set(), the connect_q pointer should be set to NULL in case of error to avoid potential invalid pointer dereferences. Signed-off-by: Maurizio Lombardi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit fd62678ab55cb01e11a404d302cdade222bf4022 Author: Maurizio Lombardi Date: Fri Jan 27 16:42:37 2023 +0100 nvme: clear the request_queue pointers on failure in nvme_alloc_admin_tag_set If nvme_alloc_admin_tag_set() fails, the admin_q and fabrics_q pointers are left with an invalid, non-NULL value. Other functions may then check the pointers and dereference them, e.g. in nvme_probe() -> out_disable: -> nvme_dev_remove_admin(). Fix the bug by setting admin_q and fabrics_q to NULL in case of error. Also use the set variable to free the tag_set as ctrl->admin_tagset isn't initialized yet. Signed-off-by: Maurizio Lombardi Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 0cab4404874f2de52617de8400c844891c6ea1ce Author: Amit Engel Date: Mon Jan 23 14:37:28 2023 +0200 nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association As part of nvmet_fc_ls_create_association there is a case where nvmet_fc_alloc_target_queue fails right after a new association with an admin queue is created. In this case, no one releases the get taken in nvmet_fc_alloc_target_assoc. This fix is adding the missing put. Signed-off-by: Amit Engel Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit 5dac9f8dc25fefd9d928b98f6477ff3daefd73e3 Author: Dan Carpenter Date: Tue Jan 31 13:02:13 2023 +0300 ALSA: pci: lx6464es: fix a debug loop This loop accidentally reuses the "i" iterator for both the inside and the outside loop. The value of MAX_STREAM_BUFFER is 5. I believe that chip->rmh.stat_len is in the 2-12 range. If the value of .stat_len is 4 or more then it will loop exactly one time, but if it's less then it is a forever loop. It looks like it was supposed to combined into one loop where conditions are checked. Fixes: 8e6320064c33 ("ALSA: lx_core: Remove useless #if 0 .. #endif") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Y9jnJTis/mRFJAQp@kili Signed-off-by: Takashi Iwai commit a3ee9e0b57f8ecca02d1c16fad4941e09bfe2941 Author: Stephen Boyd Date: Thu Jan 5 19:01:08 2023 -0800 drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable The unprepare sequence has started to fail after moving to panel bridge code in the msm drm driver (commit 007ac0262b0d ("drm/msm/dsi: switch to DRM_PANEL_BRIDGE")). You'll see messages like this in the kernel logs: panel-boe-tv101wum-nl6 ae94000.dsi.0: failed to set panel off: -22 This is because boe_panel_enter_sleep_mode() needs an operating DSI link to set the panel into sleep mode. Performing those writes in the unprepare phase of bridge ops is too late, because the link has already been torn down by the DSI controller in post_disable, i.e. the PHY has been disabled, etc. See dsi_mgr_bridge_post_disable() for more details on the DSI . Split the unprepare function into a disable part and an unprepare part. For now, just the DSI writes to enter sleep mode are put in the disable function. This fixes the panel off routine and keeps the panel happy. My Wormdingler has an integrated touchscreen that stops responding to touch if the panel is only half disabled too. This patch fixes it. And finally, this saves power when the screen is off because without this fix the regulators for the panel are left enabled when nothing is being displayed on the screen. Fixes: 007ac0262b0d ("drm/msm/dsi: switch to DRM_PANEL_BRIDGE") Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel") Cc: yangcong Cc: Douglas Anderson Cc: Jitao Shi Cc: Sam Ravnborg Cc: Rob Clark Cc: Dmitry Baryshkov Signed-off-by: Stephen Boyd Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20230106030108.2542081-1-swboyd@chromium.org (cherry picked from commit c913cd5489930abbb557ef144a333846286754c3) Signed-off-by: Thomas Zimmermann commit 3c349eacc55996a57aaca5e3754edb6b83980237 Merge: c1d6105869464 0b1d60d6dd9e2 Author: Palmer Dabbelt Date: Tue Jan 31 21:55:43 2023 -0800 Merge patch "riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y" This is a single fix, but it conflicts with some recent features. I'm merging it on top of the commit it fixes to ease backporting. * b4-shazam-merge: riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y Link: https://lore.kernel.org/r/20220922060958.44203-1-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit 0b1d60d6dd9e2e867cc6e4277d73ea5a7ff2d4d0 Author: Samuel Holland Date: Thu Sep 22 01:09:58 2022 -0500 riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y commit 8eb060e10185 ("arch/riscv: add Zihintpause support") broke building with CONFIG_CC_OPTIMIZE_FOR_SIZE enabled (gcc 11.1.0): CC arch/riscv/kernel/vdso/vgettimeofday.o In file included from : ./arch/riscv/include/asm/jump_label.h: In function 'cpu_relax': ././include/linux/compiler_types.h:285:33: warning: 'asm' operand 0 probably does not match constraints 285 | #define asm_volatile_goto(x...) asm goto(x) | ^~~ ./arch/riscv/include/asm/jump_label.h:41:9: note: in expansion of macro 'asm_volatile_goto' 41 | asm_volatile_goto( | ^~~~~~~~~~~~~~~~~ ././include/linux/compiler_types.h:285:33: error: impossible constraint in 'asm' 285 | #define asm_volatile_goto(x...) asm goto(x) | ^~~ ./arch/riscv/include/asm/jump_label.h:41:9: note: in expansion of macro 'asm_volatile_goto' 41 | asm_volatile_goto( | ^~~~~~~~~~~~~~~~~ make[1]: *** [scripts/Makefile.build:249: arch/riscv/kernel/vdso/vgettimeofday.o] Error 1 make: *** [arch/riscv/Makefile:128: vdso_prepare] Error 2 Having a static branch in cpu_relax() is problematic because that function is widely inlined, including in some quite complex functions like in the VDSO. A quick measurement shows this static branch is responsible by itself for around 40% of the jump table. Drop the static branch, which ends up being the same number of instructions anyway. If Zihintpause is supported, we trade the nop from the static branch for a div. If Zihintpause is unsupported, we trade the jump from the static branch for (what gets interpreted as) a nop. Fixes: 8eb060e10185 ("arch/riscv: add Zihintpause support") Signed-off-by: Samuel Holland Reviewed-by: Conor Dooley Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 64466c407a73e7c4fc49d50f4604cd22b53e50eb Merge: afc2336f89dc0 bd0e06f0def75 Author: Jakub Kicinski Date: Tue Jan 31 21:19:20 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Release bridge info once packet escapes the br_netfilter path, from Florian Westphal. 2) Revert incorrect fix for the SCTP connection tracking chunk iterator, also from Florian. First path fixes a long standing issue, the second path addresses a mistake in the previous pull request for net. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: Revert "netfilter: conntrack: fix bug in for_each_sctp_chunk" netfilter: br_netfilter: disable sabotage_in hook after first suppression ==================== Link: https://lore.kernel.org/r/20230131133158.4052-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit afc2336f89dc0fc0ef25b92366814524b0fd90fb Author: Chris Healy Date: Mon Jan 30 15:14:02 2023 -0800 net: phy: meson-gxl: Add generic dummy stubs for MMD register access The Meson G12A Internal PHY does not support standard IEEE MMD extended register access, therefore add generic dummy stubs to fail the read and write MMD calls. This is necessary to prevent the core PHY code from erroneously believing that EEE is supported by this PHY even though this PHY does not support EEE, as MMD register access returns all FFFFs. Fixes: 5c3407abb338 ("net: phy: meson-gxl: add g12a support") Reviewed-by: Heiner Kallweit Signed-off-by: Chris Healy Reviewed-by: Jerome Brunet Link: https://lore.kernel.org/r/20230130231402.471493-1-cphealy@gmail.com Signed-off-by: Jakub Kicinski commit 876e8ca8366735a604bac86ff7e2732fc9d85d2d Author: Yan Zhai Date: Mon Jan 30 12:51:48 2023 -0800 net: fix NULL pointer in skb_segment_list Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched when passing through the network stack. This assumption can be broken sometimes, where frag_list itself gets pulled into linear area, leaving frag_list being NULL. When this happens it can trigger following NULL pointer dereference, and panic the kernel. Reverse the test condition should fix it. [19185.577801][ C1] BUG: kernel NULL pointer dereference, address: ... [19185.663775][ C1] RIP: 0010:skb_segment_list+0x1cc/0x390 ... [19185.834644][ C1] Call Trace: [19185.841730][ C1] [19185.848563][ C1] __udp_gso_segment+0x33e/0x510 [19185.857370][ C1] inet_gso_segment+0x15b/0x3e0 [19185.866059][ C1] skb_mac_gso_segment+0x97/0x110 [19185.874939][ C1] __skb_gso_segment+0xb2/0x160 [19185.883646][ C1] udp_queue_rcv_skb+0xc3/0x1d0 [19185.892319][ C1] udp_unicast_rcv_skb+0x75/0x90 [19185.900979][ C1] ip_protocol_deliver_rcu+0xd2/0x200 [19185.910003][ C1] ip_local_deliver_finish+0x44/0x60 [19185.918757][ C1] __netif_receive_skb_one_core+0x8b/0xa0 [19185.927834][ C1] process_backlog+0x88/0x130 [19185.935840][ C1] __napi_poll+0x27/0x150 [19185.943447][ C1] net_rx_action+0x27e/0x5f0 [19185.951331][ C1] ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core] [19185.960848][ C1] __do_softirq+0xbc/0x25d [19185.968607][ C1] irq_exit_rcu+0x83/0xb0 [19185.976247][ C1] common_interrupt+0x43/0xa0 [19185.984235][ C1] asm_common_interrupt+0x22/0x40 ... [19186.094106][ C1] Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") Suggested-by: Daniel Borkmann Reviewed-by: Willem de Bruijn Signed-off-by: Yan Zhai Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/Y9gt5EUizK1UImEP@debian Signed-off-by: Jakub Kicinski commit efec2e2a722ed609fc7b64feef720fd601633b73 Author: Vladimir Oltean Date: Mon Jan 30 21:30:51 2023 +0200 net: fman: memac: free mdio device if lynx_pcs_create() fails When memory allocation fails in lynx_pcs_create() and it returns NULL, there remains a dangling reference to the mdiodev returned by of_mdio_find_device() which is leaked as soon as memac_pcs_create() returns empty-handed. Fixes: a7c2a32e7f22 ("net: fman: memac: Use lynx pcs driver") Signed-off-by: Vladimir Oltean Reviewed-by: Sean Anderson Acked-by: Madalin Bucur Link: https://lore.kernel.org/r/20230130193051.563315-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8f35ae17ef565a605de5f409e04bcd49a55d7646 Author: Xin Long Date: Mon Jan 30 11:25:33 2023 -0500 sctp: do not check hb_timer.expires when resetting hb_timer It tries to avoid the frequently hb_timer refresh in commit ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often"), and it only allows mod_timer when the new expires is after hb_timer.expires. It means even a much shorter interval for hb timer gets applied, it will have to wait until the current hb timer to time out. In sctp_do_8_2_transport_strike(), when a transport enters PF state, it expects to update the hb timer to resend a heartbeat every rto after calling sctp_transport_reset_hb_timer(), which will not work as the change mentioned above. The frequently hb_timer refresh was caused by sctp_transport_reset_timers() called in sctp_outq_flush() and it was already removed in the commit above. So we don't have to check hb_timer.expires when resetting hb_timer as it is now not called very often. Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Link: https://lore.kernel.org/r/d958c06985713ec84049a2d5664879802710179a.1675095933.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit fc546faa559538fb312c77e055243ece18ab3288 Author: Sourabh Jain Date: Tue Jan 31 08:36:15 2023 +0530 powerpc/kexec_file: Count hot-pluggable memory in FDT estimate On Systems where online memory is lesser compared to max memory, the kexec_file_load system call may fail to load the kdump kernel with the below errors: "Failed to update fdt with linux,drconf-usable-memory property" "Error setting up usable-memory property for kdump kernel" This happens because the size estimation for usable memory properties for the kdump kernel's FDT is based on the online memory whereas the usable memory properties include max memory. In short, the hot-pluggable memory is not accounted for while estimating the size of the usable memory properties. The issue is addressed by calculating usable memory property size using max hotplug address instead of the last online memory address. Fixes: 2377c92e37fe ("powerpc/kexec_file: fix FDT size estimation for kdump kernel") Signed-off-by: Sourabh Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230131030615.729894-1-sourabhjain@linux.ibm.com commit ac86f547ca1002aec2ef66b9e64d03f45bbbfbb9 Author: Kefeng Wang Date: Sun Jan 29 12:09:45 2023 +0800 mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoisoned page, the folio_memcg could be NULl, then, mem_cgroup_track_foreign_dirty_slowpath() could occurs a NULL pointer dereference, let's do not record the foreign writebacks for folio memcg is null in mem_cgroup_track_foreign_dirty() to fix it. Link: https://lkml.kernel.org/r/20230129040945.180629-1-wangkefeng.wang@huawei.com Fixes: 97b27821b485 ("writeback, memcg: Implement foreign dirty flushing") Signed-off-by: Kefeng Wang Reported-by: Ma Wupeng Tested-by: Miko Larsson Acked-by: Michal Hocko Cc: Jan Kara Cc: Jens Axboe Cc: Kefeng Wang Cc: Ma Wupeng Cc: Naoya Horiguchi Cc: Shakeel Butt Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 1e90e35b620587e82cf52f3b7ccd8270d824d840 Author: ye xingchen Date: Sun Jan 29 10:13:57 2023 +0800 Kconfig.debug: fix the help description in SCHED_DEBUG The correct file path for SCHED_DEBUG is /sys/kernel/debug/sched. Link: https://lkml.kernel.org/r/202301291013573466558@zte.com.cn Signed-off-by: ye xingchen Cc: Dan Williams Cc: Geert Uytterhoeven Cc: Josh Poimboeuf Cc: Kees Cook Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Randy Dunlap Cc: Rasmus Villemoes Cc: Vlastimil Babka Cc: Zhaoyang Huang Signed-off-by: Andrew Morton commit 7717fc1a12f88701573f9ed897cc4f6699c661e3 Author: Longlong Xia Date: Sat Jan 28 09:47:57 2023 +0000 mm/swapfile: add cond_resched() in get_swap_pages() The softlockup still occurs in get_swap_pages() under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each zram device is 50MB with same priority as si. Use the stress-ng tool to increase memory pressure, causing the system to oom frequently. The plist_for_each_entry_safe() loops in get_swap_pages() could reach tens of thousands of times to find available space (extreme case: cond_resched() is not called in scan_swap_map_slots()). Let's add cond_resched() into get_swap_pages() when failed to find available space to avoid softlockup. Link: https://lkml.kernel.org/r/20230128094757.1060525-1-xialonglong1@huawei.com Signed-off-by: Longlong Xia Reviewed-by: "Huang, Ying" Cc: Chen Wandun Cc: Huang Ying Cc: Kefeng Wang Cc: Nanyong Sun Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton commit 993f57e0277b78182eb9e4955d118cc8b086c83d Author: Zhaoyang Huang Date: Thu Jan 19 09:22:25 2023 +0800 mm: use stack_depot_early_init for kmemleak Mirsad report the below error which is caused by stack_depot_init() failure in kvcalloc. Solve this by having stackdepot use stack_depot_early_init(). On 1/4/23 17:08, Mirsad Goran Todorovac wrote: I hate to bring bad news again, but there seems to be a problem with the output of /sys/kernel/debug/kmemleak: [root@pc-mtodorov ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xffff951c118568b0 (size 16): comm "kworker/u12:2", pid 56, jiffies 4294893952 (age 4356.548s) hex dump (first 16 bytes): 6d 65 6d 73 74 69 63 6b 30 00 00 00 00 00 00 00 memstick0....... backtrace: [root@pc-mtodorov ~]# Apparently, backtrace of called functions on the stack is no longer printed with the list of memory leaks. This appeared on Lenovo desktop 10TX000VCR, with AlmaLinux 8.7 and BIOS version M22KT49A (11/10/2022) and 6.2-rc1 and 6.2-rc2 builds. This worked on 6.1 with the same CONFIG_KMEMLEAK=y and MGLRU enabled on a vanilla mainstream kernel from Mr. Torvalds' tree. I don't know if this is deliberate feature for some reason or a bug. Please find attached the config, lshw and kmemleak output. [vbabka@suse.cz: remove stack_depot_init() call] Link: https://lore.kernel.org/all/5272a819-ef74-65ff-be61-4d2d567337de@alu.unizg.hr/ Link: https://lkml.kernel.org/r/1674091345-14799-2-git-send-email-zhaoyang.huang@unisoc.com Fixes: 56a61617dd22 ("mm: use stack_depot for recording kmemleak's backtrace") Reported-by: Mirsad Todorovac Suggested-by: Vlastimil Babka Signed-off-by: Zhaoyang Huang Acked-by: Mike Rapoport (IBM) Acked-by: Catalin Marinas Acked-by: Vlastimil Babka Tested-by: Borislav Petkov (AMD) Cc: ke.wang Cc: Nathan Chancellor Cc: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton commit f65c4bbbd682b0877b669828b4e033b8d5d0a2dc Author: Phillip Lougher Date: Fri Jan 27 06:18:42 2023 +0000 Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing. In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225. Flaw 1 (64-bit systems only): The signed integer xattr_ids variable causes sign extension. This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long". On a 64-bit system this is 64-bits in size, and causes the negative number to be sign extended and widened to 64-bits and then become unsigned. This produces the very large number 18446744073709548016 or 2^64 - 3600. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0 (stored in len). Flaw 2 (32-bit systems only): On a 32-bit system the integer variable is not widened by the unsigned long type of the sizeof operator (32-bits), and the signedness of the variable has no effect due it always being treated as unsigned. The above corrupted xattr_ids value of 4294967071, when multiplied overflows and produces the number 4294963696 or 2^32 - 3400. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows again and produces a length of 0. The effect of the 0 length computation: In conjunction with the corrupted xattr_ids field, the filesystem also has a corrupted xattr_table_start value, where it matches the end of filesystem value of 850. This causes the following sanity check code to fail because the incorrectly computed len of 0 matches the incorrect size of the table reported by the superblock (0 bytes). len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids); /* * The computed size of the index table (len bytes) should exactly * match the table start and end points */ start = table_start + sizeof(*id_table); end = msblk->bytes_used; if (len != (end - start)) return ERR_PTR(-EINVAL); Changing the xattr_ids variable to be "usigned int" fixes the flaw on a 64-bit system. This relies on the fact the computation is widened by the unsigned long type of the sizeof operator. Casting the variable to u64 in the above macro fixes this flaw on a 32-bit system. It also means 64-bit systems do not implicitly rely on the type of the sizeof operator to widen the computation. [1] https://lore.kernel.org/lkml/000000000000cd44f005f1a0f17f@google.com/ Link: https://lkml.kernel.org/r/20230127061842.10965-1-phillip@squashfs.org.uk Fixes: 506220d2ba21 ("squashfs: add more sanity checks in xattr id lookup") Signed-off-by: Phillip Lougher Reported-by: Cc: Alexey Khoroshilov Cc: Fedor Pchelkin Cc: Signed-off-by: Andrew Morton commit c1c551bebf928889e7a8fef7415b44f9a64975f4 Author: Tom Saeger Date: Mon Jan 23 17:09:35 2023 -0700 sh: define RUNTIME_DISCARD_EXIT sh vmlinux fails to link with GNU ld < 2.40 (likely < 2.36) since commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv"). This is similar to fixes for powerpc and s390: commit 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT"). commit a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36"). $ sh4-linux-gnu-ld --version | head -n1 GNU ld (GNU Binutils for Debian) 2.35.2 $ make ARCH=sh CROSS_COMPILE=sh4-linux-gnu- microdev_defconfig $ make ARCH=sh CROSS_COMPILE=sh4-linux-gnu- `.exit.text' referenced in section `__bug_table' of crypto/algboss.o: defined in discarded section `.exit.text' of crypto/algboss.o `.exit.text' referenced in section `__bug_table' of drivers/char/hw_random/core.o: defined in discarded section `.exit.text' of drivers/char/hw_random/core.o make[2]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 make[1]: *** [Makefile:1252: vmlinux] Error 2 arch/sh/kernel/vmlinux.lds.S keeps EXIT_TEXT: /* * .exit.text is discarded at runtime, not link time, to deal with * references from __bug_table */ .exit.text : AT(ADDR(.exit.text)) { EXIT_TEXT } However, EXIT_TEXT is thrown away by DISCARD(include/asm-generic/vmlinux.lds.h) because sh does not define RUNTIME_DISCARD_EXIT. GNU ld 2.40 does not have this issue and builds fine. This corresponds with Masahiro's comments in a494398bde27: "Nathan [Chancellor] also found that binutils commit 21401fc7bf67 ("Duplicate output sections in scripts") cured this issue, so we cannot reproduce it with binutils 2.36+, but it is better to not rely on it." Link: https://lkml.kernel.org/r/9166a8abdc0f979e50377e61780a4bba1dfa2f52.1674518464.git.tom.saeger@oracle.com Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Link: https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/ Link: https://lore.kernel.org/all/20230123194218.47ssfzhrpnv3xfez@oracle.com/ Signed-off-by: Tom Saeger Tested-by: John Paul Adrian Glaubitz Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Dennis Gilmore Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Naresh Kamboju Cc: Nathan Chancellor Cc: Palmer Dabbelt Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton commit 88d7b12068b95731c280af8ce88e8ee9561f96de Author: Matthew Wilcox (Oracle) Date: Thu Jan 26 20:07:27 2023 +0000 highmem: round down the address passed to kunmap_flush_on_unmap() We already round down the address in kunmap_local_indexed() which is the other implementation of __kunmap_local(). The only implementation of kunmap_flush_on_unmap() is PA-RISC which is expecting a page-aligned address. This may be causing PA-RISC to be flushing the wrong addresses currently. Link: https://lkml.kernel.org/r/20230126200727.1680362-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Fixes: 298fa1ad5571 ("highmem: Provide generic variant of kmap_atomic*") Reviewed-by: Ira Weiny Cc: "Fabio M. De Francesco" Cc: Al Viro Cc: Thomas Gleixner Cc: Helge Deller Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Bagas Sanjaya Cc: David Sterba Cc: Kees Cook Cc: Sebastian Andrzej Siewior Cc: Tony Luck Cc: Signed-off-by: Andrew Morton commit 73bdf65ea74857d7fb2ec3067a3cec0e261b1462 Author: Mike Kravetz Date: Thu Jan 26 14:27:21 2023 -0800 migrate: hugetlb: check for hugetlb shared PMD in node migration migrate_pages/mempolicy semantics state that CAP_SYS_NICE is required to move pages shared with another process to a different node. page_mapcount > 1 is being used to determine if a hugetlb page is shared. However, a hugetlb page will have a mapcount of 1 if mapped by multiple processes via a shared PMD. As a result, hugetlb pages shared by multiple processes and mapped with a shared PMD can be moved by a process without CAP_SYS_NICE. To fix, check for a shared PMD if mapcount is 1. If a shared PMD is found consider the page shared. Link: https://lkml.kernel.org/r/20230126222721.222195-3-mike.kravetz@oracle.com Fixes: e2d8cf405525 ("migrate: add hugepage migration code to migrate_pages()") Signed-off-by: Mike Kravetz Acked-by: Peter Xu Acked-by: David Hildenbrand Cc: James Houghton Cc: Matthew Wilcox Cc: Michal Hocko Cc: Muchun Song Cc: Naoya Horiguchi Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit 3489dbb696d25602aea8c3e669a6d43b76bd5358 Author: Mike Kravetz Date: Thu Jan 26 14:27:20 2023 -0800 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps Patch series "Fixes for hugetlb mapcount at most 1 for shared PMDs". This issue of mapcount in hugetlb pages referenced by shared PMDs was discussed in [1]. The following two patches address user visible behavior caused by this issue. [1] https://lore.kernel.org/linux-mm/Y9BF+OCdWnCSilEu@monkey/ This patch (of 2): A hugetlb page will have a mapcount of 1 if mapped by multiple processes via a shared PMD. This is because only the first process increases the map count, and subsequent processes just add the shared PMD page to their page table. page_mapcount is being used to decide if a hugetlb page is shared or private in /proc/PID/smaps. Pages referenced via a shared PMD were incorrectly being counted as private. To fix, check for a shared PMD if mapcount is 1. If a shared PMD is found count the hugetlb page as shared. A new helper to check for a shared PMD is added. [akpm@linux-foundation.org: simplification, per David] [akpm@linux-foundation.org: hugetlb.h: include page_ref.h for page_count()] Link: https://lkml.kernel.org/r/20230126222721.222195-2-mike.kravetz@oracle.com Fixes: 25ee01a2fca0 ("mm: hugetlb: proc: add hugetlb-related fields to /proc/PID/smaps") Signed-off-by: Mike Kravetz Acked-by: Peter Xu Cc: David Hildenbrand Cc: James Houghton Cc: Matthew Wilcox Cc: Michal Hocko Cc: Muchun Song Cc: Naoya Horiguchi Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit edb5d0cf5525357652aff6eacd9850b8ced07143 Author: Zach O'Keefe Date: Wed Jan 25 14:53:58 2023 -0800 mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups In commit 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") we make the following change to find_pmd_or_thp_or_none(): - if (!pmd_present(pmde)) - return SCAN_PMD_NULL; + if (pmd_none(pmde)) + return SCAN_PMD_NONE; This was for-use by MADV_COLLAPSE file/shmem codepaths, where MADV_COLLAPSE might identify a pte-mapped hugepage, only to have khugepaged race-in, free the pte table, and clear the pmd. Such codepaths include: A) If we find a suitably-aligned compound page of order HPAGE_PMD_ORDER already in the pagecache. B) In retract_page_tables(), if we fail to grab mmap_lock for the target mm/address. In these cases, collapse_pte_mapped_thp() really does expect a none (not just !present) pmd, and we want to suitably identify that case separate from the case where no pmd is found, or it's a bad-pmd (of course, many things could happen once we drop mmap_lock, and the pmd could plausibly undergo multiple transitions due to intervening fault, split, etc). Regardless, the code is prepared install a huge-pmd only when the existing pmd entry is either a genuine pte-table-mapping-pmd, or the none-pmd. However, the commit introduces a logical hole; namely, that we've allowed !none- && !huge- && !bad-pmds to be classified as genuine pte-table-mapping-pmds. One such example that could leak through are swap entries. The pmd values aren't checked again before use in pte_offset_map_lock(), which is expecting nothing less than a genuine pte-table-mapping-pmd. We want to put back the !pmd_present() check (below the pmd_none() check), but need to be careful to deal with subtleties in pmd transitions and treatments by various arch. The issue is that __split_huge_pmd_locked() temporarily clears the present bit (or otherwise marks the entry as invalid), but pmd_present() and pmd_trans_huge() still need to return true while the pmd is in this transitory state. For example, x86's pmd_present() also checks the _PAGE_PSE , riscv's version also checks the _PAGE_LEAF bit, and arm64 also checks a PMD_PRESENT_INVALID bit. Covering all 4 cases for x86 (all checks done on the same pmd value): 1) pmd_present() && pmd_trans_huge() All we actually know here is that the PSE bit is set. Either: a) We aren't racing with __split_huge_page(), and PRESENT or PROTNONE is set. => huge-pmd b) We are currently racing with __split_huge_page(). The danger here is that we proceed as-if we have a huge-pmd, but really we are looking at a pte-mapping-pmd. So, what is the risk of this danger? The only relevant path is: madvise_collapse() -> collapse_pte_mapped_thp() Where we might just incorrectly report back "success", when really the memory isn't pmd-backed. This is fine, since split could happen immediately after (actually) successful madvise_collapse(). So, it should be safe to just assume huge-pmd here. 2) pmd_present() && !pmd_trans_huge() Either: a) PSE not set and either PRESENT or PROTNONE is. => pte-table-mapping pmd (or PROT_NONE) b) devmap. This routine can be called immediately after unlocking/locking mmap_lock -- or called with no locks held (see khugepaged_scan_mm_slot()), so previous VMA checks have since been invalidated. 3) !pmd_present() && pmd_trans_huge() Not possible. 4) !pmd_present() && !pmd_trans_huge() Neither PRESENT nor PROTNONE set => not present I've checked all archs that implement pmd_trans_huge() (arm64, riscv, powerpc, longarch, x86, mips, s390) and this logic roughly translates (though devmap treatment is unique to x86 and powerpc, and (3) doesn't necessarily hold in general -- but that doesn't matter since !pmd_present() always takes failure path). Also, add a comment above find_pmd_or_thp_or_none() to help future travelers reason about the validity of the code; namely, the possible mutations that might happen out from under us, depending on how mmap_lock is held (if at all). Link: https://lkml.kernel.org/r/20230125225358.2576151-1-zokeefe@google.com Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") Signed-off-by: Zach O'Keefe Reported-by: Hugh Dickins Reviewed-by: Yang Shi Cc: Signed-off-by: Andrew Morton commit 8ef852f1cb426a5812aee700d3b4297aaa426acc Author: Isaac J. Manjarres Date: Tue Jan 24 15:02:54 2023 -0800 Revert "mm: kmemleak: alloc gray object for reserved region with direct map" This reverts commit 972fa3a7c17c9d60212e32ecc0205dc585b1e769. Kmemleak operates by periodically scanning memory regions for pointers to allocated memory blocks to determine if they are leaked or not. However, reserved memory regions can be used for DMA transactions between a device and a CPU, and thus, wouldn't contain pointers to allocated memory blocks, making them inappropriate for kmemleak to scan. Thus, revert this commit. Link: https://lkml.kernel.org/r/20230124230254.295589-1-isaacmanjarres@google.com Fixes: 972fa3a7c17c9 ("mm: kmemleak: alloc gray object for reserved region with direct map") Signed-off-by: Isaac J. Manjarres Acked-by: Catalin Marinas Cc: Calvin Zhang Cc: Frank Rowand Cc: Rob Herring Cc: Saravana Kannan Cc: [5.17+] Signed-off-by: Andrew Morton commit 0d7866eace86c174e2d4f4fe3a7eca7a3a31247a Author: Randy Dunlap Date: Tue Jan 24 10:16:38 2023 -0800 freevxfs: Kconfig: fix spelling Fix a spello in freevxfs Kconfig. (reported by codespell) Link: https://lkml.kernel.org/r/20230124181638.15604-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit ab6ef70a8b0d314c2160af70b0de984664d675e0 Author: Wei Yang Date: Sat Nov 12 23:43:08 2022 +0000 maple_tree: should get pivots boundary by type We should get pivots boundary by type. Fixes a potential overindexing of mt_pivots[]. Link: https://lkml.kernel.org/r/20221112234308.23823-1-richard.weiyang@gmail.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Wei Yang Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 889a904fe34d90c4416dd403f5d3ad859180cf68 Author: Eugen Hristev Date: Thu Jan 19 09:22:29 2023 +0200 .mailmap: update e-mail address for Eugen Hristev Update e-mail address. Link: https://lkml.kernel.org/r/20230119072229.99603-1-eugen.hristev@collabora.com Signed-off-by: Eugen Hristev Signed-off-by: Andrew Morton commit d014cd7c1c358edc3ea82ebf327a036a42ed0164 Author: Vlastimil Babka Date: Tue Jan 17 11:19:39 2023 +0100 mm, mremap: fix mremap() expanding for vma's with vm_ops->close() Fabian has reported another regression in 6.1 due to ca3d76b0aa80 ("mm: add merging after mremap resize"). The problem is that vma_merge() can fail when vma has a vm_ops->close() method, causing is_mergeable_vma() test to be negative. This was happening for vma mapping a file from fuse-overlayfs, which does have the method. But when we are simply expanding the vma, we never remove it due to the "merge" with the added area, so the test should not prevent the expansion. As a quick fix, check for such vmas and expand them using vma_adjust() directly as was done before commit ca3d76b0aa80. For a more robust long term solution we should try to limit the check for vma_ops->close only to cases that actually result in vma removal, so that no merge would be prevented unnecessarily. [akpm@linux-foundation.org: fix indenting whitespace, reflow comment] Link: https://lkml.kernel.org/r/20230117101939.9753-1-vbabka@suse.cz Fixes: ca3d76b0aa80 ("mm: add merging after mremap resize") Signed-off-by: Vlastimil Babka Reported-by: Fabian Vogt Link: https://bugzilla.suse.com/show_bug.cgi?id=1206359#c35 Tested-by: Fabian Vogt Cc: Jakub Matěna Cc: Signed-off-by: Andrew Morton commit 72e544b1b28325fe78a4687b980871a7e4101f76 Author: Fedor Pchelkin Date: Tue Jan 17 13:52:26 2023 +0300 squashfs: harden sanity check in squashfs_read_xattr_id_table While mounting a corrupted filesystem, a signed integer '*xattr_ids' can become less than zero. This leads to the incorrect computation of 'len' and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() or out-of-bounds accesses in the next sanity checks inside squashfs_read_xattr_id_table(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru Fixes: 506220d2ba21 ("squashfs: add more sanity checks in xattr id lookup") Reported-by: Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Cc: Phillip Lougher Signed-off-by: Andrew Morton commit 6f28a2613497fc587e347afa99fa2c52230678a7 Author: James Morse Date: Tue Jan 17 15:16:32 2023 +0000 ia64: fix build error due to switch case label appearing next to declaration Since commit aa06a9bd8533 ("ia64: fix clock_getres(CLOCK_MONOTONIC) to report ITC frequency"), gcc 10.1.0 fails to build ia64 with the gnomic: | ../arch/ia64/kernel/sys_ia64.c: In function 'ia64_clock_getres': | ../arch/ia64/kernel/sys_ia64.c:189:3: error: a label can only be part of a statement and a declaration is not a statement | 189 | s64 tick_ns = DIV_ROUND_UP(NSEC_PER_SEC, local_cpu_data->itc_freq); This line appears immediately after a case label in a switch. Move the declarations out of the case, to the top of the function. Link: https://lkml.kernel.org/r/20230117151632.393836-1-james.morse@arm.com Fixes: aa06a9bd8533 ("ia64: fix clock_getres(CLOCK_MONOTONIC) to report ITC frequency") Signed-off-by: James Morse Reviewed-by: Sergei Trofimovich Cc: Émeric Maschino Cc: matoro Cc: John Paul Adrian Glaubitz Cc: Signed-off-by: Andrew Morton commit de08eaa6156405f2e9369f06ba5afae0e4ab3b62 Author: Yu Zhao Date: Sun Jan 15 20:44:05 2023 -0700 mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup_can_fork() cgroup_procs_write() cgroup_post_fork() task_lock() lru_gen_migrate_mm() task_unlock() task_lock() lru_gen_add_mm() task_unlock() And when the above happens, kernel crashes because of linked list corruption (mm_struct->lru_gen.list). Link: https://lore.kernel.org/r/20230115134651.30028-1-msizanoen@qtmlabs.xyz/ Link: https://lkml.kernel.org/r/20230116034405.2960276-1-yuzhao@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Yu Zhao Reported-by: msizanoen Tested-by: msizanoen Cc: [6.1+] Signed-off-by: Andrew Morton commit 55ab834a86a9934c4f17825c115f7dc16a89aae7 Author: Michal Hocko Date: Fri Dec 16 10:46:33 2022 +0100 Revert "mm: add nodes= arg to memory.reclaim" This reverts commit 12a5d3955227b0d7e04fb793ccceeb2a1dd275c5. Although it is recognized that a finer grained pro-active reclaim is something we need and want the semantic of this implementation is really ambiguous. In a follow up discussion it became clear that there are two essential usecases here. One is to use memory.reclaim to pro-actively reclaim memory and expectation is that the requested and reported amount of memory is uncharged from the memcg. Another usecase focuses on pro-active demotion when the memory is merely shuffled around to demotion targets while the overall charged memory stays unchanged. The current implementation considers demoted pages as reclaimed and that break both usecases. [1] has tried to address the reporting part but there are more issues with that summarized in [2] and follow up emails. Let's revert the nodemask based extension of the memcg pro-active reclaim for now until we settle with a more robust semantic. [1] http://lkml.kernel.org/r/http://lkml.kernel.org/r/20221206023406.3182800-1-almasrymina@google.com [2] http://lkml.kernel.org/r/Y5bsmpCyeryu3Zz1@dhcp22.suse.cz Link: https://lkml.kernel.org/r/Y5xASNe1x8cusiTx@dhcp22.suse.cz Fixes: 12a5d3955227b0d ("mm: add nodes= arg to memory.reclaim") Signed-off-by: Michal Hocko Cc: Bagas Sanjaya Cc: Huang Ying Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Mina Almasry Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tejun Heo Cc: Wei Xu Cc: Yang Shi Cc: Yosry Ahmed Cc: zefan li Signed-off-by: Andrew Morton commit 85b325815b566e8e7472e0089c8cbb0d5ea274ec Author: Nhat Pham Date: Tue Jan 10 15:17:01 2023 -0800 zsmalloc: fix a race with deferred_handles storing Currently, there is a race between zs_free() and zs_reclaim_page(): zs_reclaim_page() finds a handle to an allocated object, but before the eviction happens, an independent zs_free() call to the same handle could come in and overwrite the object value stored at the handle with the last deferred handle. When zs_reclaim_page() finally gets to call the eviction handler, it will see an invalid object value (i.e the previous deferred handle instead of the original object value). This race happens quite infrequently. We only managed to produce it with out-of-tree developmental code that triggers zsmalloc writeback with a much higher frequency than usual. This patch fixes this race by storing the deferred handle in the object header instead. We differentiate the deferred handle from the other two cases (handle for allocated object, and linkage for free object) with a new tag. If zspage reclamation succeeds, we will free these deferred handles by walking through the zspage objects. On the other hand, if zspage reclamation fails, we reconstruct the zspage freelist (with the deferred handle tag and allocated tag) before trying again with the reclamation. [arnd@arndb.de: avoid unused-function warning] Link: https://lkml.kernel.org/r/20230117170507.2651972-1-arnd@kernel.org Link: https://lkml.kernel.org/r/20230110231701.326724-1-nphamcs@gmail.com Fixes: 9997bc017549 ("zsmalloc: implement writeback mechanism for zsmalloc") Signed-off-by: Nhat Pham Signed-off-by: Arnd Bergmann Suggested-by: Johannes Weiner Cc: Dan Streetman Cc: Minchan Kim Cc: Nitin Gupta Cc: Sergey Senozhatsky Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 023f47a8250c6bdb4aebe744db4bf7f73414028b Author: Jann Horn Date: Wed Jan 11 14:33:51 2023 +0100 mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_POneSDF+A@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn Reported-by: Zach O'Keefe Acked-by: Kirill A. Shutemov Reviewed-by: Yang Shi Cc: David Hildenbrand Cc: Signed-off-by: Andrew Morton commit 7327e8111adb315423035fb5233533016dfd3f2e Author: Liam Howlett Date: Wed Jan 11 20:02:07 2023 +0000 maple_tree: fix mas_empty_area_rev() lower bound validation mas_empty_area_rev() was not correctly validating the start of a gap against the lower limit. This could lead to the range starting lower than the requested minimum. Fix the issue by better validating a gap once one is found. This commit also adds tests to the maple tree test suite for this issue and tests the mas_empty_area() function for similar bound checking. Link: https://lkml.kernel.org/r/20230111200136.1851322-1-Liam.Howlett@oracle.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216911 Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Link: https://lore.kernel.org/linux-mm/0b9f5425-08d4-8013-aa4c-e620c3b10bb2@leemhuis.info/ Tested-by: Holger Hoffsttte Cc: Signed-off-by: Andrew Morton commit c0b67534c95c537f7a506a06b98e5e85d72e2b7d Merge: 58706f7fb045b e5ae8803847b8 Author: Linus Torvalds Date: Tue Jan 31 16:02:05 2023 -0800 Merge tag 'cgroup-for-6.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "cpuset has a bug which can cause an oops after some configuration operations, introduced during the v6.1 cycle. This single commit fixes the bug" * tag 'cgroup-for-6.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() commit e5ae8803847b80fe9d744a3174abe2b7bfed222a Author: Waiman Long Date: Tue Jan 31 10:48:03 2023 -0500 cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts_cpumask() was incorrect. As a result, it is possible to leave parent with no effective cpu left even if there are tasks in the parent cpuset. This can lead to system panic as reported in [1]. Fix this probem by updating the check to fail the enabling the partition if parent's effective_cpus is a subset of the child's cpus_allowed. Also record the error code when an error happens in update_prstate() and add a test case where parent partition and child have the same cpu list and parent has task. Enabling partition in the child will fail in this case. [1] https://www.spinics.net/lists/cgroups/msg36254.html Fixes: f0af1bfc27b5 ("cgroup/cpuset: Relax constraints to partition & cpus changes") Cc: stable@vger.kernel.org # v6.1 Reported-by: Srinivas Pandruvada Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 58706f7fb045b7019bada81fa17f372189315fe5 Merge: 88b356e19199d 15600159bcc6a Author: Linus Torvalds Date: Tue Jan 31 11:39:08 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two core fixes. One simply moves an annotation from put to release to avoid the warning triggering needlessly in alua, but to keep it in case release is ever called from that path (which we don't think will happen). The other reverts a change to the PQ=1 target scanning behaviour that's under intense discussion at the moment" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" scsi: core: Fix the scsi_device_put() might_sleep annotation commit 4f64a6c9f6f11e8b7314f8e27e2c4568706009e6 Author: James Clark Date: Fri Jan 27 14:31:41 2023 +0000 perf: Fix perf_event_pmu_context serialization Syzkaller triggered a WARN in put_pmu_ctx(). WARNING: CPU: 1 PID: 2245 at kernel/events/core.c:4925 put_pmu_ctx+0x1f0/0x278 This is because there is no locking around the access of "if (!epc->ctx)" in find_get_pmu_context() and when it is set to NULL in put_pmu_ctx(). The decrement of the reference count in put_pmu_ctx() also happens outside of the spinlock, leading to the possibility of this order of events, and the context being cleared in put_pmu_ctx(), after its refcount is non zero: CPU0 CPU1 find_get_pmu_context() if (!epc->ctx) == false put_pmu_ctx() atomic_dec_and_test(&epc->refcount) == true epc->refcount == 0 atomic_inc(&epc->refcount); epc->refcount == 1 list_del_init(&epc->pmu_ctx_entry); epc->ctx = NULL; Another issue is that WARN_ON for no active PMU events in put_pmu_ctx() is outside of the lock. If the perf_event_pmu_context is an embedded one, even after clearing it, it won't be deleted and can be re-used. So the warning can trigger. For this reason it also needs to be moved inside the lock. The above warning is very quick to trigger on Arm by running these two commands at the same time: while true; do perf record -- ls; done while true; do perf record -- ls; done [peterz: atomic_dec_and_raw_lock*()] Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: syzbot+697196bc0265049822bd@syzkaller.appspotmail.com Signed-off-by: James Clark Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ravi Bangoria Link: https://lore.kernel.org/r/20230127143141.1782804-2-james.clark@arm.com commit 88b356e19199dca700b1180adc0b843a3228d4a0 Merge: 22b8077d0fcec 89c08aef8f8dc Author: Linus Torvalds Date: Tue Jan 31 11:17:38 2023 -0800 Merge tag 'media/v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A couple of v4l2 core fixes: - fix a regression on strings control support - fix a regression for some drivers that depend on an odd streaming behavior" * tag 'media/v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: videobuf2: set q->streaming later media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line commit 81ea42b9c3d61ea34d82d900ed93f4b4851f13b0 Author: Bart Van Assche Date: Mon Jan 30 13:12:33 2023 -0800 block: Fix the blk_mq_destroy_queue() documentation Commit 2b3f056f72e5 moved a blk_put_queue() call from blk_mq_destroy_queue() into its callers. Reflect this change in the documentation block above blk_mq_destroy_queue(). Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Chaitanya Kulkarni Cc: Keith Busch Fixes: 2b3f056f72e5 ("blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue") Signed-off-by: Bart Van Assche Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230130211233.831613-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit 7ab41c2c08a32132ba8c14624910e2fe8ce4ba4b Author: Vasily Gorbik Date: Sun Jan 29 23:47:23 2023 +0100 s390/decompressor: specify __decompress() buf len to avoid overflow Historically calls to __decompress() didn't specify "out_len" parameter on many architectures including s390, expecting that no writes beyond uncompressed kernel image are performed. This has changed since commit 2aa14b1ab2c4 ("zstd: import usptream v1.5.2") which includes zstd library commit 6a7ede3dfccb ("Reduce size of dctx by reutilizing dst buffer (#2751)"). Now zstd decompression code might store literal buffer in the unwritten portion of the destination buffer. Since "out_len" is not set, it is considered to be unlimited and hence free to use for optimization needs. On s390 this might corrupt initrd or ipl report which are often placed right after the decompressor buffer. Luckily the size of uncompressed kernel image is already known to the decompressor, so to avoid the problem simply specify it in the "out_len" parameter. Link: https://github.com/facebook/zstd/commit/6a7ede3dfccb Signed-off-by: Vasily Gorbik Tested-by: Alexander Egorenkov Link: https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours Signed-off-by: Heiko Carstens commit 254c71374a70051a043676b67ba4f7ad392b5fe6 Author: Brendan Higgins Date: Tue Jan 31 10:35:03 2023 +0800 kunit: fix kunit_test_init_section_suites(...) Looks like kunit_test_init_section_suites(...) was messed up in a merge conflict. This fixes it. kunit_test_init_section_suites(...) was not updated to avoid the extra level of indirection when .kunit_test_suites was flattened. Given no-one was actively using it, this went unnoticed for a long period of time. Fixes: e5857d396f35 ("kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites") Signed-off-by: Brendan Higgins Signed-off-by: David Gow Tested-by: Martin Fernandez Signed-off-by: Shuah Khan commit 0a2742bf5899bf3bc46d16e4cc7dd7352ce771fd Author: Stafford Horne Date: Wed Feb 1 00:48:30 2023 +0900 MAINTAINERS: Update OpenRISC mailing list The mailing list at librecores.org is being shut down due to infrastructure issues. Update the the newly created list on vger.kernel.org. Signed-off-by: Stafford Horne commit 29baef789c838bd5c02f50c88adbbc6b955aaf61 Author: Liu Xiaodong Date: Tue Jan 31 02:05:52 2023 -0500 block: ublk: extending queue_size to fix overflow When validating drafted SPDK ublk target, in a case that assigning large queue depth to multiqueue ublk device, ublk target would run into a weird incorrect state. During rounds of review and debug, An overflow bug was found in ublk driver. In ublk_cmd.h, UBLK_MAX_QUEUE_DEPTH is 4096 which means each ublk queue depth can be set as large as 4096. But when setting qd for a ublk device, sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) will be larger than 65535 if qd is larger than 2728. Then queue_size is overflowed, and ublk_get_queue() references a wrong pointer position. The wrong content of ublk_queue elements will lead to out-of-bounds memory access. Extend queue_size in ublk_device as "unsigned int". Signed-off-by: Liu Xiaodong Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230131070552.115067-1-xiaodong.liu@intel.com Signed-off-by: Jens Axboe commit f9c47b2caa7ffc903ec950b454b59c209afe3182 Author: Dean Luick Date: Mon Jan 9 14:04:08 2023 -0500 IB/hfi1: Assign npages earlier Improve code clarity and enable earlier use of tidbuf->npages by moving its assignment to structure creation time. Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 226fae124b2dac217ea5436060d623ff3385bc34 Author: George Kennedy Date: Tue Jan 24 11:16:54 2023 -0500 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data pointer load must be done at the top of while loop in vcs_read() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537 CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: __asan_report_load4_noabort (mm/kasan/report_generic.c:350) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_read (drivers/tty/vt/vc_screen.c:415) vfs_read (fs/read_write.c:468 fs/read_write.c:450) ... Allocated by task 1191: ... kmalloc_trace (mm/slab_common.c:1069) vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) con_install (drivers/tty/vt/vt.c:3383) tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413 drivers/tty/tty_io.c:1390) tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:883) vfs_open (fs/open.c:1014) ... Freed by task 1548: ... kfree (mm/slab_common.c:1021) vc_port_destruct (drivers/tty/vt/vt.c:1094) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2776) ... The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of 1024-byte region [ffff888113747800, ffff888113747c00) The buggy address belongs to the physical page: page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113740 head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()") Reported-by: syzkaller Suggested-by: Jiri Slaby Signed-off-by: George Kennedy Link: https://lore.kernel.org/r/1674577014-12374-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman commit c956940a4ab73a87d0165e911c001dbdd2c8200f Author: Maor Gottlieb Date: Mon Jan 30 16:25:50 2023 +0200 RDMA/umem: Use dma-buf locked API to solve deadlock The cited commit moves umem to call the unlocked versions of dmabuf unmap/map attachment, but the lock is held while calling to these functions, hence move back to the locked versions of these APIs. Fixes: 21c9c5c0784f ("RDMA/umem: Prepare to dynamic dma-buf locking specification") Link: https://lore.kernel.org/r/311c2cb791f8af75486df446819071357353db1b.1675088709.git.leon@kernel.org Signed-off-by: Maor Gottlieb Reviewed-by: Christian König Signed-off-by: Leon Romanovsky Reviewed-by: Dmitry Osipenko Signed-off-by: Jason Gunthorpe commit bd0e06f0def75ba26572a94e5350324474a55562 Author: Florian Westphal Date: Thu Jan 26 02:35:21 2023 +0100 Revert "netfilter: conntrack: fix bug in for_each_sctp_chunk" There is no bug. If sch->length == 0, this would result in an infinite loop, but first caller, do_basic_checks(), errors out in this case. After this change, packets with bogus zero-length chunks are no longer detected as invalid, so revert & add comment wrt. 0 length check. Fixes: 98ee00774525 ("netfilter: conntrack: fix bug in for_each_sctp_chunk") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2b272bb558f1d3a5aa95ed8a82253786fd1a48ba Author: Florian Westphal Date: Mon Jan 30 11:39:29 2023 +0100 netfilter: br_netfilter: disable sabotage_in hook after first suppression When using a xfrm interface in a bridged setup (the outgoing device is bridged), the incoming packets in the xfrm interface are only tracked in the outgoing direction. $ brctl show bridge name interfaces br_eth1 eth1 $ conntrack -L tcp 115 SYN_SENT src=192... dst=192... [UNREPLIED] ... If br_netfilter is enabled, the first (encrypted) packet is received onR eth1, conntrack hooks are called from br_netfilter emulation which allocates nf_bridge info for this skb. If the packet is for local machine, skb gets passed up the ip stack. The skb passes through ip prerouting a second time. br_netfilter ip_sabotage_in supresses the re-invocation of the hooks. After this, skb gets decrypted in xfrm layer and appears in network stack a second time (after decryption). Then, ip_sabotage_in is called again and suppresses netfilter hook invocation, even though the bridge layer never called them for the plaintext incarnation of the packet. Free the bridge info after the first suppression to avoid this. I was unable to figure out where the regression comes from, as far as i can see br_netfilter always had this problem; i did not expect that skb is looped again with different headers. Fixes: c4b0e771f906 ("netfilter: avoid using skb->nf_bridge directly") Reported-and-tested-by: Wolfgang Nothdurft Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9d2c7203ffdb846399b82b0660563c89e918c751 Author: Joerg Roedel Date: Tue Jan 31 09:57:18 2023 +0100 x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses In kernels compiled with CONFIG_PARAVIRT=n, the compiler re-orders the DR7 read in exc_nmi() to happen before the call to sev_es_ist_enter(). This is problematic when running as an SEV-ES guest because in this environment the DR7 read might cause a #VC exception, and taking #VC exceptions is not safe in exc_nmi() before sev_es_ist_enter() has run. The result is stack recursion if the NMI was caused on the #VC IST stack, because a subsequent #VC exception in the NMI handler will overwrite the stack frame of the interrupted #VC handler. As there are no compiler barriers affecting the ordering of DR7 reads/writes, make the accesses to this register volatile, forbidding the compiler to re-order them. [ bp: Massage text, make them volatile too, to make sure some aggressive compiler optimization pass doesn't discard them. ] Fixes: 315562c9af3d ("x86/sev-es: Adjust #VC IST Stack on entering NMI handler") Reported-by: Alexey Kardashevskiy Signed-off-by: Joerg Roedel Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230127035616.508966-1-aik@amd.com commit 111bcb37385353f0510e5847d5abcd1c613dba23 Author: Michael Ellerman Date: Tue Jan 10 23:47:53 2023 +1100 powerpc/64s/radix: Fix RWX mapping with relocated kernel If a relocatable kernel is loaded at a non-zero address and told not to relocate to zero (kdump or RELOCATABLE_TEST), the mapping of the interrupt code at zero is left with RWX permissions. That is a security weakness, and leads to a warning at boot if CONFIG_DEBUG_WX is enabled: powerpc/mm: Found insecure W+X mapping at address 00000000056435bc/0xc000000000000000 WARNING: CPU: 1 PID: 1 at arch/powerpc/mm/ptdump/ptdump.c:193 note_page+0x484/0x4c0 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc1-00001-g8ae8e98aea82-dirty #175 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,git-dd0dca hv:linux,kvm pSeries NIP: c0000000004a1c34 LR: c0000000004a1c30 CTR: 0000000000000000 REGS: c000000003503770 TRAP: 0700 Not tainted (6.2.0-rc1-00001-g8ae8e98aea82-dirty) MSR: 8000000002029033 CR: 24000220 XER: 00000000 CFAR: c000000000545a58 IRQMASK: 0 ... NIP note_page+0x484/0x4c0 LR note_page+0x480/0x4c0 Call Trace: note_page+0x480/0x4c0 (unreliable) ptdump_pmd_entry+0xc8/0x100 walk_pgd_range+0x618/0xab0 walk_page_range_novma+0x74/0xc0 ptdump_walk_pgd+0x98/0x170 ptdump_check_wx+0x94/0x100 mark_rodata_ro+0x30/0x70 kernel_init+0x78/0x1a0 ret_from_kernel_thread+0x5c/0x64 The fix has two parts. Firstly the pages from zero up to the end of interrupts need to be marked read-only, so that they are left with R-X permissions. Secondly the mapping logic needs to be taught to ensure there is a page boundary at the end of the interrupt region, so that the permission change only applies to the interrupt text, and not the region following it. Fixes: c55d7b5e6426 ("powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE") Reported-by: Sachin Sant Tested-by: Sachin Sant Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230110124753.1325426-2-mpe@ellerman.id.au commit 98d0219e043e09013e883eacde3b93e0b2bf944d Author: Michael Ellerman Date: Tue Jan 10 23:47:52 2023 +1100 powerpc/64s/radix: Fix crash with unaligned relocated kernel If a relocatable kernel is loaded at an address that is not 2MB aligned and told not to relocate to zero, the kernel can crash due to mark_rodata_ro() incorrectly changing some read-write data to read-only. Scenarios where the misalignment can occur are when the kernel is loaded by kdump or using the RELOCATABLE_TEST config option. Example crash with the kernel loaded at 5MB: Run /sbin/init as init process BUG: Unable to handle kernel data access on write at 0xc000000000452000 Faulting instruction address: 0xc0000000005b6730 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 1 PID: 1 Comm: init Not tainted 6.2.0-rc1-00011-g349188be4841 #166 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,git-5b4c5a hv:linux,kvm pSeries NIP: c0000000005b6730 LR: c000000000ae9ab8 CTR: 0000000000000380 REGS: c000000004503250 TRAP: 0300 Not tainted (6.2.0-rc1-00011-g349188be4841) MSR: 8000000000009033 CR: 44288480 XER: 00000000 CFAR: c0000000005b66ec DAR: c000000000452000 DSISR: 0a000000 IRQMASK: 0 ... NIP memset+0x68/0x104 LR zero_user_segments.constprop.0+0xa8/0xf0 Call Trace: ext4_mpage_readpages+0x7f8/0x830 ext4_readahead+0x48/0x60 read_pages+0xb8/0x380 page_cache_ra_unbounded+0x19c/0x250 filemap_fault+0x58c/0xae0 __do_fault+0x60/0x100 __handle_mm_fault+0x1230/0x1a40 handle_mm_fault+0x120/0x300 ___do_page_fault+0x20c/0xa80 do_page_fault+0x30/0xc0 data_access_common_virt+0x210/0x220 This happens because mark_rodata_ro() tries to change permissions on the range _stext..__end_rodata, but _stext sits in the middle of the 2MB page from 4MB to 6MB: radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages radix-mmu: Mapped 0x0000000000400000-0x0000000002400000 with 2.00 MiB pages (exec) The logic that changes the permissions assumes the linear mapping was split correctly at boot, so it marks the entire 2MB page read-only. That leads to the write fault above. To fix it, the boot time mapping logic needs to consider that if the kernel is running at a non-zero address then _stext is a boundary where it must split the mapping. That leads to the mapping being split correctly, allowing the rodata permission change to take happen correctly, with no spillover: radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages radix-mmu: Mapped 0x0000000000400000-0x0000000000500000 with 64.0 KiB pages radix-mmu: Mapped 0x0000000000500000-0x0000000000600000 with 64.0 KiB pages (exec) radix-mmu: Mapped 0x0000000000600000-0x0000000002400000 with 2.00 MiB pages (exec) If the kernel is loaded at a 2MB aligned address, the mapping continues to use 2MB pages as before: radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages radix-mmu: Mapped 0x0000000000400000-0x0000000002c00000 with 2.00 MiB pages (exec) radix-mmu: Mapped 0x0000000002c00000-0x0000000100000000 with 2.00 MiB pages Fixes: c55d7b5e6426 ("powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230110124753.1325426-1-mpe@ellerman.id.au commit 7294194b47e994753a86eee8cf1c61f3f36458a3 Author: Michael Ellerman Date: Mon Jan 30 12:47:07 2023 +1100 powerpc/kexec_file: Fix division by zero in extra size estimation In kexec_extra_fdt_size_ppc64() there's logic to estimate how much extra space will be needed in the device tree for some memory related properties. That logic uses the size of RAM divided by drmem_lmb_size() to do the estimation. However drmem_lmb_size() can be zero if the machine has no hotpluggable memory configured, which is the case when booting with qemu and no maxmem=x parameter is passed (the default). The division by zero is reported by UBSAN, and can also lead to an overflow and a warning from kvmalloc, and kdump kernel loading fails: WARNING: CPU: 0 PID: 133 at mm/util.c:596 kvmalloc_node+0x15c/0x160 Modules linked in: CPU: 0 PID: 133 Comm: kexec Not tainted 6.2.0-rc5-03455-g07358bd97810 #223 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1200 0xf000005 of:SLOF,git-dd0dca pSeries NIP: c00000000041ff4c LR: c00000000041fe58 CTR: 0000000000000000 REGS: c0000000096ef750 TRAP: 0700 Not tainted (6.2.0-rc5-03455-g07358bd97810) MSR: 800000000282b033 CR: 24248242 XER: 2004011e CFAR: c00000000041fed0 IRQMASK: 0 ... NIP kvmalloc_node+0x15c/0x160 LR kvmalloc_node+0x68/0x160 Call Trace: kvmalloc_node+0x68/0x160 (unreliable) of_kexec_alloc_and_setup_fdt+0xb8/0x7d0 elf64_load+0x25c/0x4a0 kexec_image_load_default+0x58/0x80 sys_kexec_file_load+0x5c0/0x920 system_call_exception+0x128/0x330 system_call_vectored_common+0x15c/0x2ec To fix it, skip the calculation if drmem_lmb_size() is zero. Fixes: 2377c92e37fe ("powerpc/kexec_file: fix FDT size estimation for kdump kernel") Cc: stable@vger.kernel.org # v5.12+ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230130014707.541110-1-mpe@ellerman.id.au commit 57e9af7831dcf211c5c689c2a6f209f4abdf0bce Author: Ilpo Järvinen Date: Mon Jan 30 13:48:41 2023 +0200 serial: 8250_dma: Fix DMA Rx rearm race As DMA Rx can be completed from two places, it is possible that DMA Rx completes before DMA completion callback had a chance to complete it. Once the previous DMA Rx has been completed, a new one can be started on the next UART interrupt. The following race is possible (uart_unlock_and_check_sysrq_irqrestore() replaced with spin_unlock_irqrestore() for simplicity/clarity): CPU0 CPU1 dma_rx_complete() serial8250_handle_irq() spin_lock_irqsave(&port->lock) handle_rx_dma() serial8250_rx_dma_flush() __dma_rx_complete() dma->rx_running = 0 // Complete DMA Rx spin_unlock_irqrestore(&port->lock) serial8250_handle_irq() spin_lock_irqsave(&port->lock) handle_rx_dma() serial8250_rx_dma() dma->rx_running = 1 // Setup a new DMA Rx spin_unlock_irqrestore(&port->lock) spin_lock_irqsave(&port->lock) // sees dma->rx_running = 1 __dma_rx_complete() dma->rx_running = 0 // Incorrectly complete // running DMA Rx This race seems somewhat theoretical to occur for real but handle it correctly regardless. Check what is the DMA status before complething anything in __dma_rx_complete(). Reported-by: Gilles BULOZ Tested-by: Gilles BULOZ Fixes: 9ee4b83e51f7 ("serial: 8250: Add support for dmaengine") Cc: stable@vger.kernel.org Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230130114841.25749-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 31352811e13dc2313f101b890fd4b1ce760b5fe7 Author: Ilpo Järvinen Date: Mon Jan 30 13:48:40 2023 +0200 serial: 8250_dma: Fix DMA Rx completion race __dma_rx_complete() is called from two places: - Through the DMA completion callback dma_rx_complete() - From serial8250_rx_dma_flush() after IIR_RLSI or IIR_RX_TIMEOUT The former does not hold port's lock during __dma_rx_complete() which allows these two to race and potentially insert the same data twice. Extend port's lock coverage in dma_rx_complete() to prevent the race and check if the DMA Rx is still pending completion before calling into __dma_rx_complete(). Reported-by: Gilles BULOZ Tested-by: Gilles BULOZ Fixes: 9ee4b83e51f7 ("serial: 8250: Add support for dmaengine") Cc: stable@vger.kernel.org Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230130114841.25749-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3f6c02fa712bd453871877fe1d1969625617471e Author: Marek Vasut Date: Fri Jan 20 17:03:32 2023 +0100 serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Requesting an interrupt with IRQF_ONESHOT will run the primary handler in the hard-IRQ context even in the force-threaded mode. The force-threaded mode is used by PREEMPT_RT in order to avoid acquiring sleeping locks (spinlock_t) in hard-IRQ context. This combination makes it impossible and leads to "sleeping while atomic" warnings. Use one interrupt handler for both handlers (primary and secondary) and drop the IRQF_ONESHOT flag which is not needed. Fixes: e359b4411c283 ("serial: stm32: fix threaded interrupt handling") Reviewed-by: Sebastian Andrzej Siewior Tested-by: Valentin Caron # V3 Signed-off-by: Marek Vasut Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230120160332.57930-1-marex@denx.de Signed-off-by: Greg Kroah-Hartman commit 9944028659e638587c2c27aaaf5ebd7531ebe0fa Merge: bf29ce87ba137 2acd031347f64 Author: Greg Kroah-Hartman Date: Tue Jan 31 10:51:39 2023 +0100 Merge tag 'iio-fixes-for-6.2a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: "1st set of IIO fixes for the 6.2 cycle. The usual mixed bag - with a bunch of issues found by Carlos Song in the fxos8700 IMU driver dominating. hid-accel,gyro - Fix wrong returned value when read succeeds. marvell,berlin-adc - Missing of_node_put() in an error path. nxp,fxos8700 (freescale) - Wrong channel type match. - Swapped channel read back. - Incomplete channel read back (not enough bytes). - Missing shift of acceleration data. - Range selection didn't work (datasheet bug) - Wrong ODR mode read back due to wrong field offset. - Drop unused, but wrong define. - Fix issue with magnetometer scale an units. nxp,imx8qxp - Fix an irq flood due to not reading data early enough. st,lsm6dsx - Add CONFIG_IIO_TRIGGERED_BUFFER select. st,stm32-adc - Fix missing MODULE_DEVICE_TABLE() needed for module aliases. ti,twl6030 - Fix missing enable of some channels. - Fix a typo in previous patch that meant one channel still wasn't enabled. xilinx,xadc - Carrying on incorrectly after allocation error." * tag 'iio-fixes-for-6.2a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: imu: fxos8700: fix MAGN sensor scale and unit iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: fix incorrect ODR mode readback iio: light: cm32181: Fix PM support on system with 2 I2C resources iio: hid: fix the retval in gyro_3d_capture_sample iio: hid: fix the retval in accel_3d_capture_sample iio: imu: st_lsm6dsx: fix build when CONFIG_IIO_TRIGGERED_BUFFER=m iio:adc:twl6030: Enable measurement of VAC iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imx8qxp-adc: fix irq flood when call imx8qxp_adc_read_raw() iio: adc: xilinx-ams: fix devm_krealloc() return value check iio: adc: berlin2-adc: Add missing of_node_put() in error path iio: adc: stm32-dfsdm: fill module aliases commit de5ca4c3852f896cacac2bf259597aab5e17d9e3 Author: Kees Cook Date: Fri Jan 27 14:40:37 2023 -0800 net: sched: sch: Bounds check priority Nothing was explicitly bounds checking the priority index used to access clpriop[]. WARN and bail out early if it's pathological. Seen with GCC 13: ../net/sched/sch_htb.c: In function 'htb_activate_prios': ../net/sched/sch_htb.c:437:44: warning: array subscript [0, 31] is outside array bounds of 'struct htb_prio[8]' [-Warray-bounds=] 437 | if (p->inner.clprio[prio].feed.rb_node) | ~~~~~~~~~~~~~~~^~~~~~ ../net/sched/sch_htb.c:131:41: note: while referencing 'clprio' 131 | struct htb_prio clprio[TC_HTB_NUMPRIO]; | ^~~~~~ Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Simon Horman Reviewed-by: Cong Wang Link: https://lore.kernel.org/r/20230127224036.never.561-kees@kernel.org Signed-off-by: Paolo Abeni commit f3eceaed9edd7c0e0d9fb057613131f92973626f Author: Kees Cook Date: Fri Jan 27 14:38:54 2023 -0800 net: ethernet: mtk_eth_soc: Avoid truncating allocation There doesn't appear to be a reason to truncate the allocation used for flow_info, so do a full allocation and remove the unused empty struct. GCC does not like having a reference to an object that has been partially allocated, as bounds checking may become impossible when such an object is passed to other code. Seen with GCC 13: ../drivers/net/ethernet/mediatek/mtk_ppe.c: In function 'mtk_foe_entry_commit_subflow': ../drivers/net/ethernet/mediatek/mtk_ppe.c:623:18: warning: array subscript 'struct mtk_flow_entry[0]' is partly outside array bounds of 'unsigned char[48]' [-Warray-bounds=] 623 | flow_info->l2_data.base_flow = entry; | ^~ Cc: Felix Fietkau Cc: John Crispin Cc: Sean Wang Cc: Mark Lee Cc: Lorenzo Bianconi Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Matthias Brugger Cc: netdev@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-mediatek@lists.infradead.org Signed-off-by: Kees Cook Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230127223853.never.014-kees@kernel.org Signed-off-by: Paolo Abeni commit 22e46f6480e83bcf49b6d5e6b66c81872c97a902 Author: Jan Luebbe Date: Tue Jan 31 09:43:23 2023 +0100 kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*), signing of modules fails: scripts/sign-file sha256 /.../linux/pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 /.../kernel/crypto/tcrypt.ko Usage: scripts/sign-file [-dp] [] scripts/sign-file -s [] First, we need to avoid adding the $(srctree)/ prefix to the URL. Second, since the kconfig string values no longer include quotes, we need to add them again when passing a PKCS#11 URI to sign-file. This avoids splitting by the shell if the URI contains semicolons. Fixes: 4db9c2e3d055 ("kbuild: stop using config_filename in scripts/Makefile.modsign") Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") Signed-off-by: Jan Luebbe Signed-off-by: Masahiro Yamada commit b1c3d2beed8ef3699fab106340e33a79052df116 Author: Jan Luebbe Date: Tue Jan 31 09:43:22 2023 +0100 certs: Fix build error when PKCS#11 URI contains semicolon When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a semicolon, signing_key.x509 fails to build: certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 Usage: extract-cert Add quotes to the extract-cert argument to avoid splitting by the shell. This approach was suggested by Masahiro Yamada . Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") Signed-off-by: Jan Luebbe Signed-off-by: Masahiro Yamada commit c7a806d9ce6757ff56078674916e53bd859f242d Author: Takashi Sakamoto Date: Mon Jan 30 23:15:40 2023 +0900 ALSA: firewire-motu: fix unreleased lock warning in hwdep device Smatch static analysis tool detects that acquired lock is not released in hwdep device when condition branch is passed due to no event. It is unlikely to occur, while fulfilling is preferable for better coding. Reported-by: Dan Carpenter Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20230130141540.102854-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 9b3fc325c2a7e9e17e22b008357cb0ceb810d9b2 Merge: ffe2a22562444 71a06f1034b91 Author: Jakub Kicinski Date: Mon Jan 30 21:11:11 2023 -0800 Merge tag 'ieee802154-for-net-2023-01-30' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan Stefan Schmidt says: ==================== ieee802154 for net 2023-01-30 Only one fix this time around. Miquel Raynal fixed a potential double free spotted by Dan Carpenter. * tag 'ieee802154-for-net-2023-01-30' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan: mac802154: Fix possible double free upon parsing error ==================== Link: https://lore.kernel.org/r/20230130095646.301448-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit ffe2a22562444720b05bdfeb999c03e810d84cbb Author: Pietro Borrello Date: Sat Jan 28 16:29:17 2023 +0000 net/tls: tls_is_tx_ready() checked list_entry tls_is_tx_ready() checks that list_first_entry() does not return NULL. This condition can never happen. For empty lists, list_first_entry() returns the list_entry() of the head, which is a type confusion. Use list_first_entry_or_null() which returns NULL in case of empty lists. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it Signed-off-by: Jakub Kicinski commit 84115f0e74ea73eccc44842a125f242a02097493 Merge: 73a876022273c 53b9b77dcf48d Author: Jakub Kicinski Date: Mon Jan 30 21:02:44 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-01-27 (ice) This series contains updates to ice driver only. Dave prevents modifying channels when RDMA is active as this will break RDMA traffic. Michal fixes a broken URL. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix broken link in ice NAPI doc ice: Prevent set_channel from changing queues while RDMA active ==================== Link: https://lore.kernel.org/r/20230127225333.1534783-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ad53db4acb415976761d7302f5b02e97f2bd097e Author: Michael Ellerman Date: Mon Jan 30 12:44:01 2023 +1100 powerpc/imc-pmu: Revert nest_init_lock to being a mutex The recent commit 76d588dddc45 ("powerpc/imc-pmu: Fix use of mutex in IRQs disabled section") fixed warnings (and possible deadlocks) in the IMC PMU driver by converting the locking to use spinlocks. It also converted the init-time nest_init_lock to a spinlock, even though it's not used at runtime in IRQ disabled sections or while holding other spinlocks. This leads to warnings such as: BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 preempt_count: 1, expected: 0 CPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc2-14719-gf12cd06109f4-dirty #1 Hardware name: Mambo,Simulated-System POWER9 0x4e1203 opal:v6.6.6 PowerNV Call Trace: dump_stack_lvl+0x74/0xa8 (unreliable) __might_resched+0x178/0x1a0 __cpuhp_setup_state+0x64/0x1e0 init_imc_pmu+0xe48/0x1250 opal_imc_counters_probe+0x30c/0x6a0 platform_probe+0x78/0x110 really_probe+0x104/0x420 __driver_probe_device+0xb0/0x170 driver_probe_device+0x58/0x180 __driver_attach+0xd8/0x250 bus_for_each_dev+0xb4/0x140 driver_attach+0x34/0x50 bus_add_driver+0x1e8/0x2d0 driver_register+0xb4/0x1c0 __platform_driver_register+0x38/0x50 opal_imc_driver_init+0x2c/0x40 do_one_initcall+0x80/0x360 kernel_init_freeable+0x310/0x3b8 kernel_init+0x30/0x1a0 ret_from_kernel_thread+0x5c/0x64 Fix it by converting nest_init_lock back to a mutex, so that we can call sleeping functions while holding it. There is no interaction between nest_init_lock and the runtime spinlocks used by the actual PMU routines. Fixes: 76d588dddc45 ("powerpc/imc-pmu: Fix use of mutex in IRQs disabled section") Tested-by: Kajol Jain Reviewed-by: Kajol Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230130014401.540543-1-mpe@ellerman.id.au commit 90741096769bd75152a5fe397343e5893c7d905a Author: Ben Skeggs Date: Tue Jan 31 08:37:15 2023 +1000 drm/nouveau/acr/gm20b: regression fixes Missed some Tegra-specific quirks when reworking ACR to support Ampere. Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Ben Skeggs Tested-by: Diogo Ivo Tested-by: Nicolas Chauvet Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230130223715.1831509-3-bskeggs@redhat.com commit b480600988181c411d46a7f8da24d78d1e5ee151 Author: Ben Skeggs Date: Tue Jan 31 08:37:14 2023 +1000 drm/nouveau/fb/tu102-: fix register used to determine scrub status Turing apparently needs to use the same register we use on Ampere. Not executing the scrubber ucode when required would result in large areas of VRAM being inaccessible to the driver. Signed-off-by: Ben Skeggs Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230130223715.1831509-2-bskeggs@redhat.com commit d22915d22ded21fd5b24b60d174775789f173997 Author: Ben Skeggs Date: Tue Jan 31 08:37:13 2023 +1000 drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED Starting from Turing, the driver is no longer responsible for initiating DEVINIT when required as the GPU started loading a FW image from ROM and executing DEVINIT itself after power-on. However - we apparently still need to wait for it to complete. This should correct some issues with runpm on some systems, where we get control of the HW before it's been fully reinitialised after resume from suspend. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230130223715.1831509-1-bskeggs@redhat.com commit 606d4ef4922662ded34aa7218288c3043ce0a41a Author: Joel Stanley Date: Tue Jan 31 08:38:45 2023 +1030 pinctrl: aspeed: Revert "Force to disable the function's signal" This reverts commit cf517fef601b9dde151f0afc27164d13bf1fd907. The commit cf517fef601b ("pinctrl: aspeed: Force to disable the function's signal") exposed a problem with fetching the regmap for reading the GFX register. The Romulus machine the device tree contains a gpio hog for GPIO S7. With the patch applied: Muxing pin 151 for GPIO Disabling signal VPOB9 for VPO aspeed-g5-pinctrl 1e6e2080.pinctrl: Failed to acquire regmap for IP block 1 aspeed-g5-pinctrl 1e6e2080.pinctrl: request() failed for pin 151 The code path is aspeed-gpio -> pinmux-g5 -> regmap -> clk, and the of_clock code returns an error as it doesn't have a valid struct clk_hw pointer. The regmap call happens because pinmux wants to check the GFX node (IP block 1) to query bits there. For reference, before the offending patch: Muxing pin 151 for GPIO Disabling signal VPOB9 for VPO Want SCU8C[0x00000080]=0x1, got 0x0 from 0x00000000 Disabling signal VPOB9 for VPOOFF1 Want SCU8C[0x00000080]=0x1, got 0x0 from 0x00000000 Disabling signal VPOB9 for VPOOFF2 Want SCU8C[0x00000080]=0x1, got 0x0 from 0x00000000 Enabling signal GPIOS7 for GPIOS7 Muxed pin 151 as GPIOS7 gpio-943 (seq_cont): hogged as output/low We can't skip the clock check to allow pinmux to proceed, because the write to disable VPOB9 will try to set a bit in the GFX register space which will not stick when the IP is in reset. However, we do not want to enable the IP just so pinmux can do a disable-enable dance for the pin. For now, revert the offending patch while a correct solution is found. Fixes: cf517fef601b ("pinctrl: aspeed: Force to disable the function's signal") Link: https://github.com/openbmc/linux/issues/218 Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230130220845.917985-1-joel@jms.id.au Signed-off-by: Linus Walleij commit dd2f0a0a2f751b7aafaea5cbba8e65a55fd12f94 Author: Rae Moar Date: Fri Jan 27 20:39:50 2023 +0000 kunit: fix bug in KUNIT_EXPECT_MEMEQ In KUNIT_EXPECT_MEMEQ and KUNIT_EXPECT_MEMNEQ, add check if one of the inputs is NULL and fail if this is the case. Currently, the kernel crashes if one of the inputs is NULL. Instead, fail the test and add an appropriate error message. Fixes: b8a926bea8b1 ("kunit: Introduce KUNIT_EXPECT_MEMEQ and KUNIT_EXPECT_MEMNEQ macros") This was found by the kernel test robot: https://lore.kernel.org/all/202212191448.D6EDPdOh-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 47a2bd9d985bfdb55900f313603619fc9234f317 Author: Chaitanya Kumar Borah Date: Thu Jan 12 15:11:31 2023 +0530 drm/i915/adlp: Fix typo for reference clock Fix typo for reference clock from 24400 to 24000. Bspec: 55409 Fixes: 626426ff9ce4 ("drm/i915/adl_p: Add cdclk support for ADL-P") Reviewed-by: Matt Roper Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230112094131.550252-1-chaitanya.kumar.borah@intel.com (cherry picked from commit 2b6f7e39ccae065abfbe3b6e562ec95ccad09f1e) Signed-off-by: Rodrigo Vivi commit 7057a8f126f14f14b040faecfa220fd27c6c2f85 Author: Rob Clark Date: Fri Jan 27 12:05:31 2023 -0800 drm/i915: Fix potential bit_17 double-free A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask. (Or conversely leak memory on the transition to tiled.) Move allocation/free'ing of the bitmask within the section protected by the obj lock. Signed-off-by: Rob Clark Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") Cc: # v5.5+ [tursulin: Correct fixes tag and added cc stable.] Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230127200550.3531984-1-robdclark@gmail.com (cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e) Signed-off-by: Rodrigo Vivi commit 5bc4b43d5c6c9692ddc7b96116650cdf9406f3da Author: John Harrison Date: Thu Jan 26 16:28:37 2023 -0800 drm/i915: Fix up locking around dumping requests lists The debugfs dump of requests was confused about what state requires the execlist lock versus the GuC lock. There was also a bunch of duplicated messy code between it and the error capture code. So refactor the hung request search into a re-usable function. And reduce the span of the execlist state lock to only the execlist specific code paths. In order to do that, also move the report of hold count (which is an execlist only concept) from the top level dump function to the lower level execlist specific function. Also, move the execlist specific code into the execlist source file. v2: Rename some functions and move to more appropriate files (Daniele). v3: Rename new execlist dump function (Daniele) Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Acked-by: Tvrtko Ursulin Cc: Matthew Brost Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Matt Roper Cc: Umesh Nerlige Ramappa Cc: Michael Cheng Cc: Lucas De Marchi Cc: Bruce Chang Cc: Alan Previn Cc: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-4-John.C.Harrison@Intel.com (cherry picked from commit a4be3dca53172d9d2091e4b474fb795c81ed3d6c) Signed-off-by: Rodrigo Vivi commit 86d8ddc74124c3fdfc139f246ba6da15e45e86e3 Author: John Harrison Date: Thu Jan 26 16:28:36 2023 -0800 drm/i915: Fix request ref counting during error capture & debugfs dump When GuC support was added to error capture, the reference counting around the request object was broken. Fix it up. The context based search manages the spinlocking around the search internally. So it needs to grab the reference count internally as well. The execlist only request based search relies on external locking, so it needs an external reference count but within the spinlock not outside it. The only other caller of the context based search is the code for dumping engine state to debugfs. That code wasn't previously getting an explicit reference at all as it does everything while holding the execlist specific spinlock. So, that needs updaing as well as that spinlock doesn't help when using GuC submission. Rather than trying to conditionally get/put depending on submission model, just change it to always do the get/put. v2: Explicitly document adding an extra blank line in some dense code (Andy Shevchenko). Fix multiple potential null pointer derefs in case of no request found (some spotted by Tvrtko, but there was more!). Also fix a leaked request in case of !started and another in __guc_reset_context now that intel_context_find_active_request is actually reference counting the returned request. v3: Add a _get suffix to intel_context_find_active_request now that it grabs a reference (Daniele). v4: Split the intel_guc_find_hung_context change to a separate patch and rename intel_context_find_active_request_get to intel_context_get_active_request (Tvrtko). v5: s/locking/reference counting/ in commit message (Tvrtko) Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Fixes: 573ba126aef3 ("drm/i915/guc: Capture error state on context reset") Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Acked-by: Tvrtko Ursulin Cc: Matthew Brost Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Andrzej Hajda Cc: Matthew Auld Cc: Matt Roper Cc: Umesh Nerlige Ramappa Cc: Michael Cheng Cc: Lucas De Marchi Cc: Tejas Upadhyay Cc: Andy Shevchenko Cc: Aravind Iddamsetty Cc: Alan Previn Cc: Bruce Chang Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-3-John.C.Harrison@Intel.com (cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec) Signed-off-by: Rodrigo Vivi commit 87b04e53daf806945c415e94de9f90943d434aed Author: John Harrison Date: Thu Jan 26 16:28:35 2023 -0800 drm/i915/guc: Fix locking when searching for a hung request intel_guc_find_hung_context() was not acquiring the correct spinlock before searching the request list. So fix that up. While at it, add some extra whitespace padding for readability. Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Acked-by: Tvrtko Ursulin Cc: Matthew Brost Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Matt Roper Cc: Umesh Nerlige Ramappa Cc: Michael Cheng Cc: Lucas De Marchi Cc: Tejas Upadhyay Cc: Chris Wilson Cc: Bruce Chang Cc: Alan Previn Cc: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-2-John.C.Harrison@Intel.com (cherry picked from commit d1c3717501bcf56536e8b8c1bdaf5cd5357f6bb2) Signed-off-by: Rodrigo Vivi commit 41d419382ec7e257e54b7b6ff0d3623aafb1316d Author: Rob Clark Date: Thu Jan 19 09:32:58 2023 -0800 drm/i915: Avoid potential vm use-after-free Adding the vm to the vm_xa table makes it visible to userspace, which could try to race with us to close the vm. So we need to take our extra reference before putting it in the table. Signed-off-by: Rob Clark Reviewed-by: Matthew Auld Fixes: 9ec8795e7d91 ("drm/i915: Drop __rcu from gem_context->vm") Cc: # v5.16+ Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230119173321.2825472-1-robdclark@gmail.com (cherry picked from commit 99343c46d4e2b34c285d3d5f68ff04274c2f9fb4) Signed-off-by: Rodrigo Vivi commit 22b8077d0fcec86c6ed0e0fce9f7e7e5a4c2d56a Merge: 6d796c50f84ca 3288666c72568 Author: Linus Torvalds Date: Mon Jan 30 11:58:53 2023 -0800 Merge tag 'fscache-fixes-20230130' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache fixes from David Howells: "Fix two problems in fscache volume handling: - wake_up_bit() is incorrectly paired with wait_var_event(). The latter selects the waitqueue to use differently. - Missing barriers ordering between state bit and task state" * tag 'fscache-fixes-20230130' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work() fscache: Use wait_on_bit() to wait for the freeing of relinquished volume commit 8a74191c899efd3a0e942632f31dad0ea7eb4c7f Merge: a6e6ceb28a268 1febf88ef907b Author: Arnd Bergmann Date: Mon Jan 30 17:44:27 2023 +0100 Merge tag 'imx-fixes-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.2, round 2: - Update MAINTAINERS i.MX entry to match arm64 freescale DTS. - Drop misused 'uart-has-rtscts' from imx8m-venice boards. - Fix USB host over-current polarity for imx7d-smegw01 board. - Fix a typo in i.MX8DXL sc_pwrkey property name. - Fix GPIO watchdog property for i.MX8MM eDM SBC board. - Keep Ethernet PHY powered on imx8mm-verdin to avoid kernel crash. - Fix configuration of i.MX8MM pad UART1_DTE_RX. * tag 'imx-fixes-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx7d-smegw01: Fix USB host over-current polarity arm64: dts: imx8mm-verdin: Do not power down eth-phy MAINTAINERS: match freescale ARM64 DT directory in i.MX entry arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm: Reinstate GPIO watchdog always-running property on eDM SBC Link: https://lore.kernel.org/r/20230130003614.GP20713@T480 Signed-off-by: Arnd Bergmann commit a6e6ceb28a268a2a0ec9a2ebe4081ec1d1799228 Merge: d2591298b9ab5 f71eaf2708be7 Author: Arnd Bergmann Date: Mon Jan 30 17:43:41 2023 +0100 Merge tag 'sunxi-fixes-for-6.2-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes - Fix error handling in RSB init * tag 'sunxi-fixes-for-6.2-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Link: https://lore.kernel.org/r/Y9RWcDdO0nj98KVj@jernej-laptop Signed-off-by: Arnd Bergmann commit d2591298b9ab576b568f0c49d60a7f21d0c8d1e2 Author: Krzysztof Kozlowski Date: Fri Jan 27 11:59:35 2023 +0100 MAINTAINERS: amd: drop inactive Brijesh Singh Emails to Brijesh Singh bounce ("550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup"). Signed-off-by: Krzysztof Kozlowski Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20230127105935.99174-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 581e43ef5de6cc3369b2496362348e38bc85ded0 Author: Lorenzo Pieralisi Date: Mon Jan 30 11:08:50 2023 +0100 MAINTAINERS: Promote Krzysztof to PCI controller maintainer Krzysztof has contributed significantly to the PCI controller subsystem recently through reviews, tooling and submissions. Update the MAINTAINERS file to grant him the role he deserves. Link: https://lore.kernel.org/r/20230130100850.24994-1-lpieralisi@kernel.org Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Krzysztof Wilczyński commit 32e40f9506b9e32917eb73154f93037b443124d1 Author: Alexander Egorenkov Date: Fri Jan 27 14:52:42 2023 +0100 watchdog: diag288_wdt: fix __diag288() inline assembly The DIAG 288 statement consumes an EBCDIC string the address of which is passed in a register. Use a "memory" clobber to tell the compiler that memory is accessed within the inline assembly. Signed-off-by: Alexander Egorenkov Reviewed-by: Heiko Carstens Cc: Signed-off-by: Heiko Carstens commit fe8973a3ad0905cb9ba2d42db42ed51de14737df Author: Alexander Egorenkov Date: Fri Jan 27 14:52:41 2023 +0100 watchdog: diag288_wdt: do not use stack buffers for hardware data With CONFIG_VMAP_STACK=y the stack is allocated from the vmalloc space. Data passed to a hardware or a hypervisor interface that requires V=R can no longer be allocated on the stack. Use kmalloc() to get memory for a diag288 command. Signed-off-by: Alexander Egorenkov Reviewed-by: Heiko Carstens Cc: Signed-off-by: Heiko Carstens commit eebf82012dddbdcb09e4e49d3cdfafb93bc66eb2 Author: Hans de Goede Date: Sat Jan 28 00:57:23 2023 +0100 platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255 Reading the thinklight LED brightnes while the LED is on returns 255 (LED_FULL) but we advertise a max_brightness of 1, so this should be 1 (LED_ON). Fixes: db5e2a4ca0a7 ("platform/x86: thinkpad_acpi: Fix max_brightness of thinklight") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230127235723.412864-1-hdegoede@redhat.com commit abce209d18fd26e865b2406cc68819289db973f9 Author: Arnd Bergmann Date: Fri Jan 27 10:39:44 2023 +0100 platform/x86/amd: pmc: add CONFIG_SERIO dependency Using the serio subsystem now requires the code to be reachable: x86_64-linux-ld: drivers/platform/x86/amd/pmc.o: in function `amd_pmc_suspend_handler': pmc.c:(.text+0x86c): undefined reference to `serio_bus' Add the usual dependency: as other users of serio use 'select' rather than 'depends on', use the same here. Fixes: 8e60615e8932 ("platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230127093950.2368575-1-arnd@kernel.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e0c40529ff942a985eb0f3dacf18d35ee4dbb03d Author: Hans de Goede Date: Mon Jan 30 14:25:54 2023 +0100 platform/x86/amd/pmf: Ensure mutexes are initialized before use As soon as the first handler or sysfs file is registered the mutex may get used. Move the initialization to before any handler registration / sysfs file creation. Likewise move the destruction of the mutex to after all the de-initialization is done. Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230130132554.696025-1-hdegoede@redhat.com commit f21bf62290dd4d769594dcf0e6a688783d74f6a0 Author: Shyam Sundar S K Date: Wed Jan 25 15:29:36 2023 +0530 platform/x86/amd/pmf: Fix to update SPS thermals when power supply change Every power mode of static power slider has its own AC and DC power settings. When the power source changes from AC to DC, corresponding DC thermals were not updated from PMF config store and this leads the system to always run on AC power settings. Fix it by registering with power_supply notifier and apply DC settings upon getting notified by the power_supply handler. Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") Suggested-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230125095936.3292883-6-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 635f79bc73cf3d40c4198a20b3a0e7016dd6f0d3 Author: Shyam Sundar S K Date: Wed Jan 25 15:29:35 2023 +0530 platform/x86/amd/pmf: Fix to update SPS default pprof thermals By design PMF static slider will be set to BALANCED during init, but updating to corresponding thermal values from the PMF config store was missed, leading to improper settings getting propagated to PMFW. Fixes: 4c71ae414474 ("platform/x86/amd/pmf: Add support SPS PMF feature") Suggested-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230125095936.3292883-5-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3dfe28c936f87373a2b6ada750be4c52c0f249f3 Author: Shyam Sundar S K Date: Wed Jan 25 15:29:34 2023 +0530 platform/x86/amd/pmf: update to auto-mode limits only after AMT event Auto-mode thermal limits should be updated only after receiving the AMT event. But due to a bug in the older commit, these settings were getting applied during the auto-mode init. Fix this by removing amd_pmf_set_automode() during auto-mode initialization. Fixes: 3f5571d99524 ("platform/x86/amd/pmf: Add support for Auto mode feature") Suggested-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230125095936.3292883-4-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 16909aa8c9cc284085f1202c6403ecb9814af812 Author: Shyam Sundar S K Date: Wed Jan 25 15:29:33 2023 +0530 platform/x86/amd/pmf: Add helper routine to check pprof is balanced Add helper routine to check if the current platform profile is balanced mode and remove duplicate code occurrences. Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230125095936.3292883-3-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c5258d39fc4cbed37e20945715e7eb102f26d65b Author: Shyam Sundar S K Date: Wed Jan 25 15:29:32 2023 +0530 platform/x86/amd/pmf: Add helper routine to update SPS thermals Add helper routine to update the static slider information and remove the duplicate code occurrences after this change. Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230125095936.3292883-2-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 2036890282d56bcbf7f915ba9e04bf77967ab231 Author: Jack Yu Date: Mon Jan 30 02:43:25 2023 +0000 ASoC: rt715-sdca: fix clock stop prepare timeout issue Modify clock_stop_timeout value for rt715-sdca according to the requirement of internal clock trimming. Signed-off-by: Jack Yu Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com Signed-off-by: Mark Brown commit 3288666c72568fe1cc7f5c5ae33dfd3ab18004c8 Author: Hou Tao Date: Fri Jan 13 19:52:11 2023 +0800 fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work() fscache_create_volume_work() uses wake_up_bit() to wake up the processes which are waiting for the completion of volume creation. According to comments in wake_up_bit() and waitqueue_active(), an extra smp_mb() is needed to guarantee the memory order between FSCACHE_VOLUME_CREATING flag and waitqueue_active() before invoking wake_up_bit(). Fixing it by using clear_and_wake_up_bit() to add the missing memory barrier. Reviewed-by: Jingbo Xu Signed-off-by: Hou Tao Signed-off-by: David Howells Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/20230113115211.2895845-3-houtao@huaweicloud.com/ # v3 commit 8226e37d82f43657da34dd770e2b38f20242ada7 Author: Hou Tao Date: Fri Jan 13 19:52:10 2023 +0800 fscache: Use wait_on_bit() to wait for the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these two functions operate on different wait-queues. According to the implementation in fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20 seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted 6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: __schedule+0x2f6/0xb80 schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0 erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs] erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20 erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0 __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit() and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory barrier between cursor->flags and waitqueue_active(). Fixes: 62ab63352350 ("fscache: Implement volume registration") Reviewed-by: Jingbo Xu Signed-off-by: Hou Tao Signed-off-by: David Howells Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/20230113115211.2895845-2-houtao@huaweicloud.com/ # v3 commit 6028da3f125fec34425dbd5fec18e85d372b2af6 Author: Christian Hopps Date: Thu Jan 26 11:33:50 2023 -0500 xfrm: fix bug with DSCP copy to v6 from v4 tunnel When copying the DSCP bits for decap-dscp into IPv6 don't assume the outer encap is always IPv6. Instead, as with the inner IPv4 case, copy the DSCP bits from the correctly saved "tos" value in the control block. Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input") Signed-off-by: Christian Hopps Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit b7e08a5a63a11627601915473c3b569c1f6c6c06 Author: Yang Yingliang Date: Sun Jan 29 17:37:57 2023 +0800 RDMA/usnic: use iommu_map_atomic() under spin_lock() usnic_uiom_map_sorted_intervals() is called under spin_lock(), iommu_map() might sleep, use iommu_map_atomic() to avoid potential sleep in atomic context. Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20230129093757.637354-1-yangyingliang@huawei.com Signed-off-by: Leon Romanovsky commit 73a876022273cbc9c1db7869a54444ce8b9d085e Author: Colin Foster Date: Fri Jan 27 09:14:27 2023 -0800 net: phy: fix null dereference in phy_attach_direct Commit bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") introduced a link between net devices and phy devices. It fails to check whether dev is NULL, leading to a NULL dereference error. Fixes: bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") Signed-off-by: Colin Foster Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c28548012ee2bac55772ef7685138bd1124b80c3 Author: Nicholas Piggin Date: Sat Jan 21 20:01:56 2023 +1000 powerpc/64: Fix perf profiling asynchronous interrupt handlers Interrupt entry sets the soft mask to IRQS_ALL_DISABLED to match the hard irq disabled state. So when should_hard_irq_enable() returns true because we want PMI interrupts in irq handlers, MSR[EE] is enabled but PMIs just get soft-masked. Fix this by clearing IRQS_PMI_DISABLED before enabling MSR[EE]. This also tidies some of the warnings, no need to duplicate them in both should_hard_irq_enable() and do_hard_irq_enable(). Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230121100156.2824054-1-npiggin@gmail.com commit bc88ef663265676419555df2dc469a471c0add31 Author: Nicholas Piggin Date: Sat Jan 21 19:53:52 2023 +1000 powerpc/64s: Fix local irq disable when PMIs are disabled When PMI interrupts are soft-masked, local_irq_save() will clear the PMI mask bit, allowing PMIs in and causing a race condition. This causes a deadlock in native_hpte_insert via hash_preload, which depends on PMIs being disabled since commit 8b91cee5eadd ("powerpc/64s/hash: Make hash faults work in NMI context"). native_hpte_insert calls local_irq_save(). It's possible the lpar hash code is also affected when tracing is enabled because __trace_hcall_entry() calls local_irq_save(). Fix this by making arch_local_irq_save() _or_ the IRQS_DISABLED bit into the mask. This was found with the stress_hpt option with a kbuild workload running together with `perf record -g`. Fixes: f442d004806e ("powerpc/64s: Add support to mask perf interrupts and replay them") Fixes: 8b91cee5eadd ("powerpc/64s/hash: Make hash faults work in NMI context") Signed-off-by: Nicholas Piggin [mpe: Just take the fix without the new warning] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230121095352.2823517-1-npiggin@gmail.com commit 611792920925fb088ddccbe2783c7f92fdfb6b64 Author: Hyunwoo Kim Date: Thu Jan 26 18:32:50 2023 -0800 netrom: Fix use-after-free caused by accept on already connected socket If you call listen() and accept() on an already connect()ed AF_NETROM socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and nr_accept() dequeues the skb waiting in the sk->sk_receive_queue. As a result, nr_accept() allocates and returns a sock with the sk of the parent AF_NETROM socket. And here use-after-free can happen through complex race conditions: ``` cpu0 cpu1 1. socket_2 = socket(AF_NETROM) . . listen(socket_2) accepted_socket = accept(socket_2) 2. socket_1 = socket(AF_NETROM) nr_create() // sk refcount : 1 connect(socket_1) 3. write(accepted_socket) nr_sendmsg() nr_output() nr_kick() nr_send_iframe() nr_transmit_buffer() nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() nr_process_rx_frame(sk, skb); // sk : socket_1's sk nr_state3_machine() nr_queue_rx_frame() sock_queue_rcv_skb() sock_queue_rcv_skb_reason() __sock_queue_rcv_skb() __skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue 4. listen(socket_1) nr_listen() uaf_socket = accept(socket_1) nr_accept() skb_dequeue(&sk->sk_receive_queue); 5. close(accepted_socket) nr_release() nr_write_internal(sk, NR_DISCREQ) nr_transmit_buffer() // NR_DISCREQ nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() // sk : socket_1's sk nr_process_rx_frame() // NR_STATE_3 nr_state3_machine() // NR_DISCREQ nr_disconnect() nr_sk(sk)->state = NR_STATE_0; 6. close(socket_1) // sk refcount : 3 nr_release() // NR_STATE_0 sock_put(sk); // sk refcount : 0 sk_free(sk); close(uaf_socket) nr_release() sock_hold(sk); // UAF ``` KASAN report by syzbot: ``` BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520 Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:775 [inline] nr_release+0x66/0x460 net/netrom/af_netrom.c:520 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6c19e3c9b9 Code: Unable to access opcode bytes at 0x7f6c19e3c98f. RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9 RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006 RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0 R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_release+0x39e/0x460 net/netrom/af_netrom.c:554 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd ``` To fix this issue, nr_listen() returns -EINVAL for sockets that successfully nr_connect(). Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 54aa39a513dbf2164ca462a19f04519b2407a224 Author: Andrey Konovalov Date: Fri Jan 27 00:35:39 2023 +0300 net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC Currently in phy_init_eee() the driver unconditionally configures the PHY to stop RX_CLK after entering Rx LPI state. This causes an LPI interrupt storm on my qcs404-base board. Change the PHY initialization so that for "qcom,qcs404-ethqos" compatible device RX_CLK continues to run even in Rx LPI state. Signed-off-by: Andrey Konovalov Signed-off-by: David S. Miller commit fe6de81b610e5d0b9d2231acff2de74a35482e7d Author: Sathvika Vasireddy Date: Sat Jan 28 18:11:58 2023 +0530 powerpc/kvm: Fix unannotated intra-function call warning objtool throws the following warning: arch/powerpc/kvm/booke.o: warning: objtool: kvmppc_fill_pt_regs+0x30: unannotated intra-function call Fix the warning by setting the value of 'nip' using the _THIS_IP_ macro, without using an assembly bl/mflr sequence to save the instruction pointer. Reported-by: kernel test robot Suggested-by: Michael Ellerman Signed-off-by: Sathvika Vasireddy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230128124158.1066251-1-sv@linux.ibm.com commit 8afffce6aa3bddc940ac1909627ff1e772b6cbf1 Author: Sathvika Vasireddy Date: Sat Jan 28 18:11:38 2023 +0530 powerpc/85xx: Fix unannotated intra-function call warning objtool throws the following warning: arch/powerpc/kernel/head_85xx.o: warning: objtool: .head.text+0x1a6c: unannotated intra-function call Fix the warning by annotating KernelSPE symbol with SYM_FUNC_START_LOCAL and SYM_FUNC_END macros. Reported-by: kernel test robot Signed-off-by: Sathvika Vasireddy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230128124138.1066176-1-sv@linux.ibm.com commit b600de2d7d3a16f9007fad1bdae82a3951a26af2 Author: Yu Kuai Date: Mon Jan 30 09:41:36 2023 +0800 block, bfq: fix uaf for bfqq in bic_set_bfqq() After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), bic->bfqq will be accessed in bic_set_bfqq(), however, in some context bic->bfqq will be freed, and bic_set_bfqq() is called with the freed bic->bfqq. Fix the problem by always freeing bfqq after bic_set_bfqq(). Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") Reported-and-tested-by: Shinichiro Kawasaki Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230130014136.591038-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit b67b09733d8a41eec33d5d37be2f8cff8af82a5e Author: Krzysztof Kozlowski Date: Thu Jan 19 13:46:31 2023 +0100 arm64: dts: rockchip: align rk3399 DMC OPP table with bindings Bindings expect certain pattern for OPP table node name and underscores are not allowed: rk3399-rock-pi-4a-plus.dtb: dmc_opp_table: $nodename:0: 'dmc_opp_table' does not match '^opp-table(-[a-z0-9]+)?$' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230119124631.91080-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit bc121b707e816616567683e51fd9194c2309977a Author: Dan Johansen Date: Sat Jan 28 12:24:32 2023 +0100 arm64: dts: rockchip: set sdmmc0 speed to sd-uhs-sdr50 on rock-3a As other rk336x based devices, the Rock 3 Model A has issues with high speed SD cards, so lower the speed to 50 instead of 104 in the same manor has the Quartz64 Model B has. Fixes: 22a442e6586c ("arm64: dts: rockchip: add basic dts for the radxa rock3 model a") Signed-off-by: Dan Johansen Link: https://lore.kernel.org/r/20230128112432.132302-1-strit@manjaro.org Signed-off-by: Heiko Stuebner commit 6d796c50f84ca79f1722bb131799e5a5710c4700 Author: Linus Torvalds Date: Sun Jan 29 13:59:43 2023 -0800 Linux 6.2-rc6 commit ab072681eabe1ce0a9a32d4baa1a27a2d046bc4a Merge: bc6bc34b1095b ac8f29aef2f16 Author: Linus Torvalds Date: Sun Jan 29 11:26:49 2023 -0800 Merge tag 'irq_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Borislav Petkov: - Cleanup the firmware node for the new IRQ MSI domain properly, to avoid leaking memory * tag 'irq_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/msi: Free the fwnode created by msi_create_device_irq_domain() commit bc6bc34b1095b64840308fa0fc325c028bd9b89a Merge: 80826e9020afc 27b5de622ea3f Author: Linus Torvalds Date: Sun Jan 29 11:17:34 2023 -0800 Merge tag 'x86_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Start checking for -mindirect-branch-cs-prefix clang support too now that LLVM 16 will support it - Fix a NULL ptr deref when suspending with Xen PV - Have a SEV-SNP guest check explicitly for features enabled by the hypervisor and fail gracefully if some are unsupported by the guest instead of failing in a non-obvious and hard-to-debug way - Fix a MSI descriptor leakage under Xen - Mark Xen's MSI domain as supporting MSI-X - Prevent legacy PIC interrupts from being resent in software by marking them level triggered, as they should be, which lead to a NULL ptr deref * tag 'x86_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block acpi: Fix suspend with Xen PV x86/sev: Add SEV-SNP guest feature negotiation support x86/pci/xen: Fixup fallout from the PCI/MSI overhaul x86/pci/xen: Set MSI_FLAG_PCI_MSIX support in Xen MSI domain x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL commit 80826e9020afc7b8243df302a13521e0020fa9d8 Merge: 803929285af41 9c445d2637c93 Author: Linus Torvalds Date: Sun Jan 29 11:06:47 2023 -0800 Merge tag 'input-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - touchpads on HP 15-* laptops switched back to PS/2 emulation mode - a quirk for Clevo PCX0DX/TUXEDO XP1511 to make sure keyboard is responding after resume * tag 'input-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: i8042 - add Clevo PCX0DX to i8042 quirk table Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" commit 08ddbbdf0b55839ca93a12677a30a1ef24634969 Author: Ricardo Koller Date: Fri Jan 27 21:43:53 2023 +0000 KVM: selftests: aarch64: Test read-only PT memory regions Extend the read-only memslot tests in page_fault_test to test read-only PT (Page table) memslots. Note that this was not allowed before commit 406504c7b040 ("KVM: arm64: Fix S1PTW handling on RO memslots") as all S1PTW faults were treated as writes which resulted in an (unrecoverable) exception inside the guest. Signed-off-by: Ricardo Koller Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230127214353.245671-5-ricarkol@google.com commit 8b03c97fa6fd442b949b71aeb7545b970b968fe3 Author: Ricardo Koller Date: Fri Jan 27 21:43:52 2023 +0000 KVM: selftests: aarch64: Fix check of dirty log PT write The dirty log checks are mistakenly testing the first page in the page table (PT) memory region instead of the page holding the test data page PTE. This wasn't an issue before commit 406504c7b040 ("KVM: arm64: Fix S1PTW handling on RO memslots") as all PT pages (including the first page) were treated as writes. Fix the page_fault_test dirty logging tests by checking for the right page: the one for the PTE of the data test page. Fixes: a4edf25b3e25 ("KVM: selftests: aarch64: Add dirty logging tests into page_fault_test") Signed-off-by: Ricardo Koller Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230127214353.245671-4-ricarkol@google.com commit 42561751ea918d8f3f54412622735e1f887cb360 Author: Ricardo Koller Date: Fri Jan 27 21:43:51 2023 +0000 KVM: selftests: aarch64: Do not default to dirty PTE pages on all S1PTWs Only Stage1 Page table walks (S1PTW) trying to write into a PTE should result in the PTE page being dirty in the log. However, the dirty log tests in page_fault_test default to treat all S1PTW accesses as writes. Fix the relevant tests by asserting dirty pages only for S1PTW writes, which in these tests only applies to when Hardware management of the Access Flag is enabled. Signed-off-by: Ricardo Koller Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230127214353.245671-3-ricarkol@google.com commit 0dd8d22a887a473f6f11abf556c4f7944ab5ef1d Author: Ricardo Koller Date: Fri Jan 27 21:43:50 2023 +0000 KVM: selftests: aarch64: Relax userfaultfd read vs. write checks Only Stage1 Page table walks (S1PTW) writing a PTE on an unmapped page should result in a userfaultfd write. However, the userfaultfd tests in page_fault_test wrongly assert that any S1PTW is a PTE write. Fix this by relaxing the read vs. write checks in all userfaultfd handlers. Note that this is also an attempt to focus less on KVM (and userfaultfd) behavior, and more on architectural behavior. Also note that after commit 406504c7b040 ("KVM: arm64: Fix S1PTW handling on RO memslots"), the userfaultfd fault (S1PTW with AF on an unmaped PTE page) is actually a read: the translation fault that comes before the permission fault. Signed-off-by: Ricardo Koller Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230127214353.245671-2-ricarkol@google.com commit 803929285af4194d490d5652a64731d613e78b8b Merge: 95e7a450b8190 19398821b25a9 Author: Linus Torvalds Date: Sun Jan 29 10:47:22 2023 -0800 Merge tag 'cxl-fixes-for-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dan Williams: "A couple of fixes for bugs introduced during the merge window. One is a regression, the other was a bug in the CXL AER handler: - Fix a crash regression due to module load order of cxl_pmem.ko - Fix wrong register offset read in CXL AER handling path" * tag 'cxl-fixes-for-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/pmem: Fix nvdimm unregistration when cxl_pmem driver is absent cxl: fix cxl_report_and_clear() RAS UE addr mis-assignment commit 6028acbe3a5f2119a2a6ddd3e06453c87c09cae0 Author: Gavin Shan Date: Fri Jan 27 07:54:51 2023 +0800 KVM: arm64: Allow no running vcpu on saving vgic3 pending table We don't have a running VCPU context to save vgic3 pending table due to KVM_DEV_ARM_VGIC_{GRP_CTRL, SAVE_PENDING_TABLES} command on KVM device "kvm-arm-vgic-v3". The unknown case is caught by kvm-unit-tests. # ./kvm-unit-tests/tests/its-pending-migration WARNING: CPU: 120 PID: 7973 at arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3325 \ mark_page_dirty_in_slot+0x60/0xe0 : mark_page_dirty_in_slot+0x60/0xe0 __kvm_write_guest_page+0xcc/0x100 kvm_write_guest+0x7c/0xb0 vgic_v3_save_pending_tables+0x148/0x2a0 vgic_set_common_attr+0x158/0x240 vgic_v3_set_attr+0x4c/0x5c kvm_device_ioctl+0x100/0x160 __arm64_sys_ioctl+0xa8/0xf0 invoke_syscall.constprop.0+0x7c/0xd0 el0_svc_common.constprop.0+0x144/0x160 do_el0_svc+0x34/0x60 el0_svc+0x3c/0x1a0 el0t_64_sync_handler+0xb4/0x130 el0t_64_sync+0x178/0x17c Use vgic_write_guest_lock() to save vgic3 pending table. Reported-by: Zenghui Yu Signed-off-by: Gavin Shan Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230126235451.469087-5-gshan@redhat.com commit 2f8b1ad2228a7f1f1e2458864f4bfc1cbdf511ed Author: Gavin Shan Date: Fri Jan 27 07:54:50 2023 +0800 KVM: arm64: Allow no running vcpu on restoring vgic3 LPI pending status We don't have a running VCPU context to restore vgic3 LPI pending status due to command KVM_DEV_ARM_{VGIC_GRP_CTRL, ITS_RESTORE_TABLES} on KVM device "kvm-arm-vgic-its". Use vgic_write_guest_lock() to restore vgic3 LPI pending status. Signed-off-by: Gavin Shan Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230126235451.469087-4-gshan@redhat.com commit a23eaf9368aafa4defcc8904b20391b6ea07bb1e Author: Gavin Shan Date: Fri Jan 27 07:54:48 2023 +0800 KVM: arm64: Add helper vgic_write_guest_lock() Currently, the unknown no-running-vcpu sites are reported when a dirty page is tracked by mark_page_dirty_in_slot(). Until now, the only known no-running-vcpu site is saving vgic/its tables through KVM_DEV_ARM_{VGIC_GRP_CTRL, ITS_SAVE_TABLES} command on KVM device "kvm-arm-vgic-its". Unfortunately, there are more unknown sites to be handled and no-running-vcpu context will be allowed in these sites: (1) KVM_DEV_ARM_{VGIC_GRP_CTRL, ITS_RESTORE_TABLES} command on KVM device "kvm-arm-vgic-its" to restore vgic/its tables. The vgic3 LPI pending status could be restored. (2) Save vgic3 pending table through KVM_DEV_ARM_{VGIC_GRP_CTRL, VGIC_SAVE_PENDING_TABLES} command on KVM device "kvm-arm-vgic-v3". In order to handle those unknown cases, we need a unified helper vgic_write_guest_lock(). struct vgic_dist::save_its_tables_in_progress is also renamed to struct vgic_dist::save_tables_in_progress. No functional change intended. Suggested-by: Oliver Upton Signed-off-by: Gavin Shan Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230126235451.469087-3-gshan@redhat.com commit 95e7a450b8190673675836bfef236262ceff084a Author: Vlastimil Babka Date: Fri Jan 13 18:33:45 2023 +0100 Revert "mm/compaction: fix set skip in fast_find_migrateblock" This reverts commit 7efc3b7261030da79001c00d92bc3392fd6c664c. We have got openSUSE reports (Link 1) for 6.1 kernel with khugepaged stalling CPU for long periods of time. Investigation of tracepoint data shows that compaction is stuck in repeating fast_find_migrateblock() based migrate page isolation, and then fails to migrate all isolated pages. Commit 7efc3b726103 ("mm/compaction: fix set skip in fast_find_migrateblock") was suspected as it was merged in 6.1 and in theory can indeed remove a termination condition for fast_find_migrateblock() under certain conditions, as it removes a place that always marks a scanned pageblock from being re-scanned. There are other such places, but those can be skipped under certain conditions, which seems to match the tracepoint data. Testing of revert also appears to have resolved the issue, thus revert the commit until a more robust solution for the original problem is developed. It's also likely this will fix qemu stalls with 6.1 kernel reported in Link 2, but that is not yet confirmed. Link: https://bugzilla.suse.com/show_bug.cgi?id=1206848 Link: https://lore.kernel.org/kvm/b8017e09-f336-3035-8344-c549086c2340@kernel.org/ Link: https://lore.kernel.org/lkml/20230125134434.18017-1-mgorman@techsingularity.net/ Fixes: 7efc3b726103 ("mm/compaction: fix set skip in fast_find_migrateblock") Cc: Tested-by: Pedro Falcato Acked-by: Mel Gorman Signed-off-by: Vlastimil Babka Signed-off-by: Linus Torvalds commit 5d9745cead1f121974322b94ceadfb4d1e67960e Author: Nikita Zhandarovich Date: Thu Jan 26 10:52:30 2023 -0800 RDMA/irdma: Fix potential NULL-ptr-dereference in_dev_get() can return NULL which will cause a failure once idev is dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for NULL value in idev beforehand. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Nikita Zhandarovich Link: https://lore.kernel.org/r/20230126185230.62464-1-n.zhandarovich@fintech.ru Reviewed-by: Sindhu Devale Signed-off-by: Leon Romanovsky commit c91d713630848460de8669e6570307b7e559863b Author: Dan Williams Date: Wed Jan 25 12:23:46 2023 -0800 nvdimm: Support sizeof(struct page) > MAX_STRUCT_PAGE_SIZE Commit 6e9f05dc66f9 ("libnvdimm/pfn_dev: increase MAX_STRUCT_PAGE_SIZE") ...updated MAX_STRUCT_PAGE_SIZE to account for sizeof(struct page) potentially doubling in the case of CONFIG_KMSAN=y. Unfortunately this doubles the amount of capacity stolen from user addressable capacity for everyone, regardless of whether they are using the debug option. Revert that change, mandate that MAX_STRUCT_PAGE_SIZE never exceed 64, but allow for debug scenarios to proceed with creating debug sized page maps with a compile option to support debug scenarios. Note that this only applies to cases where the page map is permanent, i.e. stored in a reservation of the pmem itself ("--map=dev" in "ndctl create-namespace" terms). For the "--map=mem" case, since the allocation is ephemeral for the lifespan of the namespace, there are no explicit restriction. However, the implicit restriction, of having enough available "System RAM" to store the page map for the typically large pmem, still applies. Fixes: 6e9f05dc66f9 ("libnvdimm/pfn_dev: increase MAX_STRUCT_PAGE_SIZE") Cc: Cc: Alexander Potapenko Cc: Marco Elver Reported-by: Jeff Moyer Acked-by: Yu Zhao Link: https://lore.kernel.org/r/167467815773.463042.7022545814443036382.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit c96618275234ad03d44eafe9f8844305bb44fda4 Author: Linus Torvalds Date: Sat Jan 28 11:17:57 2023 -0800 Fix up more non-executable files marked executable Joe found another DT file that shouldn't be executable, and that frustrated me enough that I went hunting with this script: git ls-files -s | grep '^100755' | cut -f2 | xargs grep -L '^#!' and that found another file that shouldn't have been marked executable either, despite being in the scripts directory. Maybe these two are the last ones at least for now. But I'm sure we'll be back in a few years, fixing things up again. Fixes: 8c6789f4e2d4 ("ASoC: dt-bindings: Add Everest ES8326 audio CODEC") Fixes: 4d8e5cd233db ("locking/atomics: Fix scripts/atomic/ script permissions") Reported-by: Joe Perches Signed-off-by: Linus Torvalds commit 2543fdbd5cd3bb7d72a6c810b431ba17778a607d Merge: 5af6ce7049365 a34dc4a9b9e2f Author: Linus Torvalds Date: Sat Jan 28 10:52:51 2023 -0800 Merge tag '6.2-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: "Four smb3 server fixes, all also for stable: - fix for signing bug - fix to more strictly check packet length - add a max connections parm to limit simultaneous connections - fix error message flood that can occur with newer Samba xattr format" * tag '6.2-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: downgrade ndr version error message to debug ksmbd: limit pdu length size according to connection status ksmbd: do not sign response to session request for guest login ksmbd: add max connections parameter commit bf29ce87ba137307a4465c45be5bfe633ccf6074 Merge: 1ca7fca349316 60ce26d10e585 Author: Greg Kroah-Hartman Date: Sat Jan 28 19:18:37 2023 +0100 Merge tag 'fpga-for-6.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-linus Xy writes: FPGA Manager changes for 6.2-final stratix10-soc: - Zheng's change fixes return value check Intel m10 bmc secure update: - Ilpo's change fixes probe rollback All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-6.2 branch) Signed-off-by: Xu Yilun * tag 'fpga-for-6.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: m10bmc-sec: Fix probe rollback fpga: stratix10-soc: Fix return value check in s10_ops_write_init() commit a6efc42a86c0c87cfe2f1c3d1f09a4c9b13ba890 Author: Andrei Gherzan Date: Thu Jan 26 16:55:48 2023 +0000 selftest: net: Improve IPV6_TCLASS/IPV6_HOPLIMIT tests apparmor compatibility "tcpdump" is used to capture traffic in these tests while using a random, temporary and not suffixed file for it. This can interfere with apparmor configuration where the tool is only allowed to read from files with 'known' extensions. The MINE type application/vnd.tcpdump.pcap was registered with IANA for pcap files and .pcap is the extension that is both most common but also aligned with standard apparmor configurations. See TCPDUMP(8) for more details. This improves compatibility with standard apparmor configurations by using ".pcap" as the file extension for the tests' temporary files. Signed-off-by: Andrei Gherzan Signed-off-by: David S. Miller commit 1ca7fca349316231bbaa68d16f819a08d683c5a7 Author: Johan Hovold Date: Fri Jan 27 10:40:15 2023 +0000 nvmem: qcom-spmi-sdam: fix module autoloading Add the missing module device table so that the driver can be autoloaded when built as a module. Fixes: 40ce9798794f ("nvmem: add QTI SDAM driver") Cc: stable@vger.kernel.org # 5.6 Reviewed-by: Bjorn Andersson Signed-off-by: Johan Hovold Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-11-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 0c4862b1c1465e473bc961a02765490578bf5c20 Author: Russell King (Oracle) Date: Fri Jan 27 10:40:14 2023 +0000 nvmem: core: fix return value Dan Carpenter points out that the return code was not set in commit 60c8b4aebd8e ("nvmem: core: fix cleanup after dev_set_name()"), but this is not the only issue - we also need to zero wp_gpio to prevent gpiod_put() being called on an error value. Fixes: 560181d3ace6 ("nvmem: core: fix cleanup after dev_set_name()") Cc: stable@vger.kernel.org Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Russell King (Oracle) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-10-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e Author: Michael Walle Date: Fri Jan 27 10:40:13 2023 +0000 nvmem: core: fix cell removal on error nvmem_add_cells() could return an error after some cells are already added to the provider. In this case, the added cells are not removed. Remove any registered cells if nvmem_add_cells() fails. Fixes: fa72d847d68d7 ("nvmem: check the return value of nvmem_add_cells()") Cc: stable@vger.kernel.org Signed-off-by: Michael Walle Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-9-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit edcf2fb660526b5ed29f93bd17328a2b4835c8b2 Author: Michael Walle Date: Fri Jan 27 10:40:12 2023 +0000 nvmem: core: fix device node refcounting In of_nvmem_cell_get(), of_get_next_parent() is used on cell_np. This will decrement the refcount on cell_np, but cell_np is still used later in the code. Use of_get_parent() instead and of_node_put() in the appropriate places. Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers") Fixes: 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation") Cc: stable@vger.kernel.org Signed-off-by: Michael Walle Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-8-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit ab3428cfd9aa2f3463ee4b2909b5bb2193bd0c4a Author: Russell King (Oracle) Date: Fri Jan 27 10:40:11 2023 +0000 nvmem: core: fix registration vs use race The i.MX6 CPU frequency driver sometimes fails to register at boot time due to nvmem_cell_read_u32() sporadically returning -ENOENT. This happens because there is a window where __nvmem_device_get() in of_nvmem_cell_get() is able to return the nvmem device, but as cells have been setup, nvmem_find_cell_entry_by_node() returns NULL. The occurs because the nvmem core registration code violates one of the fundamental principles of kernel programming: do not publish data structures before their setup is complete. Fix this by making nvmem core code conform with this principle. Fixes: eace75cfdcf7 ("nvmem: Add a simple NVMEM framework for nvmem providers") Cc: stable@vger.kernel.org Signed-off-by: Russell King (Oracle) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-7-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 560181d3ace61825f4ca9dd3481d6c0ee6709fa8 Author: Russell King (Oracle) Date: Fri Jan 27 10:40:10 2023 +0000 nvmem: core: fix cleanup after dev_set_name() If dev_set_name() fails, we leak nvmem->wp_gpio as the cleanup does not put this. While a minimal fix for this would be to add the gpiod_put() call, we can do better if we split device_register(), and use the tested nvmem_release() cleanup code by initialising the device early, and putting the device. This results in a slightly larger fix, but results in clear code. Note: this patch depends on "nvmem: core: initialise nvmem->id early" and "nvmem: core: remove nvmem_config wp_gpio". Fixes: 5544e90c8126 ("nvmem: core: add error handling for dev_set_name") Cc: stable@vger.kernel.org Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Russell King (Oracle) [Srini: Fixed subject line and error code handing with wp_gpio while applying.] Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-6-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 569653f022a29a1a44ea9de5308b657228303fa5 Author: Russell King (Oracle) Date: Fri Jan 27 10:40:09 2023 +0000 nvmem: core: remove nvmem_config wp_gpio No one provides wp_gpio, so let's remove it to avoid issues with the nvmem core putting this gpio. Cc: stable@vger.kernel.org Signed-off-by: Russell King (Oracle) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-5-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3bd747c7ea13cb145f0d84444e00df928b0842d9 Author: Russell King (Oracle) Date: Fri Jan 27 10:40:08 2023 +0000 nvmem: core: initialise nvmem->id early The error path for wp_gpio attempts to free the IDA nvmem->id, but this has yet to be assigned, so will always be zero - leaking the ID allocated by ida_alloc(). Fix this by moving the initialisation of nvmem->id earlier. Fixes: f7d8d7dcd978 ("nvmem: fix memory leak in error path") Cc: stable@vger.kernel.org Signed-off-by: Russell King (Oracle) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-4-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit c151d5ed8e8fe0474bd61dce7f2076ca5916c683 Author: Samuel Holland Date: Fri Jan 27 10:40:07 2023 +0000 nvmem: sunxi_sid: Always use 32-bit MMIO reads The SID SRAM on at least some SoCs (A64 and D1) returns different values when read with bus cycles narrower than 32 bits. This is not immediately obvious, because memcpy_fromio() uses word-size accesses as long as enough data is being copied. The vendor driver always uses 32-bit MMIO reads, so do the same here. This is faster than the register-based method, which is currently used as a workaround on A64. And it fixes the values returned on D1, where the SRAM method was being used. The special case for the last word is needed to maintain .word_size == 1 for sysfs ABI compatibility, as noted previously in commit de2a3eaea552 ("nvmem: sunxi_sid: Optimize register read-out method"). Fixes: 07ae4fde9efa ("nvmem: sunxi_sid: Add support for D1 variant") Cc: stable@vger.kernel.org Tested-by: Heiko Stuebner Signed-off-by: Samuel Holland Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit b0576ade3aaf24b376ea1a4406ae138e2a22b0c0 Author: Jiasheng Jiang Date: Fri Jan 27 10:40:06 2023 +0000 nvmem: brcm_nvram: Add check for kzalloc Add the check for the return value of kzalloc in order to avoid NULL pointer dereference. Fixes: 6e977eaa8280 ("nvmem: brcm_nvram: parse NVRAM content into NVMEM cells") Cc: stable@vger.kernel.org Signed-off-by: Jiasheng Jiang Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230127104015.23839-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 906ad3c9bf66e3c6dd4ebe14a7af1b339a2afacf Merge: 60bd1d9008a50 e3d6d152a1cbd Author: David S. Miller Date: Sat Jan 28 13:20:21 2023 +0000 Merge branch 't7xx-pm-fixes' Kornel Dulęba says: ==================== net: wwan: t7xx: Fix Runtime PM implementation d10b3a695ba0 ("net: wwan: t7xx: Runtime PM") introduced support for Runtime PM for this driver, but due to a bug in the initialization logic the usage refcount would never reach 0, leaving the feature unused. This patchset addresses that, together with a bug found after runtime suspend was enabled. ==================== Signed-off-by: David S. Miller commit e3d6d152a1cbdee25f2e3962009a2751b54e2297 Author: Kornel Dulęba Date: Thu Jan 26 13:25:35 2023 +0000 net: wwan: t7xx: Fix Runtime PM initialization For PCI devices the Runtime PM refcount is incremented twice: 1. During device enumeration with a call to pm_runtime_forbid. 2. Just before a driver probe logic is called. Because of that in order to enable Runtime PM on a given device we have to call both pm_runtime_allow and pm_runtime_put_noidle, once it's ready to be runtime suspended. The former was missing causing the pm refcount to never reach 0. Fixes: d10b3a695ba0 ("net: wwan: t7xx: Runtime PM") Signed-off-by: Kornel Dulęba Signed-off-by: David S. Miller commit 364d0221f1788e5225006ba7a0026e5968431c29 Author: Kornel Dulęba Date: Thu Jan 26 13:25:34 2023 +0000 net: wwan: t7xx: Fix Runtime PM resume sequence Resume device before calling napi_schedule, instead of doing in the napi poll routine. Polling is done in softrq context. We can't call the PM resume logic from there as it's blocking and not irq safe. In order to make it work modify the interrupt handler to be run from irq handler thread. Fixes: 5545b7b9f294 ("net: wwan: t7xx: Add NAPI support") Signed-off-by: Kornel Dulęba Signed-off-by: David S. Miller commit 60bd1d9008a50cc78c4033a16a6f5d78210d481c Author: Jeremy Kerr Date: Thu Jan 26 14:45:51 2023 +0800 net: mctp: purge receive queues on sk destruction We may have pending skbs in the receive queue when the sk is being destroyed; add a destructor to purge the queue. MCTP doesn't use the error queue, so only the receive_queue is purged. Fixes: 833ef3b91de6 ("mctp: Populate socket implementation") Signed-off-by: Jeremy Kerr Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230126064551.464468-1-jk@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 422ae7d9c7221e8d4c8526d0f54106307d69d2dc Author: Andre Kalb Date: Wed Jan 25 19:23:26 2023 +0100 net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that. Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection") Signed-off-by: Andre Kalb Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/Y9FzniUhUtbaGKU7@pc6682 Signed-off-by: Jakub Kicinski commit 4f876bfdb731a320089c5a64f8fa15fbba14418c Merge: 53466ebdec614 e18c6da62edc7 Author: Takashi Iwai Date: Sat Jan 28 09:21:36 2023 +0100 Merge tag 'asoc-fix-v6.2-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.2 An unfortunately large batch of fixes here, the numbers amplified by several repeated fixes for patterns of bugs in multiple drivers. Most of this is in the x86 drivers which are very actively developed, the implementation of PCI shutdown is a fix for issues with spamming warnings into the logs with a leaked reference to the i915 driver. commit 29de68c2b32ce58d64dea496d281e25ad0f551bd Author: Natalia Petrova Date: Wed Jan 25 16:48:31 2023 +0300 net: qrtr: free memory on error path in radix_tree_insert() Function radix_tree_insert() returns errors if the node hasn't been initialized and added to the tree. "kfree(node)" and return value "NULL" of node_get() help to avoid using unclear node in other calls. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: # 5.7 Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Natalia Petrova Reviewed-by: Simon Horman Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20230125134831.8090-1-n.petrova@fintech.ru Signed-off-by: Jakub Kicinski commit 14caefcf9837a2be765a566005ad82cd0d2a429f Author: Hyunwoo Kim Date: Wed Jan 25 02:59:44 2023 -0800 net/rose: Fix to not accept on connected socket If you call listen() and accept() on an already connect()ed rose socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and rose_accept() dequeues the skb waiting in the sk->sk_receive_queue. This creates a child socket with the sk of the parent rose socket, which can cause confusion. Fix rose_listen() to return -EINVAL if the socket has already been successfully connected, and add lock_sock to prevent this issue. Signed-off-by: Hyunwoo Kim Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230125105944.GA133314@ubuntu Signed-off-by: Jakub Kicinski commit ffffd2454a7a1bc9f7242b12c4cc0b05c12692b4 Author: Íñigo Huguet Date: Wed Jan 25 15:35:13 2023 +0100 sfc: correctly advertise tunneled IPv6 segmentation Recent sfc NICs are TSO capable for some tunnel protocols. However, it was not working properly because the feature was not advertised in hw_enc_features, but in hw_features only. Setting up a GENEVE tunnel and using iperf3 to send IPv4 and IPv6 traffic to the tunnel show, with tcpdump, that the IPv4 packets still had ~64k size but the IPv6 ones had only ~1500 bytes (they had been segmented by software, not offloaded). With this patch segmentation is offloaded as expected and the traffic is correctly received at the other end. Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Acked-by: Martin Habets Link: https://lore.kernel.org/r/20230125143513.25841-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 0548c5f26a0fefa721b29be2bfff1c44f15b6d73 Merge: 7d2c89b325874 5416c9aea8323 Author: Jakub Kicinski Date: Fri Jan 27 23:32:02 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== bpf 2023-01-27 We've added 10 non-merge commits during the last 9 day(s) which contain a total of 10 files changed, 170 insertions(+), 59 deletions(-). The main changes are: 1) Fix preservation of register's parent/live fields when copying range-info, from Eduard Zingerman. 2) Fix an off-by-one bug in bpf_mem_cache_idx() to select the right cache, from Hou Tao. 3) Fix stack overflow from infinite recursion in sock_map_close(), from Jakub Sitnicki. 4) Fix missing btf_put() in register_btf_id_dtor_kfuncs()'s error path, from Jiri Olsa. 5) Fix a splat from bpf_setsockopt() via lsm_cgroup/socket_sock_rcv_skb, from Kui-Feng Lee. 6) Fix bpf_send_signal[_thread]() helpers to hold a reference on the task, from Yonghong Song. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix the kernel crash caused by bpf_setsockopt(). selftests/bpf: Cover listener cloning with progs attached to sockmap selftests/bpf: Pass BPF skeleton to sockmap_listen ops tests bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself bpf: Add missing btf_put to register_btf_id_dtor_kfuncs selftests/bpf: Verify copy_register_state() preserves parent/live fields bpf: Fix to preserve reg parent/live fields when copying range info bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers bpf: Fix off-by-one error in bpf_mem_cache_idx() ==================== Link: https://lore.kernel.org/r/20230127215820.4993-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 7d2c89b325874a35564db5630a459966afab04cc Author: Alexander Duyck Date: Thu Jan 26 11:06:59 2023 -0800 skb: Do mix page pool and page referenced frags in GRO GSO should not merge page pool recycled frames with standard reference counted frames. Traditionally this didn't occur, at least not often. However as we start looking at adding support for wireless adapters there becomes the potential to mix the two due to A-MSDU repartitioning frames in the receive path. There are possibly other places where this may have occurred however I suspect they must be few and far between as we have not seen this issue until now. Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool") Reported-by: Felix Fietkau Signed-off-by: Alexander Duyck Acked-by: Ilias Apalodimas Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/167475990764.1934330.11960904198087757911.stgit@localhost.localdomain Signed-off-by: Jakub Kicinski commit ff445b8397745ea94675162faa0e9b0079ca521d Author: Arınç ÜNAL Date: Thu Jan 26 22:01:11 2023 +0300 net: dsa: mt7530: fix tristate and help description Fix description for tristate and help sections which include inaccurate information. Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230126190110.9124-1-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit 3ac77ecd9a8356c11754def95d657df026c6c135 Merge: 28b4387f0ec08 a3191c4d86c5d Author: Jakub Kicinski Date: Fri Jan 27 22:28:01 2023 -0800 Merge branch 'net-xdp-execute-xdp_do_flush-before-napi_complete_done' Magnus Karlsson says: ==================== net: xdp: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found in [1]. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in [2]. The drivers have only been compile-tested since I do not own any of the HW below. So if you are a maintainer, it would be great if you could take a quick look to make sure I did not mess something up. Note that these were the drivers I found that violated the ordering by running a simple script and manually checking the ones that came up as potential offenders. But the script was not perfect in any way. There might still be offenders out there, since the script can generate false negatives. [1] https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com [2] https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ ==================== Link: https://lore.kernel.org/r/20230125074901.2737-1-magnus.karlsson@gmail.com Signed-off-by: Jakub Kicinski commit a3191c4d86c5d3bd35b00dfde6910b88391436a0 Author: Magnus Karlsson Date: Wed Jan 25 08:49:01 2023 +0100 dpaa2-eth: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found following the first link below. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in the second link below. Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support") Signed-off-by: Magnus Karlsson Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ Signed-off-by: Jakub Kicinski commit b534013798b77f81a36f36dafd59bab9de837619 Author: Magnus Karlsson Date: Wed Jan 25 08:49:00 2023 +0100 dpaa_eth: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found following the first link below. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in the second link below. Fixes: a1e031ffb422 ("dpaa_eth: add XDP_REDIRECT support") Signed-off-by: Magnus Karlsson Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ Acked-by: Camelia Groza Signed-off-by: Jakub Kicinski commit ad7e615f646c9b5b2cf655cdfb9d91a28db4f25a Author: Magnus Karlsson Date: Wed Jan 25 08:48:59 2023 +0100 virtio-net: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found following the first link below. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in the second link below. Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT") Signed-off-by: Magnus Karlsson Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ Acked-by: Michael S. Tsirkin Signed-off-by: Jakub Kicinski commit 12b5717990c81fc2f6f2aa9d53d960b916478d4f Author: Magnus Karlsson Date: Wed Jan 25 08:48:58 2023 +0100 lan966x: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found following the first link below. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in the second link below. Fixes: a825b611c7c1 ("net: lan966x: Add support for XDP_REDIRECT") Signed-off-by: Magnus Karlsson Acked-by: Toke Høiland-Jørgensen Acked-by: Steen Hegelund Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ Signed-off-by: Jakub Kicinski commit 2ccce20d51faa0178086163ccb6c84a099a87ab4 Author: Magnus Karlsson Date: Wed Jan 25 08:48:57 2023 +0100 qede: execute xdp_do_flush() before napi_complete_done() Make sure that xdp_do_flush() is always executed before napi_complete_done(). This is important for two reasons. First, a redirect to an XSKMAP assumes that a call to xdp_do_redirect() from napi context X on CPU Y will be followed by a xdp_do_flush() from the same napi context and CPU. This is not guaranteed if the napi_complete_done() is executed before xdp_do_flush(), as it tells the napi logic that it is fine to schedule napi context X on another CPU. Details from a production system triggering this bug using the veth driver can be found following the first link below. The second reason is that the XDP_REDIRECT logic in itself relies on being inside a single NAPI instance through to the xdp_do_flush() call for RCU protection of all in-kernel data structures. Details can be found in the second link below. Fixes: d1b25b79e162b ("qede: add .ndo_xdp_xmit() and XDP_REDIRECT support") Signed-off-by: Magnus Karlsson Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ Signed-off-by: Jakub Kicinski commit 5af6ce7049365952f7f023155234fe091693ead1 Merge: 90aaef4e35c4a b7ab9161cf5dd Author: Linus Torvalds Date: Fri Jan 27 17:41:47 2023 -0800 Merge tag '6.2-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fix from Steve French: "Fix for reconnect oops in smbdirect (RDMA), also is marked for stable" * tag '6.2-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix oops due to uncleared server->smbd_conn in reconnect commit 90aaef4e35c4a74b0f1593d06e39eda867ef13d3 Merge: f851453bf1955 db3ba974c2bc8 Author: Linus Torvalds Date: Fri Jan 27 16:16:57 2023 -0800 Merge tag 'block-6.2-2023-01-27' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Minor tweaks for this release: - NVMe pull request via Christoph: - Flush initial scan_work for async probe (Keith Busch) - Fix passthrough csi check (Keith Busch) - Fix nvme-fc initialization order (Ross Lagerwall) - Fix for tearing down non-started device in ublk (Ming)" * tag 'block-6.2-2023-01-27' of git://git.kernel.dk/linux: block: ublk: move ublk_chr_class destroying after devices are removed nvme: fix passthrough csi check nvme-pci: flush initial scan_work for async probe nvme-fc: fix initialization order commit f851453bf19554a42eb480b65436b9500c3cf392 Merge: 28cca23da7240 ef5c600adb1d9 Author: Linus Torvalds Date: Fri Jan 27 16:15:06 2023 -0800 Merge tag 'io_uring-6.2-2023-01-27' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Two small fixes for this release: - Sanitize how async prep is done for drain requests, so we ensure that it always gets done (Dylan) - A ring provided buffer recycling fix for multishot receive (me)" * tag 'io_uring-6.2-2023-01-27' of git://git.kernel.dk/linux: io_uring: always prep_async for drain requests io_uring/net: cache provided buffer group value for multishot receives commit 28cca23da7240df597240a492a7a7d4ce990026b Merge: d786f0fe5e549 be0d8f48ad97f Author: Linus Torvalds Date: Fri Jan 27 16:09:12 2023 -0800 Merge tag 'hardening-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Split slow memcpy tests into MEMCPY_SLOW_KUNIT_TEST - Reorganize gcc-plugin includes for GCC 13 - Silence bcache memcpy run-time false positive warnings * tag 'hardening-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: bcache: Silence memcpy() run-time false positive warnings gcc-plugins: Reorganize gimple includes for GCC 13 kunit: memcpy: Split slow memcpy tests into MEMCPY_SLOW_KUNIT_TEST commit d786f0fe5e5490682cc05dce6bea0b32964d5088 Merge: e6f2f6ac500c6 7802023341851 Author: Linus Torvalds Date: Fri Jan 27 16:03:32 2023 -0800 Merge tag 'trace-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix filter memory leak by calling ftrace_free_filter() - Initialize trace_printk() earlier so that ftrace_dump_on_oops shows data on early crashes. - Update the outdated instructions in scripts/tracing/ftrace-bisect.sh - Add lockdep_is_held() to fix lockdep warning - Add allocation failure check in create_hist_field() - Don't initialize pointer that gets set right away in enabled_monitors_write() - Update MAINTAINER entries - Fix help messages in Kconfigs - Fix kernel-doc header for update_preds() * tag 'trace-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Update MAINTAINERS file to add tree and mailing list rv: remove redundant initialization of pointer ptr ftrace: Maintain samples/ftrace tracing/filter: fix kernel-doc warnings lib: Kconfig: fix spellos trace_events_hist: add check for return value of 'create_hist_field' tracing/osnoise: Use built-in RCU list checking tracing: Kconfig: Fix spelling/grammar/punctuation ftrace/scripts: Update the instructions for ftrace-bisect.sh tracing: Make sure trace_printk() can output as soon as it can be used ftrace: Export ftrace_free_filter() to modules commit e6f2f6ac500c67164f6f6b47299aece579277c14 Merge: 37d0be6a7d7d6 0582d984793d3 Author: Linus Torvalds Date: Fri Jan 27 13:52:38 2023 -0800 Merge tag 'i2c-for-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A bunch of driver fixes with a tiny bit of new IDs" * tag 'i2c-for-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rk3x: fix a bunch of kernel-doc warnings i2c: axxia: use 'struct' for kernel-doc notation dt-bindings: i2c: renesas,rzv2m: Fix SoC specific string i2c: mxs: suppress probe-deferral error message i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU i2c: designware: Fix unbalanced suspended flag i2c: designware: use casting of u64 in clock multiplication to avoid overflow commit 37d0be6a7d7d6fede952c439f8d8b9d1df5c756f Merge: 4d1483a99e9cd 677d85e1a1ee6 Author: Linus Torvalds Date: Fri Jan 27 13:47:40 2023 -0800 Merge tag 'gpio-fixes-for-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix the -c option in the gpio-event-mode user-space example program - fix the irq number translation in gpio-ep93xx and make its irqchip immutable - add a missing spin_unlock in error path in gpio-mxc - fix a suspend breakage on System76 and Lenovo Gen2a introduced in GPIO ACPI * tag 'gpio-fixes-for-v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: tools: gpio: fix -c option of gpio-event-mon gpio: ep93xx: remove unused variable gpio: ep93xx: Make irqchip immutable gpio: ep93xx: Fix port F hwirq numbers in handler gpio: mxc: Unlock on error path in mxc_flip_edge() gpiolib-acpi: Don't set GPIOs for wakeup in S3 mode commit 4d1483a99e9cdf2775ae93c49982042a0a103c29 Merge: 0acffb235fbf5 4bb3d82a1820c Author: Linus Torvalds Date: Fri Jan 27 13:43:46 2023 -0800 Merge tag 'regulator-fix-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A fix for the DT binding documentation which dropped a property when being converted to YAML format causing spurious errors validating device trees for platforms using the device" * tag 'regulator-fix-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: dt-bindings: samsung,s2mps14: add lost samsung,ext-control-gpios commit 0acffb235fbf57f11a3da1098f9134825ac7c1c9 Merge: 76e26e3c6a49b 4f11ada10d0ad Author: Linus Torvalds Date: Fri Jan 27 13:39:30 2023 -0800 Merge tag 'ovl-fixes-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix two bugs, a recent one introduced in the last cycle, and an older one from v5.11" * tag 'ovl-fixes-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: fail on invalid uid/gid mapping at copy up ovl: fix tmpfile leak commit 76e26e3c6a49b368a6fd38e2da2b1b164470cc52 Merge: 04ad927cacc67 d23db89883962 Author: Linus Torvalds Date: Fri Jan 27 13:18:14 2023 -0800 Merge tag 'drm-fixes-2023-01-27' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Fairly small this week as well, i915 has a memory leak fix and some minor changes, and amdgpu has some MST fixes, and some other minor ones: drm: - DP MST kref fix - fb_helper: check return value i915: - Fix BSC default context for Meteor Lake - Fix selftest-scheduler's modify_type - memory leak fix amdgpu: - GC11.x fixes - SMU13.0.0 fix - Freesync video fix - DP MST fixes - build fix" * tag 'drm-fixes-2023-01-27' of git://anongit.freedesktop.org/drm/drm: amdgpu: fix build on non-DCN platforms. drm/amd/display: Fix timing not changning when freesync video is enabled drm/display/dp_mst: Correct the kref of port. drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD drm/amdgpu/display/mst: limit payload to be updated one by one drm/amdgpu/display/mst: Fix mst_state->pbn_div and slot count assignments drm/amdgpu: declare firmware for new MES 11.0.4 drm/amdgpu: enable imu firmware for GC 11.0.4 drm/amd/pm: add missing AllowIHInterrupt message mapping for SMU13.0.0 drm/amdgpu: remove unconditional trap enable on add gfx11 queues drm/fb-helper: Use a per-driver FB deferred I/O handler drm/fb-helper: Check fb_deferred_io_init() return value drm/i915/selftest: fix intel_selftest_modify_policy argument types drm/i915/mtl: Fix bcs default context drm/i915: Fix a memory leak with reused mmap_offset drm/drm_vma_manager: Add drm_vma_node_allow_once() commit 04ad927cacc678371ea9b187cd7e6eb71894b422 Merge: 274d2f8b0c032 e6b3086fddc00 Author: Linus Torvalds Date: Fri Jan 27 13:11:19 2023 -0800 Merge tag 'acpi-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Add ACPI backlight handling quirks for 3 machines (Hans de Goede)" * tag 'acpi-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Add backlight=native DMI quirk for Asus U46E ACPI: video: Add backlight=native DMI quirk for HP EliteBook 8460p ACPI: video: Add backlight=native DMI quirk for HP Pavilion g6-1d80nr commit 274d2f8b0c032ca3c1ae88194b75edd2669368b0 Merge: 0d1e013fd9246 acd7e9ee57c88 Author: Linus Torvalds Date: Fri Jan 27 13:01:36 2023 -0800 Merge tag 'thermal-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Add locking to the Intel int340x thermal control driver to prevent its thermal zone callbacks from racing with firmware-induced thermal trip point updates (Srinivas Pandruvada, Rafael Wysocki)" * tag 'thermal-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() thermal: intel: int340x: Protect trip temperature from concurrent updates commit 0d1e013fd9246fcf73a078999487ba47d1dd1bb9 Merge: db7c4673bbd30 a428eb4b99ab8 Author: Linus Torvalds Date: Fri Jan 27 12:56:45 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Will Deacon: - Fix event counting regression in Arm CMN PMU driver due to broken optimisation * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: Partially revert "perf/arm-cmn: Optimise DTC counter accesses" commit db7c4673bbd30e54e28a3274dd50fe6a5e28a8b8 Merge: e5eb2b22f0f4a c1d6105869464 Author: Linus Torvalds Date: Fri Jan 27 12:52:45 2023 -0800 Merge tag 'riscv-for-linus-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A few DT bindings fixes to more closely align the ISA string requirements between the bindings and the ISA manual. - A handful of build error/warning fixes. - A fix to move init_cpu_topology() later in the boot flow, so it can allocate memory. - The IRC channel is now in the MAINTAINERS file, so it's easier to find. * tag 'riscv-for-linus-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Move call to init_cpu_topology() to later initialization stage riscv/kprobe: Fix instruction simulation of JALR riscv: fix -Wundef warning for CONFIG_RISCV_BOOT_SPINWAIT MAINTAINERS: add an IRC entry for RISC-V RISC-V: fix compile error from deduplicated __ALTERNATIVE_CFG_2 dt-bindings: riscv: fix single letter canonical order dt-bindings: riscv: fix underscore requirement for multi-letter extensions commit e5eb2b22f0f4a1f0b98bc9b7efb352b0841a3bd2 Merge: 9f4d0bd24e6b4 2f62847cf6ae4 Author: Linus Torvalds Date: Fri Jan 27 12:49:00 2023 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - fix nommu assignment build warning - fix -Wundef preprocessor warning - reduce __thumb2__ definitions for crypto files that require it * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9287/1: Reduce __thumb2__ definition to crypto files that require it ARM: 9284/1: include from proc-macros.S to fix -Wundef warnings ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment commit 9f4d0bd24e6b42555c02e137763f12c106572e63 Merge: 83abd4d4c4be8 a49fb7218ed84 Author: Linus Torvalds Date: Fri Jan 27 12:41:09 2023 -0800 Merge tag 'linux-kselftest-fixes-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "A single fix to a amd-pstate test Makefile bug that deletes source files during make clean run" * tag 'linux-kselftest-fixes-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: amd-pstate: Don't delete source files via Makefile commit 53b9b77dcf48dad1c6111b0c0a7310b3f9364776 Author: Michal Wilczynski Date: Fri Nov 25 14:34:39 2022 +0100 ice: Fix broken link in ice NAPI doc Current link for NAPI documentation in ice driver doesn't work - it returns 404. Update the link to the working one. Signed-off-by: Michal Wilczynski Acked-by: Jesse Brandeburg Signed-off-by: Tony Nguyen commit a6a0974aae4209d039ba81226ded5246eea14961 Author: Dave Ertman Date: Tue Jan 24 09:19:43 2023 -0800 ice: Prevent set_channel from changing queues while RDMA active The PF controls the set of queues that the RDMA auxiliary_driver requests resources from. The set_channel command will alter that pool and trigger a reconfiguration of the VSI, which breaks RDMA functionality. Prevent set_channel from executing when RDMA driver bound to auxiliary device. Adding a locked variable to pass down the call chain to avoid double locking the device_lock. Fixes: 348048e724a0 ("ice: Implement iidc operations") Signed-off-by: Dave Ertman Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit eede42c9459b58b71edc99303dad65216a655810 Author: Bartosz Golaszewski Date: Mon Jan 16 15:41:49 2023 +0100 spi: spidev: fix a recursive locking error When calling spidev_message() from the one of the ioctl() callbacks, the spi_lock is already taken. When we then end up calling spidev_sync(), we get the following splat: [ 214.047619] [ 214.049198] ============================================ [ 214.054533] WARNING: possible recursive locking detected [ 214.059858] 6.2.0-rc3-0.0.0-devel+git.97ec4d559d93 #1 Not tainted [ 214.065969] -------------------------------------------- [ 214.071290] spidev_test/1454 is trying to acquire lock: [ 214.076530] c4925dbc (&spidev->spi_lock){+.+.}-{3:3}, at: spidev_ioctl+0x8e0/0xab8 [ 214.084164] [ 214.084164] but task is already holding lock: [ 214.090007] c4925dbc (&spidev->spi_lock){+.+.}-{3:3}, at: spidev_ioctl+0x44/0xab8 [ 214.097537] [ 214.097537] other info that might help us debug this: [ 214.104075] Possible unsafe locking scenario: [ 214.104075] [ 214.110004] CPU0 [ 214.112461] ---- [ 214.114916] lock(&spidev->spi_lock); [ 214.118687] lock(&spidev->spi_lock); [ 214.122457] [ 214.122457] *** DEADLOCK *** [ 214.122457] [ 214.128386] May be due to missing lock nesting notation [ 214.128386] [ 214.135183] 2 locks held by spidev_test/1454: [ 214.139553] #0: c4925dbc (&spidev->spi_lock){+.+.}-{3:3}, at: spidev_ioctl+0x44/0xab8 [ 214.147524] #1: c4925e14 (&spidev->buf_lock){+.+.}-{3:3}, at: spidev_ioctl+0x70/0xab8 [ 214.155493] [ 214.155493] stack backtrace: [ 214.159861] CPU: 0 PID: 1454 Comm: spidev_test Not tainted 6.2.0-rc3-0.0.0-devel+git.97ec4d559d93 #1 [ 214.169012] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 214.175555] unwind_backtrace from show_stack+0x10/0x14 [ 214.180819] show_stack from dump_stack_lvl+0x60/0x90 [ 214.185900] dump_stack_lvl from __lock_acquire+0x874/0x2858 [ 214.191584] __lock_acquire from lock_acquire+0xfc/0x378 [ 214.196918] lock_acquire from __mutex_lock+0x9c/0x8a8 [ 214.202083] __mutex_lock from mutex_lock_nested+0x1c/0x24 [ 214.207597] mutex_lock_nested from spidev_ioctl+0x8e0/0xab8 [ 214.213284] spidev_ioctl from sys_ioctl+0x4d0/0xe2c [ 214.218277] sys_ioctl from ret_fast_syscall+0x0/0x1c [ 214.223351] Exception stack(0xe75cdfa8 to 0xe75cdff0) [ 214.228422] dfa0: 00000000 00001000 00000003 40206b00 bee266e8 bee266e0 [ 214.236617] dfc0: 00000000 00001000 006a71a0 00000036 004c0040 004bfd18 00000000 00000003 [ 214.244809] dfe0: 00000036 bee266c8 b6f16dc5 b6e8e5f6 Fix it by introducing an unlocked variant of spidev_sync() and calling it from spidev_message() while other users who don't check the spidev->spi's existence keep on using the locking flavor. Reported-by: Francesco Dolcini Fixes: 1f4d2dd45b6e ("spi: spidev: fix a race condition when accessing spidev->spi") Signed-off-by: Bartosz Golaszewski Tested-by: Max Krummenacher Link: https://lore.kernel.org/r/20230116144149.305560-1-brgl@bgdev.pl Signed-off-by: Mark Brown commit c63b8fd14a7db719f8252038a790638728c4eb66 Author: Serge Semin Date: Fri Jan 13 21:59:42 2023 +0300 spi: dw: Fix wrong FIFO level setting for long xfers Due to using the u16 type in the min_t() macros the SPI transfer length will be cast to word before participating in the conditional statement implied by the macro. Thus if the transfer length is greater than 64KB the Tx/Rx FIFO threshold level value will be determined by the leftover of the truncated after the type-case length. In the worst case it will cause the dramatical performance drop due to the "Tx FIFO Empty" or "Rx FIFO Full" interrupts triggered on each xfer word sent/received to/from the bus. The problem can be easily fixed by specifying the unsigned int type in the min_t() macros thus preventing the possible data loss. Fixes: ea11370fffdf ("spi: dw: get TX level without an additional variable") Reported-by: Sergey Nazarov Signed-off-by: Serge Semin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230113185942.2516-1-Sergey.Semin@baikalelectronics.ru Signed-off-by: Mark Brown commit 4f11ada10d0ad3fd53e2bd67806351de63a4f9c3 Author: Miklos Szeredi Date: Tue Jan 24 16:41:18 2023 +0100 ovl: fail on invalid uid/gid mapping at copy up If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then copy-up should fail, just like it would fail if the mounter task was doing the copy using "cp -a". There's a corner case where the "cp -a" would succeed but copy up fail: if there's a mapping of the invalid uid/gid (65534 by default) in the user namespace. This is because stat(2) will return this value if the mapping doesn't exist in the current user_ns and "cp -a" will in turn be able to create a file with this uid/gid. This behavior would be inconsistent with POSIX ACL's, which return -1 for invalid uid/gid which result in a failed copy. For consistency and simplicity fail the copy of the st_uid/st_gid are invalid. Fixes: 459c7c565ac3 ("ovl: unprivieged mounts") Cc: # v5.11 Signed-off-by: Miklos Szeredi Reviewed-by: Christian Brauner Reviewed-by: Seth Forshee commit baabaa505563362b71f2637aedd7b807d270656c Author: Miklos Szeredi Date: Tue Jan 24 16:41:18 2023 +0100 ovl: fix tmpfile leak Missed an error cleanup. Reported-by: syzbot+fd749a7ea127a84e0ffd@syzkaller.appspotmail.com Fixes: 2b1a77461f16 ("ovl: use vfs_tmpfile_open() helper") Cc: # v6.1 Signed-off-by: Miklos Szeredi commit a9ad4d87aa263de36895402b66115a3a4b88bf1c Author: Qu Wenruo Date: Sat Jan 21 16:06:11 2023 +0800 btrfs: raid56: make error_bitmap update atomic In the rework of raid56 code, there is very limited concurrency in the endio context. Most of the work is done inside the sectors arrays, which different bios will never touch the same sector. But there is a concurrency here for error_bitmap. Both read and write endio functions need to touch them, and we can have multiple write bios touching the same error bitmap if they all hit some errors. Here we fix the unprotected bitmap operation by going set_bit() in a loop. Since we have a very small ceiling of the sectors (at most 16 sectors), such set_bit() in a loop should be very acceptable. Fixes: 2942a50dea74 ("btrfs: raid56: introduce btrfs_raid_bio::error_bitmap") Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 Author: David Sterba Date: Tue Jan 24 20:32:10 2023 +0100 btrfs: send: limit number of clones and allocated memory size The arg->clone_sources_count is u64 and can trigger a warning when a huge value is passed from user space and a huge array is allocated. Limit the allocated memory to 8MiB (can be increased if needed), which in turn limits the number of clone sources to 8M / sizeof(struct clone_root) = 8M / 40 = 209715. Real world number of clones is from tens to hundreds, so this is future proof. Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com Signed-off-by: David Sterba commit ef5c600adb1d985513d2b612cc90403a148ff287 Author: Dylan Yudaken Date: Fri Jan 27 02:59:11 2023 -0800 io_uring: always prep_async for drain requests Drain requests all go through io_drain_req, which has a quick exit in case there is nothing pending (ie the drain is not useful). In that case it can run the issue the request immediately. However for safety it queues it through task work. The problem is that in this case the request is run asynchronously, but the async work has not been prepared through io_req_prep_async. This has not been a problem up to now, as the task work always would run before returning to userspace, and so the user would not have a chance to race with it. However - with IORING_SETUP_DEFER_TASKRUN - this is no longer the case and the work might be defered, giving userspace a chance to change data being referred to in the request. Instead _always_ prep_async for drain requests, which is simpler anyway and removes this issue. Cc: stable@vger.kernel.org Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20230127105911.2420061-1-dylany@meta.com Signed-off-by: Jens Axboe commit d2ceea0eb6e17bb37d8b85cb4c16797c0d683d1c Author: Danilo Krummrich Date: Thu Jan 26 01:28:44 2023 +0100 dma-buf: actually set signaling bit for private stub fences In dma_fence_allocate_private_stub() set the signaling bit of the newly allocated private stub fence rather than the signaling bit of the shared dma_fence_stub. Cc: # v6.1 Fixes: c85d00d4fd8b ("dma-buf: set signaling bit for the stub fence") Reviewed-by: Christian König Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20230126002844.339593-1-dakr@redhat.com commit 677d85e1a1ee69fa05ccea83847309484be3781c Author: Ivo Borisov Shopov Date: Thu Jan 26 15:10:33 2023 +0200 tools: gpio: fix -c option of gpio-event-mon Following line should listen for a rising edge and exit after the first one since '-c 1' is provided. # gpio-event-mon -n gpiochip1 -o 0 -r -c 1 It works with kernel 4.19 but it doesn't work with 5.10. In 5.10 the above command doesn't exit after the first rising edge it keep listening for an event forever. The '-c 1' is not taken into an account. The problem is in commit 62757c32d5db ("tools: gpio: add multi-line monitoring to gpio-event-mon"). Before this commit the iterator 'i' in monitor_device() is used for counting of the events (loops). In the case of the above command (-c 1) we should start from 0 and increment 'i' only ones and hit the 'break' statement and exit the process. But after the above commit counting doesn't start from 0, it start from 1 when we listen on one line. It is because 'i' is used from one more purpose, counting of lines (num_lines) and it isn't restore to 0 after following code for (i = 0; i < num_lines; i++) gpiotools_set_bit(&values.mask, i); Restore the initial value of the iterator to 0 in order to allow counting of loops to work for any cases. Fixes: 62757c32d5db ("tools: gpio: add multi-line monitoring to gpio-event-mon") Signed-off-by: Ivo Borisov Shopov Reviewed-by: Andy Shevchenko [Bartosz: tweak the commit message] Signed-off-by: Bartosz Golaszewski commit b710ef411048cdbd0fb279b9529af2731fe97022 Author: Arnd Bergmann Date: Fri Jan 27 10:35:05 2023 +0100 gpio: ep93xx: remove unused variable This one was left behind by a previous cleanup patch: drivers/gpio/gpio-ep93xx.c: In function 'ep93xx_gpio_add_bank': drivers/gpio/gpio-ep93xx.c:366:34: error: unused variable 'ic' [-Werror=unused-variable] Fixes: 216f37366e86 ("gpio: ep93xx: Make irqchip immutable") Signed-off-by: Arnd Bergmann Signed-off-by: Bartosz Golaszewski commit d2d73e6d4822140445ad4a7b1c6091e0f5fe703b Author: Maxim Korotkov Date: Fri Nov 18 13:43:32 2022 +0300 pinctrl: single: fix potential NULL dereference Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 571aec4df5b7 ("pinctrl: single: Use generic pinmux helpers for managing functions") Signed-off-by: Maxim Korotkov Reviewed-by: Tony Lindgren Link: https://lore.kernel.org/r/20221118104332.943-1-korotkov.maxim.s@gmail.com Signed-off-by: Linus Walleij commit c6e0679b8381bf03315e6660cf5370f916c1a1c6 Author: Mario Limonciello Date: Sat Jan 21 07:48:10 2023 -0600 pinctrl: amd: Fix debug output for debounce time If one GPIO has debounce enabled but future GPIOs in the list don't have debounce the time never gets reset and shows wrong value. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230121134812.16637-2-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 287a344a11f1ebd31055cf9b22c88d7005f108d7 Author: Joel Stanley Date: Fri Jan 20 09:48:56 2023 +1030 pinctrl: aspeed: Fix confusing types in return value The function signature is int, but we return a bool. Instead return a negative errno as the kerneldoc suggests. Fixes: 4d3d0e4272d8 ("pinctrl: Add core support for Aspeed SoCs") Signed-off-by: Joel Stanley Reviewed-by: Andrew Jeffery Link: https://lore.kernel.org/r/20230119231856.52014-1-joel@jms.id.au Signed-off-by: Linus Walleij commit 6b04456e248761cf68f562f2fd7c04e591fcac94 Author: Tanmay Bhushan <007047221b@gmail.com> Date: Tue Dec 27 22:02:16 2022 +0100 vdpa: ifcvf: Do proper cleanup if IFCVF init fails ifcvf_mgmt_dev leaks memory if it is not freed before returning. Call is made to correct return statement so memory does not leak. ifcvf_init_hw does not take care of this so it is needed to do it here. Signed-off-by: Tanmay Bhushan <007047221b@gmail.com> Message-Id: <772e9fe133f21fa78fb98a2ebe8969efbbd58e3c.camel@gmail.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Zhu Lingshan commit 6dd88fd59da84631b5fe5c8176931c38cfa3b265 Author: Jason Wang Date: Thu Jan 19 15:36:47 2023 +0800 vhost-scsi: unbreak any layout for response Al Viro said: """ Since "vhost/scsi: fix reuse of &vq->iov[out] in response" we have this: cmd->tvc_resp_iov = vq->iov[vc.out]; cmd->tvc_in_iovs = vc.in; combined with iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov, cmd->tvc_in_iovs, sizeof(v_rsp)); in vhost_scsi_complete_cmd_work(). We used to have ->tvc_resp_iov _pointing_ to vq->iov[vc.out]; back then iov_iter_init() asked to set an iovec-backed iov_iter over the tail of vq->iov[], with length being the amount of iovecs in the tail. Now we have a copy of one element of that array. Fortunately, the members following it in the containing structure are two non-NULL kernel pointers, so copy_to_iter() will not copy anything beyond the first iovec - kernel pointer is not (on the majority of architectures) going to be accepted by access_ok() in copyout() and it won't be skipped since the "length" (in reality - another non-NULL kernel pointer) won't be zero. So it's not going to give a guest-to-qemu escalation, but it's definitely a bug. Frankly, my preference would be to verify that the very first iovec is long enough to hold rsp_size. Due to the above, any users that try to give us vq->iov[vc.out].iov_len < sizeof(struct virtio_scsi_cmd_resp) would currently get a failure in vhost_scsi_complete_cmd_work() anyway. """ However, the spec doesn't say anything about the legacy descriptor layout for the respone. So this patch tries to not assume the response to reside in a single separate descriptor which is what commit 79c14141a487 ("vhost/scsi: Convert completion path to use") tries to achieve towards to ANY_LAYOUT. This is done by allocating and using dedicate resp iov in the command. To be safety, start with UIO_MAXIOV to be consistent with the limitation that we advertise to the vhost_get_vq_desc(). Testing with the hacked virtio-scsi driver that use 1 descriptor for 1 byte in the response. Reported-by: Al Viro Cc: Benjamin Coddington Cc: Nicholas Bellinger Fixes: a77ec83a5789 ("vhost/scsi: fix reuse of &vq->iov[out] in response") Signed-off-by: Jason Wang Message-Id: <20230119073647.76467-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit 3f7b75abf41cc4143aa295f62acbb060a012868d Author: Shunsuke Mie Date: Tue Jan 10 12:43:10 2023 +0900 tools/virtio: fix the vringh test for virtio ring changes Fix the build caused by missing kmsan_handle_dma() and is_power_of_2() that are used in drivers/virtio/virtio_ring.c. Signed-off-by: Shunsuke Mie Message-Id: <20230110034310.779744-1-mie@igel.co.jp> Signed-off-by: Michael S. Tsirkin commit 9526f9a2b762af16be94a72aca5d65c677d28f50 Author: Eric Auger Date: Tue Jan 17 10:15:18 2023 -0500 vhost/net: Clear the pending messages when the backend is removed When the vhost iotlb is used along with a guest virtual iommu and the guest gets rebooted, some MISS messages may have been recorded just before the reboot and spuriously executed by the virtual iommu after the reboot. As vhost does not have any explicit reset user API, VHOST_NET_SET_BACKEND looks a reasonable point where to clear the pending messages, in case the backend is removed. Export vhost_clear_msg() and call it in vhost_net_set_backend() when fd == -1. Signed-off-by: Eric Auger Suggested-by: Jason Wang Fixes: 6b1e6cc7855b0 ("vhost: new device IOTLB API") Message-Id: <20230117151518.44725-3-eric.auger@redhat.com> Signed-off-by: Michael S. Tsirkin commit 0a9e5794b21e2d1303759ff8fe5f9215db7757ba Author: Eric Dumazet Date: Thu Jan 26 11:21:30 2023 +0000 xfrm: annotate data-race around use_time KCSAN reported multiple cpus can update use_time at the same time. Adds READ_ONCE()/WRITE_ONCE() annotations. Note that 32bit arches are not fully protected, but they will probably no longer be supported/used in 2106. BUG: KCSAN: data-race in __xfrm_policy_check / __xfrm_policy_check write to 0xffff88813e7ec108 of 8 bytes by interrupt on cpu 0: __xfrm_policy_check+0x6ae/0x17f0 net/xfrm/xfrm_policy.c:3664 __xfrm_policy_check2 include/net/xfrm.h:1174 [inline] xfrm_policy_check include/net/xfrm.h:1179 [inline] xfrm6_policy_check+0x2e9/0x320 include/net/xfrm.h:1189 udpv6_queue_rcv_one_skb+0x48/0xa30 net/ipv6/udp.c:703 udpv6_queue_rcv_skb+0x2d6/0x310 net/ipv6/udp.c:792 udp6_unicast_rcv_skb+0x16b/0x190 net/ipv6/udp.c:935 __udp6_lib_rcv+0x84b/0x9b0 net/ipv6/udp.c:1020 udpv6_rcv+0x4b/0x50 net/ipv6/udp.c:1133 ip6_protocol_deliver_rcu+0x99e/0x1020 net/ipv6/ip6_input.c:439 ip6_input_finish net/ipv6/ip6_input.c:484 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ip6_input+0xca/0x180 net/ipv6/ip6_input.c:493 dst_input include/net/dst.h:454 [inline] ip6_rcv_finish+0x1e9/0x2d0 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:302 [inline] ipv6_rcv+0x85/0x140 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core net/core/dev.c:5482 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5596 process_backlog+0x23f/0x3b0 net/core/dev.c:5924 __napi_poll+0x65/0x390 net/core/dev.c:6485 napi_poll net/core/dev.c:6552 [inline] net_rx_action+0x37e/0x730 net/core/dev.c:6663 __do_softirq+0xf2/0x2c7 kernel/softirq.c:571 do_softirq+0xb1/0xf0 kernel/softirq.c:472 __local_bh_enable_ip+0x6f/0x80 kernel/softirq.c:396 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:257 [inline] _raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:284 wg_socket_send_skb_to_peer+0x107/0x120 drivers/net/wireguard/socket.c:184 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline] wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 write to 0xffff88813e7ec108 of 8 bytes by interrupt on cpu 1: __xfrm_policy_check+0x6ae/0x17f0 net/xfrm/xfrm_policy.c:3664 __xfrm_policy_check2 include/net/xfrm.h:1174 [inline] xfrm_policy_check include/net/xfrm.h:1179 [inline] xfrm6_policy_check+0x2e9/0x320 include/net/xfrm.h:1189 udpv6_queue_rcv_one_skb+0x48/0xa30 net/ipv6/udp.c:703 udpv6_queue_rcv_skb+0x2d6/0x310 net/ipv6/udp.c:792 udp6_unicast_rcv_skb+0x16b/0x190 net/ipv6/udp.c:935 __udp6_lib_rcv+0x84b/0x9b0 net/ipv6/udp.c:1020 udpv6_rcv+0x4b/0x50 net/ipv6/udp.c:1133 ip6_protocol_deliver_rcu+0x99e/0x1020 net/ipv6/ip6_input.c:439 ip6_input_finish net/ipv6/ip6_input.c:484 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ip6_input+0xca/0x180 net/ipv6/ip6_input.c:493 dst_input include/net/dst.h:454 [inline] ip6_rcv_finish+0x1e9/0x2d0 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:302 [inline] ipv6_rcv+0x85/0x140 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core net/core/dev.c:5482 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5596 process_backlog+0x23f/0x3b0 net/core/dev.c:5924 __napi_poll+0x65/0x390 net/core/dev.c:6485 napi_poll net/core/dev.c:6552 [inline] net_rx_action+0x37e/0x730 net/core/dev.c:6663 __do_softirq+0xf2/0x2c7 kernel/softirq.c:571 do_softirq+0xb1/0xf0 kernel/softirq.c:472 __local_bh_enable_ip+0x6f/0x80 kernel/softirq.c:396 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:257 [inline] _raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:284 wg_socket_send_skb_to_peer+0x107/0x120 drivers/net/wireguard/socket.c:184 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline] wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0000000063c62d6f -> 0x0000000063c62d70 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 4185 Comm: kworker/1:2 Tainted: G W 6.2.0-rc4-syzkaller-00009-gd532dd102151-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: wg-crypt-wg0 wg_packet_tx_worker Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Steffen Klassert Cc: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Steffen Klassert commit 195e4aac74ce67385f95432301da6db3c2cfc72a Author: Eric Dumazet Date: Thu Jan 26 11:21:29 2023 +0000 xfrm: consistently use time64_t in xfrm_timer_handler() For some reason, blamed commit did the right thing in xfrm_policy_timer() but did not in xfrm_timer_handler() Fixes: 386c5680e2e8 ("xfrm: use time64_t for in-kernel timestamps") Signed-off-by: Eric Dumazet Cc: Arnd Bergmann Cc: Steffen Klassert Acked-by: Arnd Bergmann Signed-off-by: Steffen Klassert commit 53466ebdec614f915c691809b0861acecb941e30 Author: Takashi Iwai Date: Wed Jan 25 16:31:04 2023 +0100 ALSA: memalloc: Workaround for Xen PV We change recently the memalloc helper to use dma_alloc_noncontiguous() and the fallback to get_pages(). Although lots of issues with IOMMU (or non-IOMMU) have been addressed, but there seems still a regression on Xen PV. Interestingly, the only proper way to work is use dma_alloc_coherent(). The use of dma_alloc_coherent() for SG buffer was dropped as it's problematic on IOMMU systems. OTOH, Xen PV has a different way, and it's fine to use the dma_alloc_coherent(). This patch is a workaround for Xen PV. It consists of the following changes: - For Xen PV, use only the fallback allocation without dma_alloc_noncontiguous() - In the fallback allocation, use dma_alloc_coherent(); the DMA address from dma_alloc_coherent() is returned in get_addr ops - The DMA addresses are stored in an array; the first entry stores the number of allocated pages in lower bits, which are referred at releasing pages again Reported-by: Marek Marczykowski-Górecki Tested-by: Marek Marczykowski-Górecki Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again") Fixes: 9736a325137b ("ALSA: memalloc: Don't fall back for SG-buffer with IOMMU") Link: https://lore.kernel.org/r/87tu256lqs.wl-tiwai@suse.de Link: https://lore.kernel.org/r/20230125153104.5527-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5416c9aea8323583e8696f0500b6142dfae80821 Author: Kui-Feng Lee Date: Thu Jan 26 16:17:32 2023 -0800 bpf: Fix the kernel crash caused by bpf_setsockopt(). The kernel crash was caused by a BPF program attached to the "lsm_cgroup/socket_sock_rcv_skb" hook, which performed a call to `bpf_setsockopt()` in order to set the TCP_NODELAY flag as an example. Flags like TCP_NODELAY can prompt the kernel to flush a socket's outgoing queue, and this hook "lsm_cgroup/socket_sock_rcv_skb" is frequently triggered by softirqs. The issue was that in certain circumstances, when `tcp_write_xmit()` was called to flush the queue, it would also allow BH (bottom-half) to run. This could lead to our program attempting to flush the same socket recursively, which caused a `skbuff` to be unlinked twice. `security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs before the sock ownership is checked in `tcp_v4_rcv()`. Consequently, if a bpf program runs on `security_sock_rcv_skb()` while under softirq conditions, it may not possess the lock needed for `bpf_setsockopt()`, thus presenting an issue. The patch fixes this issue by ensuring that a BPF program attached to the "lsm_cgroup/socket_sock_rcv_skb" hook is not allowed to call `bpf_setsockopt()`. The differences from v1 are - changing commit log to explain holding the lock of the sock, - emphasizing that TCP_NODELAY is not the only flag, and - adding the fixes tag. v1: https://lore.kernel.org/bpf/20230125000244.1109228-1-kuifeng@meta.com/ Signed-off-by: Kui-Feng Lee Fixes: 9113d7e48e91 ("bpf: expose bpf_{g,s}etsockopt to lsm cgroup") Link: https://lore.kernel.org/r/20230127001732.4162630-1-kuifeng@meta.com Signed-off-by: Martin KaFai Lau commit 15600159bcc6abbeae6b33a849bef90dca28b78f Author: Martin K. Petersen Date: Thu Jan 26 22:06:08 2023 -0500 scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" This reverts commit 948e922fc44611ee2de0c89583ca958cb5307d36. Not all targets that return PQ=1 and PDT=0 should be ignored. While the SCSI spec is vague in this department, there appears to be a critical mass of devices which rely on devices being accessible with this combination of reported values. Fixes: 948e922fc446 ("scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT") Link: https://lore.kernel.org/r/yq1lelrleqr.fsf@ca-mkp.ca.oracle.com Acked-by: Bart Van Assche Acked-by: Martin Wilck Acked-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 2542fc9578d49b3b376231269d4c7c7d4cffd62a Author: Bart Van Assche Date: Wed Jan 25 11:43:11 2023 -0800 scsi: core: Fix the scsi_device_put() might_sleep annotation Although most calls of scsi_device_put() happen from non-atomic context, alua_rtpg_queue() calls this function from atomic context if alua_rtpg_queue() itself is called from atomic context. alua_rtpg_queue() is always called from contexts where the caller must hold at least one reference to the scsi device in question. This means that the reference taken by alua_rtpg_queue() itself can't be the last one, and thus can be dropped without entering the code path in which scsi_device_put() might actually sleep. Hence move the might_sleep() annotation from scsi_device_put() into scsi_device_dev_release(). [1] https://lore.kernel.org/linux-scsi/b49e37d5-edfb-4c56-3eeb-62c7d5855c00@linux.ibm.com/ [2] https://lore.kernel.org/linux-scsi/55c35e64-a7d4-9072-46fd-e8eae6a90e96@linux.ibm.com/ Note: a significant part of the above description was written by Martin Wilck. Fixes: f93ed747e2c7 ("scsi: core: Release SCSI devices synchronously") Cc: Martin Wilck Cc: Steffen Maier Cc: Hannes Reinecke Cc: Sachin Sant Cc: Benjamin Block Reported-by: Steffen Maier Signed-off-by: Bart Van Assche Reviewed-by: Martin Wilck Link: https://lore.kernel.org/r/20230125194311.249553-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit d23db89883962d9b4cb3ad03dfd02e525ed2cc03 Merge: f439a959dcfb6 d6591da5f3ff2 Author: Dave Airlie Date: Fri Jan 27 12:31:02 2023 +1000 Merge tag 'drm-misc-fixes-2023-01-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A fix and a preliminary patch to fix a memory leak in i915, and a use after free fix for fbdev deferred io Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230126104018.cbrcjxl5wefdbb2f@houat commit f439a959dcfb6b39d6fd4b85ca1110a1d1de1587 Author: Dave Airlie Date: Fri Jan 27 12:15:13 2023 +1000 amdgpu: fix build on non-DCN platforms. This fixes the build here locally on my 32-bit arm build. Signed-off-by: Dave Airlie commit 1d65bd6b6f6f1e57430787682e6fa791108f1b05 Merge: af0af9087a071 4b069553246f9 Author: Dave Airlie Date: Fri Jan 27 11:50:08 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-01-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-01-25: amdgpu: - GC11.x fixes - SMU13.0.0 fix - Freesync video fix - DP MST fixes drm: - DP MST kref fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230125220153.320248-1-alexander.deucher@amd.com commit af0af9087a071c68cc9be3f3875772b41068e03b Merge: 2241ab53cbb5c 2255bbcdc39d5 Author: Dave Airlie Date: Fri Jan 27 11:39:55 2023 +1000 Merge tag 'drm-intel-fixes-2023-01-26' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix BSC default context for Meteor Lake (Lucas) - Fix selftest-scheduler's modify_type (Andi) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y9LKD2J5bmICTyIP@intel.com commit ad34656db3b959421621c4e239d7e0dc710ec04c Author: Bjorn Helgaas Date: Thu Jan 26 15:10:03 2023 -0600 MAINTAINERS: Move to shared PCI tree Move PCI subsystem maintenance to a shared git tree to make it easier for maintainers to collaborate. Update MAINTAINERS accordingly. No change to patch submission and patchwork tracking. Link: https://lore.kernel.org/r/20230126211003.1310916-1-helgaas@kernel.org Signed-off-by: Bjorn Helgaas commit e632291a2dbce45a24cddeb5fe28fe71d724ba43 Author: Dragos Tatulea Date: Tue Jan 24 20:24:18 2023 +0200 IB/IPoIB: Fix legacy IPoIB due to wrong number of queues The cited commit creates child PKEY interfaces over netlink will multiple tx and rx queues, but some devices doesn't support more than 1 tx and 1 rx queues. This causes to a crash when traffic is sent over the PKEY interface due to the parent having a single queue but the child having multiple queues. This patch fixes the number of queues to 1 for legacy IPoIB at the earliest possible point in time. BUG: kernel NULL pointer dereference, address: 000000000000036b PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc+0xcb/0x450 Code: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a 01 49 8b 3c 24 <49> 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b RSP: 0018:ffff88822acbbab8 EFLAGS: 00010202 RAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae RDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00 RBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40 R10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000 R13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000 FS: 00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_clone+0x55/0xd0 ip6_finish_output2+0x3fe/0x690 ip6_finish_output+0xfa/0x310 ip6_send_skb+0x1e/0x60 udp_v6_send_skb+0x1e5/0x420 udpv6_sendmsg+0xb3c/0xe60 ? ip_mc_finish_output+0x180/0x180 ? __switch_to_asm+0x3a/0x60 ? __switch_to_asm+0x34/0x60 sock_sendmsg+0x33/0x40 __sys_sendto+0x103/0x160 ? _copy_to_user+0x21/0x30 ? kvm_clock_get_cycles+0xd/0x10 ? ktime_get_ts64+0x49/0xe0 __x64_sys_sendto+0x25/0x30 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f9374f1ed14 Code: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b RSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14 RDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030 RBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc Fixes: dbc94a0fb817 ("IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces") Signed-off-by: Dragos Tatulea Link: https://lore.kernel.org/r/95eb6b74c7cf49fa46281f9d056d685c9fa11d38.1674584576.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 343c700480982214dc4f834f536a49a4098e556a Author: Javier Martinez Canillas Date: Wed Jan 25 19:42:30 2023 +0100 drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command Commit 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the atomic helpers") changed the driver to just use the atomic helpers instead of the simple KMS abstraction layer. But the commit also made a subtle change on the display power sequence and initialization order, by moving the ssd130x_power_on() call to the encoder .atomic_enable handler and the ssd130x_init() call to CRTC .reset handler. Before this change, both ssd130x_power_on() and ssd130x_init() were called in the simple display pipeline .enable handler, so the display was already initialized by the time the SSD130X_DISPLAY_ON command was sent. For some reasons, it only made the ssd130x SPI driver to fail but the I2C was still working. That is the reason why the bug was not noticed before. To revert to the old driver behavior, move the ssd130x_init() call to the encoder .atomic_enable as well. Besides fixing the panel not being turned on when using SPI, it also gets rid of the custom CRTC .reset callback. Fixes: 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the atomic helpers") Signed-off-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230125184230.3343206-1-javierm@redhat.com commit db3ba974c2bc895ba39689a364cb7a49c0fe779f Merge: 8e4ff684762b6 85eee6341abb8 Author: Jens Axboe Date: Thu Jan 26 11:43:33 2023 -0700 Merge tag 'nvme-6.2-2023-01-26' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - flush initial scan_work for async probe (Keith Busch) - fix passthrough csi check (Keith Busch) - fix nvme-fc initialization order (Ross Lagerwall)" * tag 'nvme-6.2-2023-01-26' of git://git.infradead.org/nvme: nvme: fix passthrough csi check nvme-pci: flush initial scan_work for async probe nvme-fc: fix initialization order commit 83abd4d4c4be8984ba5a3a813ccfedba79c7d6ad Merge: 28b4387f0ec08 1bc5d819f0b97 Author: Linus Torvalds Date: Thu Jan 26 10:29:49 2023 -0800 Merge tag 'platform-drivers-x86-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - Fix false positive apple_gmux backlight detection on older iGPU only MacBook models - Various other small fixes and hardware-id additions * tag 'platform-drivers-x86-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms ACPI: video: Fix apple gmux detection platform/x86: apple-gmux: Add apple_gmux_detect() helper platform/x86: apple-gmux: Move port defines to apple-gmux.h platform/x86: hp-wmi: Fix cast to smaller integer type warning platform/x86/amd: pmc: Add a module parameter to disable workarounds platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF platform/x86: hp-wmi: Handle Omen Key event platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table commit 28b4387f0ec08d48634fcc3e3687c93edc1503f9 Merge: 262b42e02d1e0 7083df59abbc2 Author: Linus Torvalds Date: Thu Jan 26 10:20:12 2023 -0800 Merge tag 'net-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Current release - regressions: - sched: sch_taprio: do not schedule in taprio_reset() Previous releases - regressions: - core: fix UaF in netns ops registration error path - ipv4: prevent potential spectre v1 gadgets - ipv6: fix reachability confirmation with proxy_ndp - netfilter: fix for the set rbtree - eth: fec: use page_pool_put_full_page when freeing rx buffers - eth: iavf: fix temporary deadlock and failure to set MAC address Previous releases - always broken: - netlink: prevent potential spectre v1 gadgets - netfilter: fixes for SCTP connection tracking - mctp: struct sock lifetime fixes - eth: ravb: fix possible hang if RIS2_QFF1 happen - eth: tg3: resolve deadlock in tg3_reset_task() during EEH Misc: - Mat stepped out as MPTCP co-maintainer" * tag 'net-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits) net: mdio-mux-meson-g12a: force internal PHY off on mux switch docs: networking: Fix bridge documentation URL tsnep: Fix TX queue stop/wake for multiple queues net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mctp: mark socks as dead on unhash, prevent re-add net: mctp: hold key reference when looking up a general key net: mctp: move expiry timer delete to unhash net: mctp: add an explicit reference from a mctp_sk_key to sock net: ravb: Fix possible hang if RIS2_QFF1 happen net: ravb: Fix lack of register setting after system resumed for Gen3 net/x25: Fix to not accept on connected socket ice: move devlink port creation/deletion sctp: fail if no bound addresses can be used for a given scope net/sched: sch_taprio: do not schedule in taprio_reset() Revert "Merge branch 'ethtool-mac-merge'" netrom: Fix use-after-free of a listening socket. netfilter: conntrack: unify established states for SCTP paths Revert "netfilter: conntrack: add sctp DATA_SENT state" netfilter: conntrack: fix bug in for_each_sctp_chunk netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE ... commit 262b42e02d1e0b5ad1b33e9b9842e178c16231de Author: Linus Torvalds Date: Thu Jan 26 10:05:39 2023 -0800 treewide: fix up files incorrectly marked executable I'm not exactly clear on what strange workflow causes people to do it, but clearly occasionally some files end up being committed as executable even though they clearly aren't. This is a reprise of commit 90fda63fa115 ("treewide: fix up files incorrectly marked executable"), just with a different set of files (but with the same trivial shell scripting). So apparently we need to re-do this every five years or so, and Joe needs to just keep reminding me to do so ;) Reported-by: Joe Perches Fixes: 523375c943e5 ("drm/vmwgfx: Port vmwgfx to arm64") Fixes: 5c439937775d ("ASoC: codecs: add support for ES8326") Signed-off-by: Linus Torvalds commit e18c6da62edc780e4f4f3c9ce07bdacd69505182 Author: Arnd Bergmann Date: Thu Jan 26 17:21:24 2023 +0100 ASoC: cs42l56: fix DT probe While looking through legacy platform data users, I noticed that the DT probing never uses data from the DT properties, as the platform_data structure gets overwritten directly after it is initialized. There have never been any boards defining the platform_data in the mainline kernel either, so this driver so far only worked with patched kernels or with the default values. For the benefit of possible downstream users, fix the DT probe by no longer overwriting the data. Signed-off-by: Arnd Bergmann Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20230126162203.2986339-1-arnd@kernel.org Signed-off-by: Mark Brown commit 8e4ff684762b6503db45e8906e258faee080c336 Author: Ming Lei Date: Thu Jan 26 19:53:46 2023 +0800 block: ublk: move ublk_chr_class destroying after devices are removed The 'ublk_chr_class' is needed when deleting ublk char devices in ublk_exit(), so move it after devices(idle) are removed. Fixes the following warning reported by Harris, James R: [ 859.178950] sysfs group 'power' not found for kobject 'ublkc0' [ 859.178962] WARNING: CPU: 3 PID: 1109 at fs/sysfs/group.c:278 sysfs_remove_group+0x9c/0xb0 Reported-by: "Harris, James R" Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Link: https://lore.kernel.org/linux-block/Y9JlFmSgDl3+zy3N@T590/T/#t Signed-off-by: Ming Lei Tested-by: Jim Harris Link: https://lore.kernel.org/r/20230126115346.263344-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit a428eb4b99ab80454f06ad256b25e930fe8a4954 Author: Robin Murphy Date: Mon Jan 23 18:30:38 2023 +0000 Partially revert "perf/arm-cmn: Optimise DTC counter accesses" It turns out the optimisation implemented by commit 4f2c3872dde5 is totally broken, since all the places that consume hw->dtcs_used for events other than cycle count are still not expecting it to be sparsely populated, and fail to read all the relevant DTC counters correctly if so. If implemented correctly, the optimisation potentially saves up to 3 register reads per event update, which is reasonably significant for events targeting a single node, but still not worth a massive amount of additional code complexity overall. Getting it right within the current design looks a fair bit more involved than it was ever intended to be, so let's just make a functional revert which restores the old behaviour while still backporting easily. Fixes: 4f2c3872dde5 ("perf/arm-cmn: Optimise DTC counter accesses") Reported-by: Ilkka Koskinen Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/b41bb4ed7283c3d8400ce5cf5e6ec94915e6750f.1674498637.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit 5754a1c98b18009cb3030dc391aa37b77428a0bd Author: Guodong Liu Date: Wed Jan 18 14:21:16 2023 +0800 pinctrl: mediatek: Fix the drive register definition of some Pins The drive adjustment register definition of gpio13 and gpio81 is wrong: "the start address for the range" of gpio18 is corrected to 0x000, "the start bit for the first register within the range" of gpio81 is corrected to 24. Fixes: 6cf5e9ef362a ("pinctrl: add pinctrl driver on mt8195") Signed-off-by: Guodong Liu Link: https://lore.kernel.org/r/20230118062116.26315-1-Guodong.Liu@mediatek.com Signed-off-by: Linus Walleij commit 51128c3f2a7c98055ea1d27e34910dc10977f618 Author: Hans Verkuil Date: Thu Jan 19 10:02:19 2023 +0100 drm/vc4: hdmi: make CEC adapter name unique The bcm2711 has two HDMI outputs, each with their own CEC adapter. The CEC adapter name has to be unique, but it is currently hardcoded to "vc4" for both outputs. Change this to use the card_name from the variant information in order to make the adapter name unique. Signed-off-by: Hans Verkuil Fixes: 15b4511a4af6 ("drm/vc4: add HDMI CEC support") Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/dcf1db75-d9cc-62cc-fa12-baf1b2b3bf31@xs4all.nl commit 1febf88ef907b142fdde34f7c64ed3535d9339e4 Author: Fabio Estevam Date: Tue Jan 17 08:25:10 2023 -0300 ARM: dts: imx7d-smegw01: Fix USB host over-current polarity Currently, when resetting the USB modem via AT commands, the modem is no longer re-connected. This problem is caused by the incorrect description of the USB_OTG2_OC pad. It should have pull-up enabled, hysteresis enabled and the property 'over-current-active-low' should be passed. With this change, the USB modem can be successfully re-connected after a reset. Cc: stable@vger.kernel.org Fixes: 9ac0ae97e349 ("ARM: dts: imx7d-smegw01: Add support for i.MX7D SMEGW01 board") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 39c95d0c357d7ef76aea958c1bece6b24f9b2e7e Author: Philippe Schenker Date: Mon Jan 16 15:01:52 2023 +0100 arm64: dts: imx8mm-verdin: Do not power down eth-phy Currently if suspending using either freeze or memory state, the fec driver tries to power down the phy which leads to crash of the kernel and non-responsible kernel with the following call trace: [ 24.839889 ] Call trace: [ 24.839892 ] phy_error+0x18/0x60 [ 24.839898 ] kszphy_handle_interrupt+0x6c/0x80 [ 24.839903 ] phy_interrupt+0x20/0x2c [ 24.839909 ] irq_thread_fn+0x30/0xa0 [ 24.839919 ] irq_thread+0x178/0x2c0 [ 24.839925 ] kthread+0x154/0x160 [ 24.839932 ] ret_from_fork+0x10/0x20 Since there is currently no functionality in the phy subsystem to power down phys let's just disable the feature of powering-down the ethernet phy. Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Philippe Schenker Signed-off-by: Shawn Guo commit 52219e719f53c792cc10296178e7e38e9e1412aa Author: Ahmad Fatoum Date: Mon Jan 16 12:25:06 2023 +0100 MAINTAINERS: match freescale ARM64 DT directory in i.MX entry The majority of device trees in arch/arm64/boot/dts/freescale/ are built around i.MX SoCs with the rest being for Layerscape. Yet, calling get_maintainers.pl -f on this directory will not match the MAINTAINERS entry, because the directory name doesn't contain the substring "imx". Add an explicit file match for the directory and exclude the Layerscape specific files. This ensures To/Cc is not only generated from git history, but takes e.g. the R: entries into account as well. Signed-off-by: Ahmad Fatoum Signed-off-by: Shawn Guo commit 7083df59abbc2b7500db312cac706493be0273ff Author: Jerome Brunet Date: Tue Jan 24 11:11:57 2023 +0100 net: mdio-mux-meson-g12a: force internal PHY off on mux switch Force the internal PHY off then on when switching to the internal path. This fixes problems where the PHY ID is not properly set. Fixes: 7090425104db ("net: phy: add amlogic g12a mdio mux support") Suggested-by: Qi Duan Co-developed-by: Heiner Kallweit Signed-off-by: Heiner Kallweit Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20230124101157.232234-1-jbrunet@baylibre.com Signed-off-by: Jakub Kicinski commit aee2770d199a969b205e7b60125d5af47e3bdee0 Author: Ivan Vecera Date: Tue Jan 24 15:51:26 2023 +0100 docs: networking: Fix bridge documentation URL Current documentation URL [1] is no longer valid. [1] https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge Signed-off-by: Ivan Vecera Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230124145127.189221-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 3d53aaef4332245044b2f3688ac0ea10436c719c Author: Gerhard Engleder Date: Tue Jan 24 20:14:40 2023 +0100 tsnep: Fix TX queue stop/wake for multiple queues netif_stop_queue() and netif_wake_queue() act on TX queue 0. This is ok as long as only a single TX queue is supported. But support for multiple TX queues was introduced with 762031375d5c and I missed to adapt stop and wake of TX queues. Use netif_stop_subqueue() and netif_tx_wake_queue() to act on specific TX queue. Fixes: 762031375d5c ("tsnep: Support multiple TX/RX queue pairs") Signed-off-by: Gerhard Engleder Link: https://lore.kernel.org/r/20230124191440.56887-1-gerhard@engleder-embedded.com Signed-off-by: Jakub Kicinski commit 6c4ca03bd890566d873e3593b32d034bf2f5a087 Author: David Christensen Date: Tue Jan 24 13:53:39 2023 -0500 net/tg3: resolve deadlock in tg3_reset_task() during EEH During EEH error injection testing, a deadlock was encountered in the tg3 driver when tg3_io_error_detected() was attempting to cancel outstanding reset tasks: crash> foreach UN bt ... PID: 159 TASK: c0000000067c6000 CPU: 8 COMMAND: "eehd" ... #5 [c00000000681f990] __cancel_work_timer at c00000000019fd18 #6 [c00000000681fa30] tg3_io_error_detected at c00800000295f098 [tg3] #7 [c00000000681faf0] eeh_report_error at c00000000004e25c ... PID: 290 TASK: c000000036e5f800 CPU: 6 COMMAND: "kworker/6:1" ... #4 [c00000003721fbc0] rtnl_lock at c000000000c940d8 #5 [c00000003721fbe0] tg3_reset_task at c008000002969358 [tg3] #6 [c00000003721fc60] process_one_work at c00000000019e5c4 ... PID: 296 TASK: c000000037a65800 CPU: 21 COMMAND: "kworker/21:1" ... #4 [c000000037247bc0] rtnl_lock at c000000000c940d8 #5 [c000000037247be0] tg3_reset_task at c008000002969358 [tg3] #6 [c000000037247c60] process_one_work at c00000000019e5c4 ... PID: 655 TASK: c000000036f49000 CPU: 16 COMMAND: "kworker/16:2" ...:1 #4 [c0000000373ebbc0] rtnl_lock at c000000000c940d8 #5 [c0000000373ebbe0] tg3_reset_task at c008000002969358 [tg3] #6 [c0000000373ebc60] process_one_work at c00000000019e5c4 ... Code inspection shows that both tg3_io_error_detected() and tg3_reset_task() attempt to acquire the RTNL lock at the beginning of their code blocks. If tg3_reset_task() should happen to execute between the times when tg3_io_error_deteced() acquires the RTNL lock and tg3_reset_task_cancel() is called, a deadlock will occur. Moving tg3_reset_task_cancel() call earlier within the code block, prior to acquiring RTNL, prevents this from happening, but also exposes another deadlock issue where tg3_reset_task() may execute AFTER tg3_io_error_detected() has executed: crash> foreach UN bt PID: 159 TASK: c0000000067d2000 CPU: 9 COMMAND: "eehd" ... #4 [c000000006867a60] rtnl_lock at c000000000c940d8 #5 [c000000006867a80] tg3_io_slot_reset at c0080000026c2ea8 [tg3] #6 [c000000006867b00] eeh_report_reset at c00000000004de88 ... PID: 363 TASK: c000000037564000 CPU: 6 COMMAND: "kworker/6:1" ... #3 [c000000036c1bb70] msleep at c000000000259e6c #4 [c000000036c1bba0] napi_disable at c000000000c6b848 #5 [c000000036c1bbe0] tg3_reset_task at c0080000026d942c [tg3] #6 [c000000036c1bc60] process_one_work at c00000000019e5c4 ... This issue can be avoided by aborting tg3_reset_task() if EEH error recovery is already in progress. Fixes: db84bf43ef23 ("tg3: tg3_reset_task() needs to use rtnl_lock to synchronize") Signed-off-by: David Christensen Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230124185339.225806-1-drc@linux.vnet.ibm.com Signed-off-by: Jakub Kicinski commit 47123900f3e4a7f769631d6ec15abf44086276f6 Author: Pierluigi Passaro Date: Sun Jan 15 22:35:03 2023 +0100 arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX According section     8.2.5.313 Select Input Register (IOMUXC_UART1_RXD_SELECT_INPUT) of      i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020 the required setting for this specific pin configuration is "1" Signed-off-by: Pierluigi Passaro Reviewed-by: Fabio Estevam Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm") Signed-off-by: Shawn Guo commit a34dc4a9b9e2fb3a45c179a60bb0b26539c96189 Author: Namjae Jeon Date: Wed Jan 25 00:09:02 2023 +0900 ksmbd: downgrade ndr version error message to debug When user switch samba to ksmbd, The following message flood is coming when accessing files. Samba seems to changs dos attribute version to v5. This patch downgrade ndr version error message to debug. $ dmesg ... [68971.766914] ksmbd: v5 version is not supported [68971.779808] ksmbd: v5 version is not supported [68971.871544] ksmbd: v5 version is not supported [68971.910135] ksmbd: v5 version is not supported ... Cc: stable@vger.kernel.org Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 62c487b53a7ff31e322cf2874d3796b8202c54a5 Author: Namjae Jeon Date: Wed Jan 25 00:13:20 2023 +0900 ksmbd: limit pdu length size according to connection status Stream protocol length will never be larger than 16KB until session setup. After session setup, the size of requests will not be larger than 16KB + SMB2 MAX WRITE size. This patch limits these invalidly oversized requests and closes the connection immediately. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit ecfb9f404771dde909ce7743df954370933c3be2 Author: Paul Cercueil Date: Wed Dec 14 13:37:04 2022 +0100 clk: ingenic: jz4760: Update M/N/OD calculation algorithm The previous algorithm was pretty broken. - The inner loop had a '(m > m_max)' condition, and the value of 'm' would increase in each iteration; - Each iteration would actually multiply 'm' by two, so it is not needed to re-compute the whole equation at each iteration; - It would loop until (m & 1) == 0, which means it would loop at most once. - The outer loop would divide the 'n' value by two at the end of each iteration. This meant that for a 12 MHz parent clock and a 1.2 GHz requested clock, it would first try n=12, then n=6, then n=3, then n=1, none of which would work; the only valid value is n=2 in this case. Simplify this algorithm with a single for loop, which decrements 'n' after each iteration, addressing all of the above problems. Fixes: bdbfc029374f ("clk: ingenic: Add support for the JZ4760") Cc: Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20221214123704.7305-1-paul@crapouillou.net Signed-off-by: Stephen Boyd commit 19398821b25a9cde564265262e680ae1c2351be7 Author: Dan Williams Date: Fri Jan 20 16:26:12 2023 -0800 cxl/pmem: Fix nvdimm unregistration when cxl_pmem driver is absent The cxl_pmem.ko module houses the driver for both cxl_nvdimm_bridge objects and cxl_nvdimm objects. When the core creates a cxl_nvdimm it arranges for it to be autoremoved when the bridge goes down. However, if the bridge never initialized because the cxl_pmem.ko module never loaded, it sets up a the following crash scenario: BUG: kernel NULL pointer dereference, address: 0000000000000478 [..] RIP: 0010:cxl_nvdimm_probe+0x99/0x140 [cxl_pmem] [..] Call Trace: cxl_bus_probe+0x17/0x50 [cxl_core] really_probe+0xde/0x380 __driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __driver_attach+0xd2/0x1c0 bus_for_each_dev+0x79/0xc0 bus_add_driver+0x1b1/0x200 driver_register+0x89/0xe0 cxl_pmem_init+0x50/0xff0 [cxl_pmem] It turns out the recent rework to simplify nvdimm probing obviated the need to unregister cxl_nvdimm objects at cxl_nvdimm_bridge ->remove() time. Leave the cxl_nvdimm device registered until the hosting cxl_memdev departs. The alternative is that the cxl_memdev needs to be reattached whenever the cxl_nvdimm_bridge attach state cycles, which is awkward and unnecessary. The only requirement is to make sure that when the cxl_nvdimm_bridge goes away any dependent cxl_nvdimm objects are shutdown. Handle that in unregister_nvdimm_bus(). With these registration entanglements removed there is no longer a need to pre-load the cxl_pmem module in cxl_acpi. Fixes: cb9cfff82f6a ("cxl/acpi: Simplify cxl_nvdimm_bridge probing") Reported-by: Gregory Price Debugged-by: Jonathan Cameron Tested-by: Jonathan Cameron Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/167426077263.3955046.9695309346988027311.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit fb6df4366f86dd252bfa3049edffa52d17e7b895 Author: Vishal Verma Date: Wed Jan 25 11:34:18 2023 -0700 ACPI: NFIT: fix a potential deadlock during NFIT teardown Lockdep reports that acpi_nfit_shutdown() may deadlock against an opportune acpi_nfit_scrub(). acpi_nfit_scrub () is run from inside a 'work' and therefore has already acquired workqueue-internal locks. It also acquiires acpi_desc->init_mutex. acpi_nfit_shutdown() first acquires init_mutex, and was subsequently attempting to cancel any pending workqueue items. This reversed locking order causes a potential deadlock: ====================================================== WARNING: possible circular locking dependency detected 6.2.0-rc3 #116 Tainted: G O N ------------------------------------------------------ libndctl/1958 is trying to acquire lock: ffff888129b461c0 ((work_completion)(&(&acpi_desc->dwork)->work)){+.+.}-{0:0}, at: __flush_work+0x43/0x450 but task is already holding lock: ffff888129b460e8 (&acpi_desc->init_mutex){+.+.}-{3:3}, at: acpi_nfit_shutdown+0x87/0xd0 [nfit] which lock already depends on the new lock. ... Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&acpi_desc->init_mutex); lock((work_completion)(&(&acpi_desc->dwork)->work)); lock(&acpi_desc->init_mutex); lock((work_completion)(&(&acpi_desc->dwork)->work)); *** DEADLOCK *** Since the workqueue manipulation is protected by its own internal locking, the cancellation of pending work doesn't need to be done under acpi_desc->init_mutex. Move cancel_delayed_work_sync() outside the init_mutex to fix the deadlock. Any work that starts after acpi_nfit_shutdown() drops the lock will see ARS_CANCEL, and the cancel_delayed_work_sync() will safely flush it out. Reported-by: Dan Williams Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20230112-acpi_nfit_lockdep-v1-1-660be4dd10be@intel.com Signed-off-by: Dan Williams commit 1c88b9ba6b126080a9c121abd943b25e20cd7ac1 Author: Randy Dunlap Date: Mon Jan 16 23:02:49 2023 -0800 dax: super.c: fix kernel-doc bad line warning Convert an empty line to " *" to avoid a kernel-doc warning: drivers/dax/super.c:478: warning: bad line: Signed-off-by: Randy Dunlap Cc: Dan Williams Cc: Vishal Verma Cc: Dave Jiang Cc: nvdimm@lists.linux.dev Link: https://lore.kernel.org/r/20230117070249.31934-1-rdunlap@infradead.org Signed-off-by: Dan Williams commit be0d8f48ad97f5b775b0af3310343f676dbf318a Author: Kees Cook Date: Thu Jan 5 22:02:33 2023 -0800 bcache: Silence memcpy() run-time false positive warnings struct bkey has internal padding in a union, but it isn't always named the same (e.g. key ## _pad, key_p, etc). This makes it extremely hard for the compiler to reason about the available size of copies done against such keys. Use unsafe_memcpy() for now, to silence the many run-time false positive warnings: memcpy: detected field-spanning write (size 264) of single field "&i->j" at drivers/md/bcache/journal.c:152 (size 240) memcpy: detected field-spanning write (size 24) of single field "&b->key" at drivers/md/bcache/btree.c:939 (size 16) memcpy: detected field-spanning write (size 24) of single field "&temp.key" at drivers/md/bcache/extents.c:428 (size 16) Reported-by: Alexandre Pereira Link: https://bugzilla.kernel.org/show_bug.cgi?id=216785 Acked-by: Coly Li Cc: Kent Overstreet Cc: linux-bcache@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230106060229.never.047-kees@kernel.org commit e6a71160cc145e18ab45195abf89884112e02dfb Author: Kees Cook Date: Wed Jan 18 12:21:35 2023 -0800 gcc-plugins: Reorganize gimple includes for GCC 13 The gimple-iterator.h header must be included before gimple-fold.h starting with GCC 13. Reorganize gimple headers to work for all GCC versions. Reported-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/all/20230113173033.4380-1-palmer@rivosinc.com/ Cc: linux-hardening@vger.kernel.org Signed-off-by: Kees Cook commit 4acf1de35f41549e60c3c02a8defa7cb95eabdf2 Author: Kees Cook Date: Fri Jan 6 19:47:05 2023 -0800 kunit: memcpy: Split slow memcpy tests into MEMCPY_SLOW_KUNIT_TEST Since the long memcpy tests may stall a system for tens of seconds in virtualized architecture environments, split those tests off under CONFIG_MEMCPY_SLOW_KUNIT_TEST so they can be separately disabled. Reported-by: Guenter Roeck Link: https://lore.kernel.org/lkml/20221226195206.GA2626419@roeck-us.net Reviewed-by: Nick Desaulniers Reviewed-and-tested-by: Guenter Roeck Reviewed-by: David Gow Cc: Andrew Morton Cc: Nathan Chancellor Cc: linux-hardening@vger.kernel.org Signed-off-by: Kees Cook commit 4b069553246f993c4221e382d0d0ae34f5ba730e Author: Aurabindo Pillai Date: Wed Jan 11 14:56:22 2023 -0500 drm/amd/display: Fix timing not changning when freesync video is enabled [Why&How] Switching between certain modes that are freesync video modes and those are not freesync video modes result in timing not changing as seen by the monitor due to incorrect timing being driven. The issue is fixed by ensuring that when a non freesync video mode is set, we reset the freesync status on the crtc. Reviewed-by: Nicholas Kazlauskas Acked-by: Alan Liu Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit eadd7deca0ad8a83edb2b894d8326c78e78635d6 Author: Alexander Potapenko Date: Tue Jan 24 12:32:34 2023 +0100 btrfs: zlib: zero-initialize zlib workspace KMSAN reports uses of uninitialized memory in zlib's longest_match() called on memory originating from zlib_alloc_workspace(). This issue is known by zlib maintainers and is claimed to be harmless, but to be on the safe side we'd better initialize the memory. Link: https://zlib.net/zlib_faq.html#faq36 Reported-by: syzbot+14d9e7602ebdf7ec0a60@syzkaller.appspotmail.com CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Alexander Potapenko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3c538de0f2a74d50aff7278c092f88ae59cee688 Author: Josef Bacik Date: Wed Jan 18 16:35:13 2023 -0500 btrfs: limit device extents to the device size There was a recent regression in btrfs/177 that started happening with the size class patches ("btrfs: introduce size class to block group allocator"). This however isn't a regression introduced by those patches, but rather the bug was uncovered by a change in behavior in these patches. The patches triggered more chunk allocations in the ^free-space-tree case, which uncovered a race with device shrink. The problem is we will set the device total size to the new size, and use this to find a hole for a device extent. However during shrink we may have device extents allocated past this range, so we could potentially find a hole in a range past our new shrink size. We don't actually limit our found extent to the device size anywhere, we assume that we will not find a hole past our device size. This isn't true with shrink as we're relocating block groups and thus creating holes past the device size. Fix this by making sure we do not search past the new device size, and if we wander into any device extents that start after our device size simply break from the loop and use whatever hole we've already found. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit f7c11affde9e29316d24b6736d16faeaac8278f2 Author: Tanmay Bhushan <007047221b@gmail.com> Date: Sun Jan 15 21:32:15 2023 +0100 btrfs: raid56: fix stripes if vertical errors are found We take two stripe numbers if vertical errors are found. In case it is just a pstripe it does not matter but in case of raid 6 it matters as both stripes need to be fixed. Fixes: 7a3150723061 ("btrfs: raid56: do data csum verification during RMW cycle") Reviewed-by: Qu Wenruo Signed-off-by: Tanmay Bhushan <007047221b@gmail.com> Signed-off-by: David Sterba commit d8bf2df715bb8ac964f91fe8bf67c37c5d916463 Author: Wayne Lin Date: Wed Dec 28 14:50:43 2022 +0800 drm/display/dp_mst: Correct the kref of port. [why & how] We still need to refer to port while removing payload at commit_tail. we should keep the kref till then to release. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2171 Signed-off-by: Wayne Lin Signed-off-by: Harry Wentland Fixes: 4d07b0bc4034 ("drm/display/dp_mst: Move all payload info into the atomic state") Cc: stable@vger.kernel.org # 6.1 Acked-by: Harry Wentland Reviewed-by: Lyude Paul Tested-by: Didier Raboud Signed-off-by: Alex Deucher commit f85c5e25fd28fe0bf6d6d0563cf83758a4e05c8f Author: Wayne Lin Date: Mon Dec 12 15:41:18 2022 +0800 drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD [Why & How] Now the vc_start_slot is controlled at drm side. When we service a long HPD, we still need to run dm_helpers_dp_mst_write_payload_allocation_table() to update drm mst_mgr's relevant variable. Otherwise, on the next plug-in, payload will get assigned with a wrong start slot. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2171 Signed-off-by: Wayne Lin Signed-off-by: Harry Wentland Fixes: 4d07b0bc4034 ("drm/display/dp_mst: Move all payload info into the atomic state") Cc: stable@vger.kernel.org # 6.1 Acked-by: Harry Wentland Reviewed-by: Lyude Paul Tested-by: Didier Raboud Signed-off-by: Alex Deucher commit cb1e0b015f56b8f3c7f5ce33ff4b782ee5674512 Author: Wayne Lin Date: Fri Dec 9 19:05:33 2022 +0800 drm/amdgpu/display/mst: limit payload to be updated one by one [Why] amdgpu expects to update payload table for one stream one time by calling dm_helpers_dp_mst_write_payload_allocation_table(). Currently, it get modified to try to update HW payload table at once by referring mst_state. [How] This is just a quick workaround. Should find way to remove the temporary struct dc_dp_mst_stream_allocation_table later if set struct link_mst_stream_allocatio directly is possible. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2171 Signed-off-by: Wayne Lin Signed-off-by: Harry Wentland Fixes: 4d07b0bc4034 ("drm/display/dp_mst: Move all payload info into the atomic state") Cc: stable@vger.kernel.org # 6.1 Acked-by: Harry Wentland Reviewed-by: Lyude Paul Tested-by: Didier Raboud Signed-off-by: Alex Deucher commit 1119e1f9636b76aef14068c7fd0b4d55132b86b8 Author: Lyude Paul Date: Wed Nov 23 14:50:16 2022 -0500 drm/amdgpu/display/mst: Fix mst_state->pbn_div and slot count assignments Looks like I made a pretty big mistake here without noticing: it seems when I moved the assignments of mst_state->pbn_div I completely missed the fact that the reason for us calling drm_dp_mst_update_slots() earlier was to account for the fact that we need to call this function using info from the root MST connector, instead of just trying to do this from each MST encoder's atomic check function. Otherwise, we end up filling out all of DC's link information with zeroes. So, let's restore that and hopefully fix this DSC regression. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2171 Signed-off-by: Lyude Paul Signed-off-by: Harry Wentland Fixes: 4d07b0bc4034 ("drm/display/dp_mst: Move all payload info into the atomic state") Cc: stable@vger.kernel.org # 6.1 Reviewed-by: Harry Wentland Tested-by: Didier Raboud Signed-off-by: Alex Deucher commit f0f7743624e77abe419ff1971b50e44ac1482421 Author: Li Ma Date: Fri Jan 20 15:41:22 2023 +0800 drm/amdgpu: declare firmware for new MES 11.0.4 To support new mes ip block Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 08fbe3c24fd2f0706c0eb907c71e26f10e5d8c6a Author: Li Ma Date: Fri Jan 20 15:38:33 2023 +0800 drm/amdgpu: enable imu firmware for GC 11.0.4 The GC 11.0.4 needs load IMU to power up GFX before loads GFX firmware. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 15b207d0abdcbb2271774aa99d9a290789159e75 Author: Evan Quan Date: Fri Jan 20 11:21:53 2023 +0800 drm/amd/pm: add missing AllowIHInterrupt message mapping for SMU13.0.0 Add SMU13.0.0 AllowIHInterrupt message mapping. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 2de3769830346e68b3de0f4abc0d8e2625ad9dac Author: Jonathan Kim Date: Thu Jan 19 18:42:03 2023 -0500 drm/amdgpu: remove unconditional trap enable on add gfx11 queues Rebase of driver has incorrect unconditional trap enablement for GFX11 when adding mes queues. Reported-by: Graham Sider Signed-off-by: Jonathan Kim Reviewed-by: Graham Sider Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 7c46948a6e9cf47ed03b0d489fde894ad46f1437 Merge: 948ef7bb70c4a facd61053cff1 Author: Linus Torvalds Date: Wed Jan 25 09:15:15 2023 -0800 Merge tag 'fs.fuse.acl.v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull fuse ACL fix from Christian Brauner: "The new posix acl API doesn't depend on the xattr handler infrastructure anymore and instead only relies on the posix acl inode operations. As a result daemons without FUSE_POSIX_ACL are unable to use posix acls like they used to. Fix this by copying what we did for overlayfs during the posix acl api conversion. Make fuse implement a dedicated ->get_inode_acl() method as does overlayfs. Fuse can then also uses this to express different needs for vfs permission checking during lookup and acl based retrieval via the regular system call path. This allows fuse to continue to refuse retrieving posix acls for daemons that don't set FUSE_POSXI_ACL for permission checking while also allowing a fuse server to retrieve it via the usual system calls" * tag 'fs.fuse.acl.v6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fuse: fixes after adapting to new posix acl api commit a49fb7218ed84a4c5e6c56b9fd933498b9730912 Author: Doug Smythies Date: Sat Jan 21 08:41:35 2023 -0800 selftests: amd-pstate: Don't delete source files via Makefile Revert the portion of a recent Makefile change that incorrectly deletes source files when doing "make clean". Fixes: ba2d788aa873 ("selftests: amd-pstate: Trigger tbench benchmark and test cpus") Reported-by: Sedat Dilek Tested-by: Sedat Dilek Reviewed-by: Sedat Dilek Acked-by: Huang Rui Signed-off-by: Doug Smythies Signed-off-by: Shuah Khan commit b7ab9161cf5ddc42a288edf9d1a61f3bdffe17c7 Author: David Howells Date: Wed Jan 25 14:02:13 2023 +0000 cifs: Fix oops due to uncleared server->smbd_conn in reconnect In smbd_destroy(), clear the server->smbd_conn pointer after freeing the smbd_connection struct that it points to so that reconnection doesn't get confused. Fixes: 8ef130f9ec27 ("CIFS: SMBD: Implement function to destroy a SMB Direct connection") Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Acked-by: Tom Talpey Signed-off-by: David Howells Cc: Long Li Cc: Pavel Shilovsky Cc: Ronnie Sahlberg Signed-off-by: Steve French commit 78020233418518faa72fba11f40e1d53b9e88a2e Author: Masami Hiramatsu (Google) Date: Fri Jan 20 08:36:24 2023 +0900 bootconfig: Update MAINTAINERS file to add tree and mailing list Since the bootconfig related changes will be handled on linux-trace tree, add the tree and mailing lists for EXTRA BOOT CONFIG. Link: https://lkml.kernel.org/r/167417138436.2333752.6988808113120359923.stgit@devnote3 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit ae3edea88e6c1bbb8b41ef958f79a7a44ab45f7c Author: Colin Ian King Date: Mon Jan 16 16:16:12 2023 +0000 rv: remove redundant initialization of pointer ptr The pointer ptr is being initialized with a value that is never read, it is being updated later on a call to strim. Remove the extraneous initialization. Link: https://lkml.kernel.org/r/20230116161612.77192-1-colin.i.king@gmail.com Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (Google) commit 34226fc6889e0e2fe8480bf3a0b43ac992bbee94 Author: Mark Rutland Date: Tue Jan 3 12:49:10 2023 +0000 ftrace: Maintain samples/ftrace There's no entry in MAINTAINERS for samples/ftrace. Add one so that the FTRACE maintainers are kept in the loop. Link: https://lkml.kernel.org/r/20230103124912.2948963-2-mark.rutland@arm.com Acked-by: Masami Hiramatsu (Google) Signed-off-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) commit d5090d91ec929a79b52e5a98144d85dea40d4438 Author: Randy Dunlap Date: Sat Jan 7 18:12:38 2023 -0800 tracing/filter: fix kernel-doc warnings Use the 'struct' keyword for a struct's kernel-doc notation and use the correct function parameter name to eliminate kernel-doc warnings: kernel/trace/trace_events_filter.c:136: warning: cannot understand function prototype: 'struct prog_entry ' kerne/trace/trace_events_filter.c:155: warning: Excess function parameter 'when_to_branch' description in 'update_preds' Also correct some trivial punctuation problems. Link: https://lkml.kernel.org/r/20230108021238.16398-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Steven Rostedt (Google) commit c1d6105869464635d8a2bcf87a43c05f4c0cfca4 Author: Ley Foon Tan Date: Thu Jan 5 11:37:05 2023 +0800 riscv: Move call to init_cpu_topology() to later initialization stage If "capacity-dmips-mhz" is present in a CPU DT node, topology_parse_cpu_capacity() will fail to allocate memory. arm64, with which this code path is shared, does not call topology_parse_cpu_capacity() until later in boot where memory allocation is available. While "capacity-dmips-mhz" is not yet a valid property on RISC-V, invalid properties should be ignored rather than cause issues. Move init_cpu_topology(), which calls topology_parse_cpu_capacity(), to a later initialization stage, to match arm64. As a side effect of this change, RISC-V is "protected" from changes to core topology code that would work on arm64 where memory allocation is safe but on RISC-V isn't. Fixes: 03f11f03dbfe ("RISC-V: Parse cpu topology during boot.") Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Signed-off-by: Ley Foon Tan Link: https://lore.kernel.org/r/20230105033705.3946130-1-leyfoon.tan@starfivetech.com [Palmer: use Conor's commit text] Link: https://lore.kernel.org/linux-riscv/20230104183033.755668-1-pierre.gondois@arm.com/T/#me592d4c8b9508642954839f0077288a353b0b9b2 Signed-off-by: Palmer Dabbelt commit 2fa89458af9993fab8054daf827f38881e2ad473 Author: Pratham Pratap Date: Wed Jan 25 12:57:25 2023 +0530 usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints Currently connect/disconnect of USB cable calls afunc_bind and eventually increments the bNumEndpoints. Performing multiple plugin/plugout will increment bNumEndpoints incorrectly, and on the next plug-in it leads to invalid configuration of descriptor and hence enumeration fails. Fix this by resetting the value of bNumEndpoints to 1 on every afunc_bind call. Fixes: 40c73b30546e ("usb: gadget: f_uac2: add adaptive sync support for capture") Cc: stable Signed-off-by: Pratham Pratap Signed-off-by: Prashanth K Link: https://lore.kernel.org/r/1674631645-28888-1-git-send-email-quic_prashk@quicinc.com Signed-off-by: Greg Kroah-Hartman commit cb963b2c011a62838852c902eccb3f72e5d3dbb6 Author: marco.rodolfi@tuta.io Date: Tue Jan 10 15:54:26 2023 +0100 HID: Ignore battery for Elan touchscreen on Asus TP420IA This device has a touchscreen thats report a battery even if it doesn't have one. Ask Linux to ignore the battery so it will not always report it as low. [jkosina@suse.cz: fix whitespace damage] Signed-off-by: Marco Rodolfi Signed-off-by: Jiri Kosina commit acd7e9ee57c880b99671dd99680cb707b7b5b0ee Author: Rafael J. Wysocki Date: Wed Jan 25 13:17:42 2023 +0100 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() In order to prevent int340x_thermal_get_trip_type() from possibly racing with int340x_thermal_read_trips() invoked by int3403_notify() add locking to it in analogy with int340x_thermal_get_trip_temp(). Fixes: 6757a7abe47b ("thermal: intel: int340x: Protect trip temperature from concurrent updates") Signed-off-by: Rafael J. Wysocki commit ac8d986cbf0b0ffdbf2c707fe59cf4a71d933a18 Merge: a9e9b78d53b91 b98e1a04e27fd Author: David S. Miller Date: Wed Jan 25 13:07:38 2023 +0000 Merge branch 'mptcp-fixes' Jeremy Kerr says: ==================== net: mctp: struct sock lifetime fixes This series is a set of fixes for the sock lifetime handling in the AF_MCTP code, fixing a uaf reported by Noam Rathaus . The Fixes: tags indicate the original patches affected, but some tweaking to backport to those commits may be needed; I have a separate branch with backports to 5.15 if that helps with stable trees. Of course, any comments/queries most welcome. ==================== Signed-off-by: David S. Miller commit b98e1a04e27fddfdc808bf46fe78eca30db89ab3 Author: Jeremy Kerr Date: Tue Jan 24 10:01:06 2023 +0800 net: mctp: mark socks as dead on unhash, prevent re-add Once a socket has been unhashed, we want to prevent it from being re-used in a sk_key entry as part of a routing operation. This change marks the sk as SOCK_DEAD on unhash, which prevents addition into the net's key list. We need to do this during the key add path, rather than key lookup, as we release the net keys_lock between those operations. Fixes: 4a992bbd3650 ("mctp: Implement message fragmentation & reassembly") Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit 6e54ea37e344f145665c2dc3cc534b92529e8de5 Author: Paolo Abeni Date: Tue Jan 24 10:01:05 2023 +0800 net: mctp: hold key reference when looking up a general key Currently, we have a race where we look up a sock through a "general" (ie, not directly associated with the (src,dest,tag) tuple) key, then drop the key reference while still holding the key's sock. This change expands the key reference until we've finished using the sock, and hence the sock reference too. Commit message changes from Jeremy Kerr . Reported-by: Noam Rathaus Fixes: 73c618456dc5 ("mctp: locking, lifetime and validity changes for sk_keys") Signed-off-by: Paolo Abeni Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit 5f41ae6fca9d40ab3cb9b0507931ef7a9b3ea50b Author: Jeremy Kerr Date: Tue Jan 24 10:01:04 2023 +0800 net: mctp: move expiry timer delete to unhash Currently, we delete the key expiry timer (in sk->close) before unhashing the sk. This means that another thread may find the sk through its presence on the key list, and re-queue the timer. This change moves the timer deletion to the unhash, after we have made the key no longer observable, so the timer cannot be re-queued. Fixes: 7b14e15ae6f4 ("mctp: Implement a timeout for tags") Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit de8a6b15d9654c3e4f672d76da9d9df8ee06331d Author: Jeremy Kerr Date: Tue Jan 24 10:01:03 2023 +0800 net: mctp: add an explicit reference from a mctp_sk_key to sock Currently, we correlate the mctp_sk_key lifetime to the sock lifetime through the sock hash/unhash operations, but this is pretty tenuous, and there are cases where we may have a temporary reference to an unhashed sk. This change makes the reference more explicit, by adding a hold on the sock when it's associated with a mctp_sk_key, released on final key unref. Fixes: 73c618456dc5 ("mctp: locking, lifetime and validity changes for sk_keys") Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit a9e9b78d53b91e6e52a2580aafece542655685b7 Merge: f2b0b5210f67c f3c07758c9007 Author: David S. Miller Date: Wed Jan 25 13:00:27 2023 +0000 Merge branch 'ravb-fixes' Yoshihiro Shimoda says: ==================== net: ravb: Fix potential issues Fix potentiall issues on the ravb driver. Changes from v2: https://lore.kernel.org/all/20230123131331.1425648-1-yoshihiro.shimoda.uh@renesas.com/ - Add Reviewed-by in the patch [2/2]. - Add a commit description in the patch [2/2]. Changes from v1: https://lore.kernel.org/all/20230119043920.875280-1-yoshihiro.shimoda.uh@renesas.com/ - Fix typo in the patch [1/2]. - Add Reviewed-by in the patch [1/2]. - Fix "Fixed" tag in the patch [2/2]. - Fix a comment indentation of the code in the patch [2/2]. ==================== Signed-off-by: David S. Miller commit f3c07758c9007a6bfff5290d9e19d3c41930c897 Author: Yoshihiro Shimoda Date: Tue Jan 24 09:02:11 2023 +0900 net: ravb: Fix possible hang if RIS2_QFF1 happen Since this driver enables the interrupt by RIC2_QFE1, this driver should clear the interrupt flag if it happens. Otherwise, the interrupt causes to hang the system. Note that this also fix a minor coding style (a comment indentation) around the fixed code. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergey Shtylyov Signed-off-by: David S. Miller commit c2b6cdee1d13ffbb24baca3c9b8a572d6b541e4e Author: Yoshihiro Shimoda Date: Tue Jan 24 09:02:10 2023 +0900 net: ravb: Fix lack of register setting after system resumed for Gen3 After system entered Suspend to RAM, registers setting of this hardware is reset because the SoC will be turned off. On R-Car Gen3 (info->ccc_gac), ravb_ptp_init() is called in ravb_probe() only. So, after system resumed, it lacks of the initial settings for ptp. So, add ravb_ptp_{init,stop}() into ravb_{resume,suspend}(). Fixes: f5d7837f96e5 ("ravb: ptp: Add CONFIG mode support") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergey Shtylyov Signed-off-by: David S. Miller commit 216f37366e86a6ddd34ed842cac3354f579ef48e Author: Nikita Shubin Date: Wed Jan 25 11:30:25 2023 +0300 gpio: ep93xx: Make irqchip immutable This turns the Cirrus ep93xx gpio irqchip immutable. Preserve per-chip labels by adding an ->irq_print_chip() callback. Signed-off-by: Nikita Shubin Signed-off-by: Bartosz Golaszewski commit 0f04cdbdb210000a97c773b28b598fa8ac3aafa4 Author: Nikita Shubin Date: Wed Jan 25 11:30:24 2023 +0300 gpio: ep93xx: Fix port F hwirq numbers in handler Fix wrong translation of irq numbers in port F handler, as ep93xx hwirqs increased by 1, we should simply decrease them by 1 in translation. Fixes: 482c27273f52 ("ARM: ep93xx: renumber interrupts") Signed-off-by: Nikita Shubin Acked-by: Arnd Bergmann Signed-off-by: Bartosz Golaszewski commit 100c94ffde489ee11e23400f2a07b236144b048f Author: Krzysztof Kozlowski Date: Tue Jan 24 13:30:49 2023 +0100 ASoC: codecs: wsa883x: correct playback min/max rates Correct reversed values used in min/max rates, leading to incorrect playback constraints. Cc: Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230124123049.285395-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 37870358616ca7fdb1e90ad1cdd791655ec54414 Author: Dan Carpenter Date: Tue Jan 24 18:20:26 2023 +0300 gpio: mxc: Unlock on error path in mxc_flip_edge() We recently added locking to this function but one error path was over looked. Drop the lock before returning. Fixes: e5464277625c ("gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock") Signed-off-by: Dan Carpenter Acked-by: Marek Vasut Signed-off-by: Bartosz Golaszewski commit 1bc5d819f0b9784043ea08570e1b21107aa35739 Author: Mark Pearson Date: Tue Jan 24 10:36:23 2023 -0500 platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms My last commit to fix profile mode displays on AMD platforms caused an issue on Intel platforms - sorry! In it I was reading the current functional mode (MMC, PSC, AMT) from the BIOS but didn't account for the fact that on some of our Intel platforms I use a different API which returns just the profile and not the functional mode. This commit fixes it so that on Intel platforms it knows the functional mode is always MMC. I also fixed a potential problem that a platform may try to set the mode for both MMC and PSC - which was incorrect. Tested on X1 Carbon 9 (Intel) and Z13 (AMD). Link: https://bugzilla.kernel.org/show_bug.cgi?id=216963 Fixes: fde5f74ccfc7 ("platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode") Cc: stable@vger.kernel.org Reviewed-by: Mario Limonciello Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230124153623.145188-1-mpearson-lenovo@squebb.ca Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit f2b0b5210f67c56a3bcdf92ff665fb285d6e0067 Author: Hyunwoo Kim Date: Mon Jan 23 11:43:23 2023 -0800 net/x25: Fix to not accept on connected socket When listen() and accept() are called on an x25 socket that connect() succeeds, accept() succeeds immediately. This is because x25_connect() queues the skb to sk->sk_receive_queue, and x25_accept() dequeues it. This creates a child socket with the sk of the parent x25 socket, which can cause confusion. Fix x25_listen() to return -EINVAL if the socket has already been successfully connect()ed to avoid this issue. Signed-off-by: Hyunwoo Kim Signed-off-by: David S. Miller commit 85eee6341abb81ac6a35062ffd5c3029eb53be6b Author: Keith Busch Date: Tue Jan 24 13:29:14 2023 -0800 nvme: fix passthrough csi check The namespace head saves the Command Set Indicator enum, so use that instead of the Command Set Selected. The two values are not the same. Fixes: 831ed60c2aca2d ("nvme: also return I/O command effects from nvme_command_effects") Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit ca0254998be4d74cf6add70ccfab0d2dbd362a10 Author: Liao Chang Date: Mon Jan 16 14:43:42 2023 +0800 riscv/kprobe: Fix instruction simulation of JALR Set kprobe at 'jalr 1140(ra)' of vfs_write results in the following crash: [ 32.092235] Unable to handle kernel access to user memory without uaccess routines at virtual address 00aaaaaad77b1170 [ 32.093115] Oops [#1] [ 32.093251] Modules linked in: [ 32.093626] CPU: 0 PID: 135 Comm: ftracetest Not tainted 6.2.0-rc2-00013-gb0aa5e5df0cb-dirty #16 [ 32.093985] Hardware name: riscv-virtio,qemu (DT) [ 32.094280] epc : ksys_read+0x88/0xd6 [ 32.094855] ra : ksys_read+0xc0/0xd6 [ 32.095016] epc : ffffffff801cda80 ra : ffffffff801cdab8 sp : ff20000000d7bdc0 [ 32.095227] gp : ffffffff80f14000 tp : ff60000080f9cb40 t0 : ffffffff80f13e80 [ 32.095500] t1 : ffffffff8000c29c t2 : ffffffff800dbc54 s0 : ff20000000d7be60 [ 32.095716] s1 : 0000000000000000 a0 : ffffffff805a64ae a1 : ffffffff80a83708 [ 32.095921] a2 : ffffffff80f160a0 a3 : 0000000000000000 a4 : f229b0afdb165300 [ 32.096171] a5 : f229b0afdb165300 a6 : ffffffff80eeebd0 a7 : 00000000000003ff [ 32.096411] s2 : ff6000007ff76800 s3 : fffffffffffffff7 s4 : 00aaaaaad77b1170 [ 32.096638] s5 : ffffffff80f160a0 s6 : ff6000007ff76800 s7 : 0000000000000030 [ 32.096865] s8 : 00ffffffc3d97be0 s9 : 0000000000000007 s10: 00aaaaaad77c9410 [ 32.097092] s11: 0000000000000000 t3 : ffffffff80f13e48 t4 : ffffffff8000c29c [ 32.097317] t5 : ffffffff8000c29c t6 : ffffffff800dbc54 [ 32.097505] status: 0000000200000120 badaddr: 00aaaaaad77b1170 cause: 000000000000000d [ 32.098011] [] ksys_write+0x6c/0xd6 [ 32.098222] [] sys_write+0x2a/0x38 [ 32.098405] [] ret_from_syscall+0x0/0x2 Since the rs1 and rd might be the same one, such as 'jalr 1140(ra)', hence it requires obtaining the target address from rs1 followed by updating rd. Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") Signed-off-by: Liao Chang Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230116064342.2092136-1-liaochang1@huawei.com [Palmer: Pick Guo's cleanup] Signed-off-by: Palmer Dabbelt commit e8c8fd9b8393d7064152c8806f5ac446d760a23e Merge: 74bc3a5acc82f c88ea16a8f892 Author: Alexei Starovoitov Date: Tue Jan 24 21:32:55 2023 -0800 Merge branch 'bpf, sockmap: Fix infinite recursion in sock_map_close' Jakub Sitnicki says: ==================== This patch set addresses the syzbot report in [1]. Patch #1 has been suggested by Eric [2]. I extended it to cover the rest of sock_map proto callbacks. Otherwise we would still overflow the stack. Patch #2 contains the actual fix and bug analysis. Patches #3 & #4 add coverage to selftests to trigger the bug. [1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/ [2] https://lore.kernel.org/all/CANn89iK2UN1FmdUcH12fv_xiZkv2G+Nskvmq7fG6aA_6VKRf6g@mail.gmail.com/ --- v1 -> v2: v1: https://lore.kernel.org/r/20230113-sockmap-fix-v1-0-d3cad092ee10@cloudflare.com [v1 didn't hit bpf@ ML by mistake] * pull in Eric's patch to protect against recursion loop bugs (Eric) * add a macro helper to check if pointer is inside a memory range (Eric) ==================== Signed-off-by: Alexei Starovoitov commit c88ea16a8f892bce3bfb3f6a0d91b2bb27df8f59 Author: Jakub Sitnicki Date: Sat Jan 21 13:41:46 2023 +0100 selftests/bpf: Cover listener cloning with progs attached to sockmap Today we test if a child socket is cloned properly from a listening socket inside a sockmap only when there are no BPF programs attached to the map. A bug has been reported [1] for the case when sockmap has a verdict program attached. So cover this case as well to prevent regressions. [1]: https://lore.kernel.org/r/00000000000073b14905ef2e7401@google.com Signed-off-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-4-1e0ee7ac2f90@cloudflare.com Signed-off-by: Alexei Starovoitov commit b4ea530d024ca6095fc80290075893a5b7136516 Author: Jakub Sitnicki Date: Sat Jan 21 13:41:45 2023 +0100 selftests/bpf: Pass BPF skeleton to sockmap_listen ops tests Following patch extends the sockmap ops tests to cover the scenario when a sockmap with attached programs holds listening sockets. Pass the BPF skeleton to sockmap ops test so that the can access and attach the BPF programs. Signed-off-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-3-1e0ee7ac2f90@cloudflare.com Signed-off-by: Alexei Starovoitov commit ddce1e091757d0259107c6c0c7262df201de2b66 Author: Jakub Sitnicki Date: Sat Jan 21 13:41:44 2023 +0100 bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener A listening socket linked to a sockmap has its sk_prot overridden. It points to one of the struct proto variants in tcp_bpf_prots. The variant depends on the socket's family and which sockmap programs are attached. A child socket cloned from a TCP listener initially inherits their sk_prot. But before cloning is finished, we restore the child's proto to the listener's original non-tcp_bpf_prots one. This happens in tcp_create_openreq_child -> tcp_bpf_clone. Today, in tcp_bpf_clone we detect if the child's proto should be restored by checking only for the TCP_BPF_BASE proto variant. This is not correct. The sk_prot of listening socket linked to a sockmap can point to to any variant in tcp_bpf_prots. If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then the child socket unintentionally is left if the inherited sk_prot by tcp_bpf_clone. This leads to issues like infinite recursion on close [1], because the child state is otherwise not set up for use with tcp_bpf_prot operations. Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants. Note that it wouldn't be sufficient to check the socket state when overriding the sk_prot in tcp_bpf_update_proto in order to always use the TCP_BPF_BASE variant for listening sockets. Since commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage") it is possible for a socket to transition to TCP_LISTEN state while already linked to a sockmap, e.g. connect() -> insert into map -> connect(AF_UNSPEC) -> listen(). [1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/ Fixes: e80251555f0b ("tcp_bpf: Don't let child socket inherit parent protocol ops on copy") Reported-by: syzbot+04c21ed96d861dccc5cd@syzkaller.appspotmail.com Signed-off-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-2-1e0ee7ac2f90@cloudflare.com Signed-off-by: Alexei Starovoitov commit 5b4a79ba65a1ab479903fff2e604865d229b70a9 Author: Jakub Sitnicki Date: Sat Jan 21 13:41:43 2023 +0100 bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursive loop to avoid a stack overflow in favor of a resource leak. [1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/ Suggested-by: Eric Dumazet Signed-off-by: Jakub Sitnicki Acked-by: John Fastabend Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-1-1e0ee7ac2f90@cloudflare.com Signed-off-by: Alexei Starovoitov commit 2a48216cff7a2e3964fbed16f84d33f68b3e5e42 Merge: 418e53401e478 a44b7651489f2 Author: Jakub Kicinski Date: Tue Jan 24 18:59:37 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Perform SCTP vtag verification for ABORT/SHUTDOWN_COMPLETE according to RFC 9260, Sect 8.5.1. 2) Fix infinite loop if SCTP chunk size is zero in for_each_sctp_chunk(). And remove useless check in this macro too. 3) Revert DATA_SENT state in the SCTP tracker, this was applied in the previous merge window. Next patch in this series provides a more simple approach to multihoming support. 4) Unify HEARTBEAT_ACKED and ESTABLISHED states for SCTP multihoming support, use default ESTABLISHED of 210 seconds based on heartbeat timeout * maximum number of retransmission + round-trip timeout. Otherwise, SCTP conntrack entry that represents secondary paths remain stale in the table for up to 5 days. This is a slightly large batch with fixes for the SCTP connection tracking helper, all patches from Sriram Yagnaraman. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: conntrack: unify established states for SCTP paths Revert "netfilter: conntrack: add sctp DATA_SENT state" netfilter: conntrack: fix bug in for_each_sctp_chunk netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE ==================== Link: https://lore.kernel.org/r/20230124183933.4752-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 418e53401e478a743cf33b1c32ea0728f0afef66 Author: Paul M Stillwell Jr Date: Mon Jan 23 16:57:14 2023 -0800 ice: move devlink port creation/deletion Commit a286ba738714 ("ice: reorder PF/representor devlink port register/unregister flows") moved the code to create and destroy the devlink PF port. This was fine, but created a corner case issue in the case of ice_register_netdev() failing. In that case, the driver would end up calling ice_devlink_destroy_pf_port() twice. Additionally, it makes no sense to tie creation of the devlink PF port to the creation of the netdev so separate out the code to create/destroy the devlink PF port from the netdev code. This makes it a cleaner interface. Fixes: a286ba738714 ("ice: reorder PF/representor devlink port register/unregister flows") Signed-off-by: Paul M Stillwell Jr Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230124005714.3996270-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 458e279f861d3f61796894cd158b780765a1569f Author: Marcelo Ricardo Leitner Date: Mon Jan 23 14:59:33 2023 -0300 sctp: fail if no bound addresses can be used for a given scope Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner Reviewed-by: Xin Long Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.1674496737.git.marcelo.leitner@gmail.com Signed-off-by: Jakub Kicinski commit 948ef7bb70c4acaf74d87420ea3a1190862d4548 Merge: 246dc53fb2461 0254127ab977e Author: Linus Torvalds Date: Tue Jan 24 18:19:44 2023 -0800 Merge tag 'modules-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module fix from Luis Chamberlain: "Theis is a fix we have been delaying for v6.2 due to lack of early testing on linux-next. The commit has been sitting in linux-next since December and testing has also been now a bit extensive by a few developers. Since this is a fix which definitely will go to v6.3 it should also apply to v6.2 so if there are any issues we pick them up earlier rather than later. The fix fixes a regression since v5.3, prior to me helping with module maintenance, however, the issue is real in that in the worst case now can prevent boot. We've discussed all possible corner cases [0] and at last do feel this is ready for v6.2-rc6" Link https://lore.kernel.org/all/Y9A4fiobL6IHp%2F%2FP@bombadil.infradead.org/ [0] * tag 'modules-6.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: Don't wait for GOING modules commit ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb Author: Eric Dumazet Date: Mon Jan 23 08:45:52 2023 +0000 net/sched: sch_taprio: do not schedule in taprio_reset() As reported by syzbot and hinted by Vinicius, I should not have added a qdisc_synchronize() call in taprio_reset() taprio_reset() can be called with qdisc spinlock held (and BH disabled) as shown in included syzbot report [1]. Only taprio_destroy() needed this synchronization, as explained in the blamed commit changelog. [1] BUG: scheduling while atomic: syz-executor150/5091/0x00000202 2 locks held by syz-executor150/5091: Modules linked in: Preemption disabled at: [<0000000000000000>] 0x0 Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ... CPU: 1 PID: 5091 Comm: syz-executor150 Not tainted 6.2.0-rc3-syzkaller-00219-g010a74f52203 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 panic+0x2cc/0x626 kernel/panic.c:318 check_panic_on_warn.cold+0x19/0x35 kernel/panic.c:238 __schedule_bug.cold+0xd5/0xfe kernel/sched/core.c:5836 schedule_debug kernel/sched/core.c:5865 [inline] __schedule+0x34e4/0x5450 kernel/sched/core.c:6500 schedule+0xde/0x1b0 kernel/sched/core.c:6682 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167 schedule_timeout_uninterruptible kernel/time/timer.c:2201 [inline] msleep+0xb6/0x100 kernel/time/timer.c:2322 qdisc_synchronize include/net/sch_generic.h:1295 [inline] taprio_reset+0x93/0x270 net/sched/sch_taprio.c:1703 qdisc_reset+0x10c/0x770 net/sched/sch_generic.c:1022 dev_reset_queue+0x92/0x130 net/sched/sch_generic.c:1285 netdev_for_each_tx_queue include/linux/netdevice.h:2464 [inline] dev_deactivate_many+0x36d/0x9f0 net/sched/sch_generic.c:1351 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1374 qdisc_graft+0xe4a/0x1380 net/sched/sch_api.c:1080 tc_modify_qdisc+0xb6b/0x19a0 net/sched/sch_api.c:1689 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] Fixes: 3a415d59c1db ("net/sched: sch_taprio: fix possible use-after-free") Link: https://lore.kernel.org/netdev/167387581653.2747.13878941339893288655.git-patchwork-notify@kernel.org/T/ Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20230123084552.574396-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 246dc53fb2461dbcd66d4d1d914246a581edad29 Merge: b2f317173ed5f 6618d69aa129a Author: Linus Torvalds Date: Tue Jan 24 17:54:25 2023 -0800 Merge tag 'rust-fixes-6.2' of https://github.com/Rust-for-Linux/linux Pull rust fix from Miguel Ojeda: - Avoid evaluating arguments in 'pr_*' macros in 'unsafe' blocks * tag 'rust-fixes-6.2' of https://github.com/Rust-for-Linux/linux: rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks commit b2f317173ed5f00a00aedba71cc67454d9cde90f Merge: 02db81a787e30 c2c46b10d5262 Author: Linus Torvalds Date: Tue Jan 24 17:48:09 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM64: - Pass the correct address to mte_clear_page_tags() on initialising a tagged page - Plug a race against a GICv4.1 doorbell interrupt while saving the vgic-v3 pending state. x86: - A command line parsing fix and a clang compilation fix for selftests - A fix for a longstanding VMX issue, that surprisingly was only found now to affect real world guests" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Make reclaim_period_ms input always be positive KVM: x86/vmx: Do not skip segment attributes if unusable bit is set selftests: kvm: move declaration at the beginning of main() KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation KVM: arm64: Pass the actual page address to mte_clear_page_tags() commit 02db81a787e304e5afaa31dc66522d39d3f89f1a Merge: fb6e71db53f3d 0bfe63d075789 Author: Linus Torvalds Date: Tue Jan 24 17:42:53 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Six fixes, all in drivers. The biggest are the UFS devfreq fixes which address a lock inversion and the two iscsi_tcp fixes which try to prevent a use after free from userspace still accessing an area which the kernel has released (seen by KASAN)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: device_handler: alua: Remove a might_sleep() annotation scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress scsi: ufs: core: Fix devfreq deadlocks scsi: hpsa: Fix allocation size for scsi_host_alloc() scsi: target: core: Fix warning on RT kernels commit ca0f2cfc495d9b614ac6431d7029f1f140403155 Author: Randy Dunlap Date: Tue Jan 24 10:16:55 2023 -0800 lib: Kconfig: fix spellos Fix spelling in lib/ Kconfig files. (reported by codespell) Link: https://lkml.kernel.org/r/20230124181655.16269-1-rdunlap@infradead.org Cc: Andrew Morton Cc: Marco Elver Cc: Dmitry Vyukov Cc: kasan-dev@googlegroups.com Reviewed-by: Marco Elver Signed-off-by: Randy Dunlap Signed-off-by: Steven Rostedt (Google) commit 8b152e9150d07a885f95e1fd401fc81af202d9a4 Author: Natalia Petrova Date: Wed Jan 11 15:04:09 2023 +0300 trace_events_hist: add check for return value of 'create_hist_field' Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20230111120409.4111-1-n.petrova@fintech.ru Cc: stable@vger.kernel.org Fixes: 30350d65ac56 ("tracing: Add variable support to hist triggers") Signed-off-by: Natalia Petrova Signed-off-by: Steven Rostedt (Google) commit 685b64e4d6da4be8b4595654a57db663b3d1dfc2 Author: Chuang Wang Date: Tue Dec 27 10:30:36 2022 +0800 tracing/osnoise: Use built-in RCU list checking list_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled. Execute as follow: [tracing]# echo osnoise > current_tracer [tracing]# echo 1 > tracing_on [tracing]# echo 0 > tracing_on The trace_types_lock is held when osnoise_tracer_stop() or timerlat_tracer_stop() are called in the non-RCU read side section. So, pass lockdep_is_held(&trace_types_lock) to silence false lockdep warning. Link: https://lkml.kernel.org/r/20221227023036.784337-1-nashuiliang@gmail.com Cc: Masami Hiramatsu Fixes: dae181349f1e ("tracing/osnoise: Support a list of trace_array *tr") Acked-by: Daniel Bristot de Oliveira Signed-off-by: Chuang Wang Signed-off-by: Steven Rostedt (Google) commit d9b6c322fd33d55a254756b0269d644851899e5f Author: Eddie James Date: Wed Jan 18 15:47:36 2023 +1030 ARM: dts: aspeed: Fix pca9849 compatible Missed a digit in the PCA9849 compatible string. Signed-off-by: Eddie James Fixes: 65b697e5dec7 ("ARM: dts: aspeed: Add IBM Bonnell system BMC devicetree") Link: https://lore.kernel.org/r/20220826194457.164492-1-eajames@linux.ibm.com Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230118051736.246714-1-joel@jms.id.au Signed-off-by: Arnd Bergmann commit fb6e71db53f3d4351dada7c130fb652eecf994d6 Merge: 50306df38ac4e 4bdbba54e9b1c Author: Linus Torvalds Date: Tue Jan 24 12:58:47 2023 -0800 Merge tag 'nfsd-6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Nail another UAF in NFSD's filecache * tag 'nfsd-6.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: don't free files unconditionally in __nfsd_file_cache_purge commit 50306df38ac4edbeb1eac29d68128f84630405d8 Merge: 5149394c89980 31e1be62abdeb Author: Linus Torvalds Date: Tue Jan 24 12:53:26 2023 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt MAINTAINERS entry update from Eric Biggers: "Update the MAINTAINERS file entry for fscrypt" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: MAINTAINERS: update fscrypt git repo commit 0254127ab977e70798707a7a2b757c9f3c971210 Author: Petr Pavlu Date: Mon Dec 5 11:35:57 2022 +0100 module: Don't wait for GOING modules During a system boot, it can happen that the kernel receives a burst of requests to insert the same module but loading it eventually fails during its init call. For instance, udev can make a request to insert a frequency module for each individual CPU when another frequency module is already loaded which causes the init function of the new module to return an error. Since commit 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for modules that have finished loading"), the kernel waits for modules in MODULE_STATE_GOING state to finish unloading before making another attempt to load the same module. This creates unnecessary work in the described scenario and delays the boot. In the worst case, it can prevent udev from loading drivers for other devices and might cause timeouts of services waiting on them and subsequently a failed boot. This patch attempts a different solution for the problem 6e6de3dee51a was trying to solve. Rather than waiting for the unloading to complete, it returns a different error code (-EBUSY) for modules in the GOING state. This should avoid the error situation that was described in 6e6de3dee51a (user space attempting to load a dependent module because the -EEXIST error code would suggest to user space that the first module had been loaded successfully), while avoiding the delay situation too. This has been tested on linux-next since December 2022 and passes all kmod selftests except test 0009 with module compression enabled but it has been confirmed that this issue has existed and has gone unnoticed since prior to this commit and can also be reproduced without module compression with a simple usleep(5000000) on tools/modprobe.c [0]. These failures are caused by hitting the kernel mod_concurrent_max and can happen either due to a self inflicted kernel module auto-loead DoS somehow or on a system with large CPU count and each CPU count incorrectly triggering many module auto-loads. Both of those issues need to be fixed in-kernel. [0] https://lore.kernel.org/all/Y9A4fiobL6IHp%2F%2FP@bombadil.infradead.org/ Fixes: 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for modules that have finished loading") Co-developed-by: Martin Wilck Signed-off-by: Martin Wilck Signed-off-by: Petr Pavlu Cc: stable@vger.kernel.org Reviewed-by: Petr Mladek [mcgrof: enhance commit log with testing and kmod test result interpretation ] Signed-off-by: Luis Chamberlain commit 5149394c899808667e0f8444d3d39cba1dfb42f7 Merge: 854f0912f813c ef7592e466ef7 Author: Linus Torvalds Date: Tue Jan 24 12:51:49 2023 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity MAINTAINERS entry update from Eric Biggers: "Update the MAINTAINERS file entry for fsverity" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: MAINTAINERS: update fsverity git repo, list, and patchwork commit 854f0912f813c3b7a4d35517658ca7f1511a69e2 Author: Linus Torvalds Date: Tue Jan 24 09:23:56 2023 -0800 ext4: make xattr char unsignedness in hash explicit Commit f3bbac32475b ("ext4: deal with legacy signed xattr name hash values") added a hashing function for the legacy case of having the xattr hash calculated using a signed 'char' type. It left the unsigned case alone, since it's all implicitly handled by the '-funsigned-char' compiler option. However, there's been some noise about back-porting it all into stable kernels that lack the '-funsigned-char', so let's just make that at least possible by making the whole 'this uses unsigned char' very explicit in the code itself. Whether such a back-port is really warranted or not, I'll leave to others, but at least together with this change it is technically sensible. Also, add a 'pr_warn_once()' for reporting the "hey, signedness for this hash calculation has changed" issue. Hopefully it never triggers except for that xfstests generic/454 test-case, but even if it does it's just good information to have. If for no other reason than "we can remove the legacy signed hash code entirely if nobody ever sees the message any more". Cc: Sasha Levin Cc: Eric Biggers Cc: Andreas Dilger Cc: Theodore Ts'o , Cc: Jason Donenfeld Cc: Masahiro Yamada Signed-off-by: Linus Torvalds commit 6757a7abe47bcb12cb2d45661067e182424b0ee3 Author: Srinivas Pandruvada Date: Mon Jan 23 09:21:10 2023 -0800 thermal: intel: int340x: Protect trip temperature from concurrent updates Trip temperatures are read using ACPI methods and stored in the memory during zone initializtion and when the firmware sends a notification for change. This trip temperature is returned when the thermal core calls via callback get_trip_temp(). But it is possible that while updating the memory copy of the trips when the firmware sends a notification for change, thermal core is reading the trip temperature via the callback get_trip_temp(). This may return invalid trip temperature. To address this add a mutex to protect the invalid temperature reads in the callback get_trip_temp() and int340x_thermal_read_trips(). Fixes: 5fbf7f27fa3d ("Thermal/int340x: Add common thermal zone handler") Signed-off-by: Srinivas Pandruvada Cc: 5.0+ # 5.0+ Signed-off-by: Rafael J. Wysocki commit 5a5754a4997c372292e57ed631807131c63cebaf Author: Keith Busch Date: Tue Jan 24 09:17:38 2023 -0800 nvme-pci: flush initial scan_work for async probe The nvme device may have a namespace with the root partition, so make sure we've completed scanning before returning from the async probe. Fixes: eac3ef262941 ("nvme-pci: split the initial probe from the rest path") Reported-by: Klaus Jensen Signed-off-by: Keith Busch Tested-by: Ville Syrjälä Tested-by: Klaus Jensen Signed-off-by: Christoph Hellwig commit ac28d0a0f40782d216f6aaaf22e0d8bded06a435 Author: Randy Dunlap Date: Tue Jan 24 10:16:47 2023 -0800 tracing: Kconfig: Fix spelling/grammar/punctuation Fix some editorial nits in trace Kconfig. Link: https://lkml.kernel.org/r/20230124181647.15902-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Steven Rostedt (Google) commit 7ae4ba7195b1bac04a4210a499da9d8c63b0ba9c Author: Steven Rostedt (Google) Date: Mon Jan 23 11:22:52 2023 -0500 ftrace/scripts: Update the instructions for ftrace-bisect.sh The instructions for the ftrace-bisect.sh script, which is used to find what function is being traced that is causing a kernel crash, and possibly a triple fault reboot, uses the old method. In 5.1, a new feature was added that let the user write in the index into available_filter_functions that maps to the function a user wants to set in set_ftrace_filter (or set_ftrace_notrace). This takes O(1) to set, as suppose to writing a function name, which takes O(n) (where n is the number of functions in available_filter_functions). The ftrace-bisect.sh requires setting half of the functions in available_filter_functions, which is O(n^2) using the name method to enable and can take several minutes to complete. The number method is O(n) which takes less than a second to complete. Using the number method for any kernel 5.1 and after is the proper way to do the bisect. Update the usage to reflect the new change, as well as using the /sys/kernel/tracing path instead of the obsolete debugfs path. Link: https://lkml.kernel.org/r/20230123112252.022003dd@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Acked-by: Mark Rutland Fixes: f79b3f338564e ("ftrace: Allow enabling of filters via index of available_filter_functions") Signed-off-by: Steven Rostedt (Google) commit 921deb9da15851425ccbb6ee409dc2fd8fbdfe6b Author: Udipto Goswami Date: Tue Jan 24 14:41:49 2023 +0530 usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait __ffs_ep0_queue_wait executes holding the spinlock of &ffs->ev.waitq.lock and unlocks it after the assignments to usb_request are done. However in the code if the request is already NULL we bail out returning -EINVAL but never unlocked the spinlock. Fix this by adding spin_unlock_irq &ffs->ev.waitq.lock before returning. Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait") Reviewed-by: John Keeping Signed-off-by: Udipto Goswami Link: https://lore.kernel.org/r/20230124091149.18647-1-quic_ugoswami@quicinc.com Signed-off-by: Greg Kroah-Hartman commit eb320f76e31dc835b9f57f04af1a2353b13bb7d8 Author: Neil Armstrong Date: Tue Jan 24 09:31:21 2023 +0100 usb: dwc3: qcom: enable vbus override when in OTG dr-mode With vbus override enabled when in OTG dr_mode, Host<->Peripheral switch now works on SM8550, otherwise the DWC3 seems to be stuck in Host mode only. Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Reviewed-by: Bryan O'Donoghue Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230123-topic-sm8550-upstream-dwc3-qcom-otg-v2-1-2d400e598463@linaro.org Signed-off-by: Greg Kroah-Hartman commit fa003a3c11efff1c42a0edbe8eee86fb1ebe6d7a Author: Daniel Scally Date: Tue Jan 24 15:39:09 2023 +0000 MAINTAINERS: Add myself as UVC Gadget Maintainer Add myself as a second maintainer for the UVC Gadget. Reviewed-by: Laurent Pinchart Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20230124153909.867202-1-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit d968117a7e8e5572762eacbdbca13bc96710e9a3 Author: Paolo Abeni Date: Tue Jan 24 17:44:14 2023 +0100 Revert "Merge branch 'ethtool-mac-merge'" This reverts commit 0ad999c1eec879f06cc52ef7df4d0dbee4a2d7eb, reversing changes made to e38553bdc377e3e7a6caa9dd9770d8b644d8dac3. It was not intended for net. Signed-off-by: Paolo Abeni commit 3bb06eb6e9acf7c4a3e1b5bc87aed398ff8e2253 Author: Steven Rostedt (Google) Date: Wed Jan 4 16:14:12 2023 -0500 tracing: Make sure trace_printk() can output as soon as it can be used Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be: [ 0.456075] -0 0dN.2. 347519us : Unknown type 6 [ 0.456075] -0 0dN.2. 353141us : Unknown type 6 [ 0.456075] -0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. Link: https://lkml.kernel.org/r/20230104161412.019f6c55@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Fixes: e725c731e3bb1 ("tracing: Split tracing initialization into two for early initialization") Reported-by: "Joel Fernandes (Google)" Tested-by: Joel Fernandes (Google) Signed-off-by: Steven Rostedt (Google) commit 8be9fbd5345da52f4a74f7f81d55ff9fa0a2958e Author: Mark Rutland Date: Tue Jan 3 12:49:11 2023 +0000 ftrace: Export ftrace_free_filter() to modules Setting filters on an ftrace ops results in some memory being allocated for the filter hashes, which must be freed before the ops can be freed. This can be done by removing every individual element of the hash by calling ftrace_set_filter_ip() or ftrace_set_filter_ips() with `remove` set, but this is somewhat error prone as it's easy to forget to remove an element. Make it easier to clean this up by exporting ftrace_free_filter(), which can be used to clean up all of the filter hashes after an ftrace_ops has been unregistered. Using this, fix the ftrace-direct* samples to free hashes prior to being unloaded. All other code either removes individual filters explicitly or is built-in and already calls ftrace_free_filter(). Link: https://lkml.kernel.org/r/20230103124912.2948963-3-mark.rutland@arm.com Cc: stable@vger.kernel.org Cc: Florent Revest Cc: Masami Hiramatsu Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modify interface") Fixes: 5fae941b9a6f ("ftrace/samples: Add multi direct interface test module") Reviewed-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Signed-off-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) commit 89c08aef8f8dcb5fc98ad8db7ca92c9dab1f26b0 Author: Hans Verkuil Date: Mon Jan 23 09:45:49 2023 +0100 media: videobuf2: set q->streaming later Commit a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops") moved up the q->streaming = 1 assignment to before the call to vb2_start_streaming(). This does make sense since q->streaming indicates that VIDIOC_STREAMON is called, and the call to start_streaming happens either at that time or later if q->min_buffers_needed > 0. So q->streaming should be 1 before start_streaming is called. However, it turned out that some drivers use vb2_is_streaming() in buf_queue, and if q->min_buffers_needed == 0, then that will now return true instead of false. So for the time being revert to the original behavior. Signed-off-by: Hans Verkuil Fixes: a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops") Reviewed-by: Laurent Pinchart Tested-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit facd61053cff100973921d4d45d47cf53c747ec6 Author: Christian Brauner Date: Fri Jan 20 12:55:04 2023 +0100 fuse: fixes after adapting to new posix acl api This cycle we ported all filesystems to the new posix acl api. While looking at further simplifications in this area to remove the last remnants of the generic dummy posix acl handlers we realized that we regressed fuse daemons that don't set FUSE_POSIX_ACL but still make use of posix acls. With the change to a dedicated posix acl api interacting with posix acls doesn't go through the old xattr codepaths anymore and instead only relies the get acl and set acl inode operations. Before this change fuse daemons that don't set FUSE_POSIX_ACL were able to get and set posix acl albeit with two caveats. First, that posix acls aren't cached. And second, that they aren't used for permission checking in the vfs. We regressed that use-case as we currently refuse to retrieve any posix acls if they aren't enabled via FUSE_POSIX_ACL. So older fuse daemons would see a change in behavior. We can restore the old behavior in multiple ways. We could change the new posix acl api and look for a dedicated xattr handler and if we find one prefer that over the dedicated posix acl api. That would break the consistency of the new posix acl api so we would very much prefer not to do that. We could introduce a new ACL_*_CACHE sentinel that would instruct the vfs permission checking codepath to not call into the filesystem and ignore acls. But a more straightforward fix for v6.2 is to do the same thing that Overlayfs does and give fuse a separate get acl method for permission checking. Overlayfs uses this to express different needs for vfs permission lookup and acl based retrieval via the regular system call path as well. Let fuse do the same for now. This way fuse can continue to refuse to retrieve posix acls for daemons that don't set FUSE_POSXI_ACL for permission checking while allowing a fuse server to retrieve it via the usual system calls. In the future, we could extend the get acl inode operation to not just pass a simple boolean to indicate rcu lookup but instead make it a flag argument. Then in addition to passing the information that this is an rcu lookup to the filesystem we could also introduce a flag that tells the filesystem that this is a request from the vfs to use these acls for permission checking. Then fuse could refuse the get acl request for permission checking when the daemon doesn't have FUSE_POSIX_ACL set in the same get acl method. This would also help Overlayfs and allow us to remove the second method for it as well. But since that change is more invasive as we need to update the get acl inode operation for multiple filesystems we should not do this as a fix for v6.2. Instead we will do this for the v6.3 merge window. Fwiw, since posix acls are now always correctly translated in the new posix acl api we could also allow them to be used for daemons without FUSE_POSIX_ACL that are not mounted on the host. But this is behavioral change and again if dones should be done for v6.3. For now, let's just restore the original behavior. A nice side-effect of this change is that for fuse daemons with and without FUSE_POSIX_ACL the same code is used for posix acls in a backwards compatible way. This also means we can remove the legacy xattr handlers completely. We've also added comments to explain the expected behavior for daemons without FUSE_POSIX_ACL into the code. Fixes: 318e66856dde ("xattr: use posix acl api") Signed-off-by: Seth Forshee (Digital Ocean) Reviewed-by: Miklos Szeredi Signed-off-by: Christian Brauner (Microsoft) commit b0935f110cff5d70da05c5cb1670bee0b07b631c Author: Hans de Goede Date: Tue Jan 24 11:57:54 2023 +0100 ACPI: video: Fix apple gmux detection Some apple laptop models have an ACPI device with a HID of APP000B and that device has an IO resource (so it does not describe the new unsupported MMIO based gmux type), but there actually is no gmux in the laptop at all. The gmux_probe() function of the actual apple-gmux driver has code to detect this, this code has been factored out into a new apple_gmux_detect() helper in apple-gmux.h. Use this new function to fix acpi_video_get_backlight_type() wrongly returning apple_gmux as type on the following laptops: MacBookPro5,4 https://pastebin.com/8Xjq7RhS MacBookPro8,1 https://linux-hardware.org/?probe=e513cfbadb&log=dmesg MacBookPro9,2 https://bugzilla.kernel.org/attachment.cgi?id=278961 MacBookPro10,2 https://lkml.org/lkml/2014/9/22/657 MacBookPro11,2 https://forums.fedora-fr.org/viewtopic.php?id=70142 MacBookPro11,4 https://raw.githubusercontent.com/im-0/investigate-card-reader-suspend-problem-on-mbp11.4/mast Fixes: 21245df307cb ("ACPI: video: Add Apple GMUX brightness control detection") Link: https://lore.kernel.org/platform-driver-x86/20230123113750.462144-1-hdegoede@redhat.com/ Reported-by: Emmanouil Kouroupakis Acked-by: Rafael J. Wysocki Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230124105754.62167-4-hdegoede@redhat.com commit d143908f80f3e5d164ac3342f73d6b9f536e8b4d Author: Hans de Goede Date: Tue Jan 24 11:57:53 2023 +0100 platform/x86: apple-gmux: Add apple_gmux_detect() helper Add a new (static inline) apple_gmux_detect() helper to apple-gmux.h which can be used for gmux detection instead of apple_gmux_present(). The latter is not really reliable since an ACPI device with a HID of APP000B is present on some devices without a gmux at all, as well as on devices with a newer (unsupported) MMIO based gmux model. This causes apple_gmux_present() to return false-positives on a number of different Apple laptop models. This new helper uses the same probing as the actual apple-gmux driver, so that it does not return false positives. To avoid code duplication the gmux_probe() function of the actual driver is also moved over to using the new apple_gmux_detect() helper. This avoids false positives (vs _HID + IO region detection) on: MacBookPro5,4 https://pastebin.com/8Xjq7RhS MacBookPro8,1 https://linux-hardware.org/?probe=e513cfbadb&log=dmesg MacBookPro9,2 https://bugzilla.kernel.org/attachment.cgi?id=278961 MacBookPro10,2 https://lkml.org/lkml/2014/9/22/657 MacBookPro11,2 https://forums.fedora-fr.org/viewtopic.php?id=70142 MacBookPro11,4 https://raw.githubusercontent.com/im-0/investigate-card-reader-suspend-problem-on-mbp11.4/master/test-16/dmesg Fixes: 21245df307cb ("ACPI: video: Add Apple GMUX brightness control detection") Link: https://lore.kernel.org/platform-driver-x86/20230123113750.462144-1-hdegoede@redhat.com/ Reported-by: Emmanouil Kouroupakis Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230124105754.62167-3-hdegoede@redhat.com commit 39f5a81f7ad80eb3fbcbfd817c6552db9de5504d Author: Hans de Goede Date: Tue Jan 24 11:57:52 2023 +0100 platform/x86: apple-gmux: Move port defines to apple-gmux.h This is a preparation patch for adding a new static inline apple_gmux_detect() helper which actually checks a supported gmux is present, rather then only checking an ACPI device with the HID is there as apple_gmux_present() does. Fixes: 21245df307cb ("ACPI: video: Add Apple GMUX brightness control detection") Link: https://lore.kernel.org/platform-driver-x86/20230123113750.462144-1-hdegoede@redhat.com/ Reported-by: Emmanouil Kouroupakis Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230124105754.62167-2-hdegoede@redhat.com commit ce95010ef62d4bf470928969bafc9070ae98cbb1 Author: Hans de Goede Date: Mon Jan 23 14:28:24 2023 +0100 platform/x86: hp-wmi: Fix cast to smaller integer type warning Fix the following compiler warning: drivers/platform/x86/hp/hp-wmi.c:551:24: warning: cast to smaller integer type 'enum hp_wmi_radio' from 'void *' [-Wvoid-pointer-to-enum-cast] Reported-by: kernel test robot Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230123132824.660062-1-hdegoede@redhat.com commit 062c1394cbda95b0c51839b5221c7267e1e7f57e Author: Mario Limonciello Date: Fri Jan 20 13:15:19 2023 -0600 platform/x86/amd: pmc: Add a module parameter to disable workarounds Some users may want to live with the bugs that exist in platform firmware and have workarounds in AMD PMC driver. To allow them to bypass these workarounds, introduce a module parameter. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230120191519.15926-2-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8e60615e8932167057b363c11a7835da7f007106 Author: Mario Limonciello Date: Fri Jan 20 13:15:18 2023 -0600 platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN By default when the system is configured for low power idle in the FADT the keyboard is set up as a wake source. This matches the behavior that Windows uses for Modern Standby as well. It has been reported that a variety of AMD based designs there are spurious wakeups are happening where two IRQ sources are active. For example: ``` PM: Triggering wakeup from IRQ 9 PM: Triggering wakeup from IRQ 1 ``` In these designs IRQ 9 is the ACPI SCI and IRQ 1 is the keyboard. One way to trigger this problem is to suspend the laptop and then unplug the AC adapter. The SOC will be in a hardware sleep state and plugging in the AC adapter returns control to the kernel's s2idle loop. Normally if just IRQ 9 was active the s2idle loop would advance any EC transactions and no other IRQ being active would cause the s2idle loop to put the SOC back into hardware sleep state. When this bug occurred IRQ 1 is also active even if no keyboard activity occurred. This causes the s2idle loop to break and the system to wake. This is a platform firmware bug triggering IRQ1 without keyboard activity. This occurs in Windows as well, but Windows will enter "SW DRIPS" and then with no activity enters back into "HW DRIPS" (hardware sleep state). This issue affects Renoir, Lucienne, Cezanne, and Barcelo platforms. It does not happen on newer systems such as Mendocino or Rembrandt. It's been fixed in newer platform firmware. To avoid triggering the bug on older systems check the SMU F/W version and adjust the policy at suspend time for s2idle wakeup from keyboard on these systems. A lot of thought and experimentation has been given around the timing of disabling IRQ1, and to make it work the "suspend" PM callback is restored. Reported-by: Kai-Heng Feng Reported-by: Xaver Hugl Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2115 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1951 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230120191519.15926-1-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit fdcc0602d64f22185f61c70747214b630049cc33 Author: Hans de Goede Date: Fri Jan 20 15:34:41 2023 +0100 platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting Commit 1ea0d3b46798 ("platform/x86: asus-wmi: Simplify tablet-mode-switch handling") unified the asus-wmi tablet-switch handling, but it did not take into account that the value returned for the kbd_dock_devid WMI method is inverted where as the other ones are not inverted. This causes asus-wmi to report an inverted tablet-switch state for devices which use the kbd_dock_devid, which causes libinput to ignore touchpad events while the affected T10x model 2-in-1s are docked. Add inverting of the return value in the kbd_dock_devid case to fix this. Fixes: 1ea0d3b46798 ("platform/x86: asus-wmi: Simplify tablet-mode-switch handling") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230120143441.527334-1-hdegoede@redhat.com commit a410429a3b7e748a9db9f357e71e2e085a21c902 Author: Kevin Kuriakose Date: Thu Jan 19 20:39:25 2023 +0530 platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF To the best of my knowledge this is the same board as the B450M DS3H-CF, but with an added WiFi card. Name obtained using dmidecode, tested with force_load on v6.1.6 Signed-off-by: Kevin Kuriakose Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20230119150925.31962-1-kevinmkuriakose@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3ee5447b2048c8389ed899838a40b40180d50906 Author: Rishit Bansal Date: Sat Jan 21 03:42:14 2023 +0530 platform/x86: hp-wmi: Handle Omen Key event Add support to map the "HP Omen Key" to KEY_PROG2. Laptops in the HP Omen Series open the HP Omen Command Center application on windows. But, on linux it fails with the following message from the hp-wmi driver: [ 5143.415714] hp_wmi: Unknown event_id - 29 - 0x21a5 Also adds support to map Fn+Esc to KEY_FN_ESC. This currently throws the following message on the hp-wmi driver: [ 6082.143785] hp_wmi: Unknown key code - 0x21a7 There is also a "Win-Lock" key on HP Omen Laptops which supports Enabling and Disabling the Windows key, which trigger commands 0x21a4 and 0x121a4 respectively, but I wasn't able to find any KEY in input.h to map this to. Signed-off-by: Rishit Bansal Link: https://lore.kernel.org/r/20230120221214.24426-1-rishitbansal0@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 83bcf3e52e9cfc727df33f1055ef0618c91719d0 Author: Koba Ko Date: Tue Jan 17 20:34:36 2023 +0800 platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Some platforms send the speaker-mute key from EC. dell-wmi can't recognize it. Add a new keymap for KEY_MUTE in type 0x0010 table. Signed-off-by: Koba Ko Link: https://lore.kernel.org/r/20230117123436.200440-1-koba.ko@canonical.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 Author: Kuniyuki Iwashima Date: Fri Jan 20 15:19:27 2023 -0800 netrom: Fix use-after-free of a listening socket. syzbot reported a use-after-free in do_accept(), precisely nr_accept() as sk_prot_alloc() allocated the memory and sock_put() frees it. [0] The issue could happen if the heartbeat timer is fired and nr_heartbeat_expiry() calls nr_destroy_socket(), where a socket has SOCK_DESTROY or a listening socket has SOCK_DEAD. In this case, the first condition cannot be true. SOCK_DESTROY is flagged in nr_release() only when the file descriptor is close()d, but accept() is being called for the listening socket, so the second condition must be true. Usually, the AF_NETROM listener neither starts timers nor sets SOCK_DEAD. However, the condition is met if connect() fails before listen(). connect() starts the t1 timer and heartbeat timer, and t1timer calls nr_disconnect() when timeout happens. Then, SOCK_DEAD is set, and if we call listen(), the heartbeat timer calls nr_destroy_socket(). nr_connect nr_establish_data_link(sk) nr_start_t1timer(sk) nr_start_heartbeat(sk) nr_t1timer_expiry nr_disconnect(sk, ETIMEDOUT) nr_sk(sk)->state = NR_STATE_0 sk->sk_state = TCP_CLOSE sock_set_flag(sk, SOCK_DEAD) nr_listen if (sk->sk_state != TCP_LISTEN) sk->sk_state = TCP_LISTEN nr_heartbeat_expiry switch (nr->state) case NR_STATE_0 if (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD)) nr_destroy_socket(sk) This path seems expected, and nr_destroy_socket() is called to clean up resources. Initially, there was sock_hold() before nr_destroy_socket() so that the socket would not be freed, but the commit 517a16b1a88b ("netrom: Decrease sock refcount when sock timers expire") accidentally removed it. To fix use-after-free, let's add sock_hold(). [0]: BUG: KASAN: use-after-free in do_accept+0x483/0x510 net/socket.c:1848 Read of size 8 at addr ffff88807978d398 by task syz-executor.3/5315 CPU: 0 PID: 5315 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-00165-gd9fc1511728c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 do_accept+0x483/0x510 net/socket.c:1848 __sys_accept4_file net/socket.c:1897 [inline] __sys_accept4+0x9a/0x120 net/socket.c:1927 __do_sys_accept net/socket.c:1944 [inline] __se_sys_accept net/socket.c:1941 [inline] __x64_sys_accept+0x75/0xb0 net/socket.c:1941 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa436a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa437784168 EFLAGS: 00000246 ORIG_RAX: 000000000000002b RAX: ffffffffffffffda RBX: 00007fa436bac050 RCX: 00007fa436a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007fa436ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffebc6700df R14: 00007fa437784300 R15: 0000000000022000 Allocated by task 5294: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 14: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_heartbeat_expiry+0x1d7/0x460 net/netrom/nr_timer.c:148 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700 expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] __run_timers kernel/time/timer.c:1995 [inline] run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035 __do_softirq+0x1fb/0xadc kernel/softirq.c:571 Fixes: 517a16b1a88b ("netrom: Decrease sock refcount when sock timers expire") Reported-by: syzbot+5fafd5cfe1fc91f6b352@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230120231927.51711-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit d6591da5f3ff284a376d56b5f7a48a34e9cb159d Author: Javier Martinez Canillas Date: Sat Jan 21 20:24:18 2023 +0100 drm/fb-helper: Use a per-driver FB deferred I/O handler The DRM fbdev emulation layer sets the struct fb_info .fbdefio field to a struct fb_deferred_io pointer, that is shared across all drivers that use the generic drm_fbdev_generic_setup() helper function. It is a problem because the fbdev core deferred I/O logic assumes that the struct fb_deferred_io data is not shared between devices, and it's stored there state such as the list of pages touched and a mutex that is use to synchronize between the fb_deferred_io_track_page() function that track the dirty pages and fb_deferred_io_work() workqueue handler doing the actual deferred I/O. The latter can lead to the following error, since it may happen that two drivers are probed and then one is removed, which causes the mutex bo be destroyed and not existing anymore by the time the other driver tries to grab it for the fbdev deferred I/O logic: [ 369.756553] ------------[ cut here ]------------ [ 369.756604] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 369.756631] WARNING: CPU: 2 PID: 1023 at kernel/locking/mutex.c:582 __mutex_lock+0x348/0x424 [ 369.756744] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ip v6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr btsdio bluetooth sunrpc brcmfmac snd_soc_hdmi_codec cpufreq_dt cfg80211 vfat fat vc4 rfkill brcmutil raspberrypi_cpufreq i2c_bcm2835 iproc_rng200 bcm2711_thermal snd_soc_core snd_pcm_dmaen gine leds_gpio nvmem_rmem joydev hid_cherry uas usb_storage gpio_raspberrypi_exp v3d snd_pcm raspberrypi_hwmon gpu_sched bcm2835_wdt broadcom bcm_phy_lib snd_timer genet snd mdio_bcm_unimac clk_bcm2711_dvp soundcore drm_display_helper pci e_brcmstb cec ip6_tables ip_tables fuse [ 369.757400] CPU: 2 PID: 1023 Comm: fbtest Not tainted 5.19.0-rc6+ #94 [ 369.757455] Hardware name: raspberrypi,4-model-b Raspberry Pi 4 Model B Rev 1.4/Raspberry Pi 4 Model B Rev 1.4, BIOS 2022.10 10/01/2022 [ 369.757538] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 369.757596] pc : __mutex_lock+0x348/0x424 [ 369.757635] lr : __mutex_lock+0x348/0x424 [ 369.757672] sp : ffff80000953bb00 [ 369.757703] x29: ffff80000953bb00 x28: ffff17fdc087c000 x27: 0000000000000002 [ 369.757771] x26: ffff17fdc349f9b0 x25: fffffc5ff72e0100 x24: 0000000000000000 [ 369.757838] x23: 0000000000000000 x22: 0000000000000002 x21: ffffa618df636f10 [ 369.757903] x20: ffff80000953bb68 x19: ffffa618e0f18138 x18: 0000000000000001 [ 369.757968] x17: 0000000020000000 x16: 0000000000000002 x15: 0000000000000000 [ 369.758032] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 5f534b434f4c5f47 [ 369.758097] x11: 00000000ffffdfff x10: ffffa618e0c79f88 x9 : ffffa618de472484 [ 369.758162] x8 : 000000000002ffe8 x7 : c0000000ffffdfff x6 : 00000000000affa8 [ 369.758227] x5 : 0000000000001fff x4 : 0000000000000000 x3 : 0000000000000027 [ 369.758292] x2 : 0000000000000001 x1 : ffff17fdc087c000 x0 : 0000000000000028 [ 369.758357] Call trace: [ 369.758383] __mutex_lock+0x348/0x424 [ 369.758420] mutex_lock_nested+0x4c/0x5c [ 369.758459] fb_deferred_io_mkwrite+0x78/0x1d8 [ 369.758507] do_page_mkwrite+0x5c/0x19c [ 369.758550] wp_page_shared+0x70/0x1a0 [ 369.758590] do_wp_page+0x3d0/0x510 [ 369.758628] handle_pte_fault+0x1c0/0x1e0 [ 369.758670] __handle_mm_fault+0x250/0x380 [ 369.758712] handle_mm_fault+0x17c/0x3a4 [ 369.758753] do_page_fault+0x158/0x530 [ 369.758792] do_mem_abort+0x50/0xa0 [ 369.758831] el0_da+0x78/0x19c [ 369.758864] el0t_64_sync_handler+0xbc/0x150 [ 369.758904] el0t_64_sync+0x190/0x194 [ 369.758942] irq event stamp: 11395 [ 369.758973] hardirqs last enabled at (11395): [] __up_console_sem+0x74/0x80 [ 369.759042] hardirqs last disabled at (11394): [] __up_console_sem+0x6c/0x80 [ 369.760554] softirqs last enabled at (11392): [] __do_softirq+0x4c4/0x6b8 [ 369.762060] softirqs last disabled at (11383): [] __irq_exit_rcu+0x104/0x214 [ 369.763564] ---[ end trace 0000000000000000 ]--- Fixes: d536540f304c ("drm/fb-helper: Add generic fbdev emulation .fb_probe function") Signed-off-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230121192418.2814955-4-javierm@redhat.com commit cc88ad784e42398b8845594fe3aa720d0cc1c40c Author: Javier Martinez Canillas Date: Sat Jan 21 20:24:17 2023 +0100 drm/fb-helper: Check fb_deferred_io_init() return value The fb_deferred_io_init() can fail and return an errno code but currently there is no check for its return value. Fix that and propagate to errno to the caller in the case of a failure. Fixes: d536540f304c ("drm/fb-helper: Add generic fbdev emulation .fb_probe function") Signed-off-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230121192418.2814955-3-javierm@redhat.com commit 6a28a25d358079b7d0d144689f850aecacf63cba Author: Victor Shyba Date: Mon Jan 23 19:21:29 2023 -0300 ALSA: hda/realtek: Add Acer Predator PH315-54 Same issue as SP513-54N: Headset microphone does not work without ALC255_FIXUP_ACER_MIC_NO_PRESENCE fixup. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211853 Cc: Signed-off-by: Victor Shyba Link: https://lore.kernel.org/r/20230123222129.17589-1-victor1984@riseup.net Signed-off-by: Takashi Iwai commit a44b7651489f26271ac784b70895e8a85d0cebf4 Author: Sriram Yagnaraman Date: Tue Jan 24 02:47:21 2023 +0100 netfilter: conntrack: unify established states for SCTP paths An SCTP endpoint can start an association through a path and tear it down over another one. That means the initial path will not see the shutdown sequence, and the conntrack entry will remain in ESTABLISHED state for 5 days. By merging the HEARTBEAT_ACKED and ESTABLISHED states into one ESTABLISHED state, there remains no difference between a primary or secondary path. The timeout for the merged ESTABLISHED state is set to 210 seconds (hb_interval * max_path_retrans + rto_max). So, even if a path doesn't see the shutdown sequence, it will expire in a reasonable amount of time. With this change in place, there is now more than one state from which we can transition to ESTABLISHED, COOKIE_ECHOED and HEARTBEAT_SENT, so handle the setting of ASSURED bit whenever a state change has happened and the new state is ESTABLISHED. Removed the check for dir==REPLY since the transition to ESTABLISHED can happen only in the reply direction. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Sriram Yagnaraman Signed-off-by: Pablo Neira Ayuso commit 13bd9b31a969b03c8ec1d4eb0f2b9aebd30ebfd8 Author: Sriram Yagnaraman Date: Tue Jan 24 02:47:20 2023 +0100 Revert "netfilter: conntrack: add sctp DATA_SENT state" This reverts commit (bff3d0534804: "netfilter: conntrack: add sctp DATA_SENT state") Using DATA/SACK to detect a new connection on secondary/alternate paths works only on new connections, while a HEARTBEAT is required on connection re-use. It is probably consistent to wait for HEARTBEAT to create a secondary connection in conntrack. Signed-off-by: Sriram Yagnaraman Signed-off-by: Pablo Neira Ayuso commit 98ee0077452527f971567db01386de3c3d97ce13 Author: Sriram Yagnaraman Date: Tue Jan 24 02:47:19 2023 +0100 netfilter: conntrack: fix bug in for_each_sctp_chunk skb_header_pointer() will return NULL if offset + sizeof(_sch) exceeds skb->len, so this offset < skb->len test is redundant. if sch->length == 0, this will end up in an infinite loop, add a check for sch->length > 0 Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Suggested-by: Florian Westphal Signed-off-by: Sriram Yagnaraman Signed-off-by: Pablo Neira Ayuso commit a9993591fa94246b16b444eea55d84c54608282a Author: Sriram Yagnaraman Date: Tue Jan 24 02:47:18 2023 +0100 netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE RFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk MUST be accepted if the vtag of the packet matches its own tag and the T bit is not set OR if it is set to its peer's vtag and the T bit is set in chunk flags. Otherwise the packet MUST be silently dropped. Update vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above description. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Sriram Yagnaraman Signed-off-by: Pablo Neira Ayuso commit 208a21107ef0ae86c92078caf84ce80053e73f7a Merge: 571cca79df0a6 e2b53ea5a7c1f Author: Jakub Kicinski Date: Mon Jan 23 22:36:58 2023 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-01-20 (iavf) This series contains updates to iavf driver only. Michal Schmidt converts single iavf workqueue to per adapter to avoid deadlock issues. Marcin moves setting of VLAN related netdev features to watchdog task to avoid RTNL deadlock. Stefan Assmann schedules immediate watchdog task execution on changing primary MAC to avoid excessive delay. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: schedule watchdog immediately when changing primary MAC iavf: Move netdev_update_features() into watchdog task iavf: fix temporary deadlock and failure to set MAC address ==================== Link: https://lore.kernel.org/r/20230120211036.430946-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 571cca79df0a6c0ae9f14be7381e13dad4078fbf Merge: bce4affe30b29 5d235d6ce75c1 Author: Jakub Kicinski Date: Mon Jan 23 21:50:58 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix overlap detection in rbtree set backend: Detect overlap by going through the ordered list of valid tree nodes. To shorten the number of visited nodes in the list, this algorithm descends the tree to search for an existing element greater than the key value to insert that is greater than the new element. 2) Fix for the rbtree set garbage collector: Skip inactive and busy elements when checking for expired elements to avoid interference with an ongoing transaction from control plane. This is a rather large fix coming at this stage of the 6.2-rc. Since 33c7aba0b4ff ("netfilter: nf_tables: do not set up extensions for end interval"), bogus overlap errors in the rbtree set occur more frequently. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netfilter: nft_set_rbtree: Switch to node list walk for overlap detection ==================== Link: https://lore.kernel.org/r/20230123211601.292930-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit bce4affe30b297bfa3092bb53e879c0bd86901ab Author: Mat Martineau Date: Fri Jan 20 15:11:21 2023 -0800 MAINTAINERS: Update MPTCP maintainer list and CREDITS My responsibilities at Intel have changed, so I'm handing off exclusive MPTCP subsystem maintainer duties to Matthieu. It has been a privilege to see MPTCP through its initial upstreaming and first few years in the upstream kernel! Acked-by: Matthieu Baerts Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230120231121.36121-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit 8a4f6d023221c4b052ddfa1db48b27871bad6e96 Author: Alexandru Tachici Date: Fri Jan 20 11:08:46 2023 +0200 net: ethernet: adi: adin1110: Fix multicast offloading Driver marked broadcast/multicast frames as offloaded incorrectly. Mark them as offloaded only when HW offloading has been enabled. This should happen only for ADIN2111 when both ports are bridged by the software. Fixes: bc93e19d088b ("net: ethernet: adi: Add ADIN1110 support") Signed-off-by: Alexandru Tachici Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230120090846.18172-1-alexandru.tachici@analog.com Signed-off-by: Jakub Kicinski commit 360fdc999d92db4a4adbba0db8641396dc9f1b13 Author: Ahmad Fatoum Date: Fri Jan 20 12:09:32 2023 +0100 net: dsa: microchip: fix probe of I2C-connected KSZ8563 Starting with commit eee16b147121 ("net: dsa: microchip: perform the compatibility check for dev probed"), the KSZ switch driver now bails out if it thinks the DT compatible doesn't match the actual chip ID read back from the hardware: ksz9477-switch 1-005f: Device tree specifies chip KSZ9893 but found KSZ8563, please fix it! For the KSZ8563, which used ksz_switch_chips[KSZ9893], this was fine at first, because it indeed shares the same chip id as the KSZ9893. Commit b44908095612 ("net: dsa: microchip: add separate struct ksz_chip_data for KSZ8563 chip") started differentiating KSZ9893 compatible chips by consulting the 0x1F register. The resulting breakage was fixed for the SPI driver in the same commit by introducing the appropriate ksz_switch_chips[KSZ8563], but not for the I2C driver. Fix this for I2C-connected KSZ8563 now to get it probing again. Fixes: b44908095612 ("net: dsa: microchip: add separate struct ksz_chip_data for KSZ8563 chip"). Reviewed-by: Andrew Lunn Signed-off-by: Ahmad Fatoum Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230120110933.1151054-1-a.fatoum@pengutronix.de Signed-off-by: Jakub Kicinski commit 5e9398a26a92fc402d82ce1f97cc67d832527da0 Author: Eric Dumazet Date: Fri Jan 20 13:31:40 2023 +0000 ipv4: prevent potential spectre v1 gadget in fib_metrics_match() if (!type) continue; if (type > RTAX_MAX) return false; ... fi_val = fi->fib_metrics->metrics[type - 1]; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 5f9ae3d9e7e4 ("ipv4: do metrics match when looking up and deleting a route") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230120133140.3624204-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8 Author: Eric Dumazet Date: Fri Jan 20 13:30:40 2023 +0000 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 6cf9dfd3bd62 ("net: fib: move metrics parsing to a helper") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230120133040.3623463-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d6ab640c21ed3b471e42ea783223c396e102c02d Merge: 9f535c870e493 9b663b5cbb15b Author: Jakub Kicinski Date: Mon Jan 23 21:35:55 2023 -0800 Merge branch 'netlink-annotate-various-data-races' Eric Dumazet says: ==================== netlink: annotate various data races A recent syzbot report came to my attention. After addressing it, I also fixed other related races. ==================== Link: https://lore.kernel.org/r/20230120125955.3453768-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9b663b5cbb15b494ef132a3c937641c90646eb73 Author: Eric Dumazet Date: Fri Jan 20 12:59:55 2023 +0000 netlink: annotate data races around sk_state netlink_getsockbyportid() reads sk_state while a concurrent netlink_connect() can change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 004db64d185a5f23dfb891d7701e23713b2420ee Author: Eric Dumazet Date: Fri Jan 20 12:59:54 2023 +0000 netlink: annotate data races around dst_portid and dst_group netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid() can read nlk->dst_portid and nlk->dst_group while another thread is changing them. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit c1bb9484e3b05166880da8574504156ccbd0549e Author: Eric Dumazet Date: Fri Jan 20 12:59:53 2023 +0000 netlink: annotate data races around nlk->portid syzbot reminds us netlink_getname() runs locklessly [1] This first patch annotates the race against nlk->portid. Following patches take care of the remaining races. [1] BUG: KCSAN: data-race in netlink_getname / netlink_insert write to 0xffff88814176d310 of 4 bytes by task 2315 on cpu 1: netlink_insert+0xf1/0x9a0 net/netlink/af_netlink.c:583 netlink_autobind+0xae/0x180 net/netlink/af_netlink.c:856 netlink_sendmsg+0x444/0x760 net/netlink/af_netlink.c:1895 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x19a/0x230 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88814176d310 of 4 bytes by task 2316 on cpu 0: netlink_getname+0xcd/0x1a0 net/netlink/af_netlink.c:1144 __sys_getsockname+0x11d/0x1b0 net/socket.c:2026 __do_sys_getsockname net/socket.c:2041 [inline] __se_sys_getsockname net/socket.c:2038 [inline] __x64_sys_getsockname+0x3e/0x50 net/socket.c:2038 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0xc9a49780 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 2316 Comm: syz-executor.2 Not tainted 6.2.0-rc3-syzkaller-00030-ge8f60cd7db24-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: Jakub Kicinski commit 08279468a294d8c996a657ecc9e51bd5c084c75d Author: Arnd Bergmann Date: Tue Jan 17 18:24:44 2023 +0100 rtc: sunplus: fix format string for printing resource On 32-bit architectures with 64-bit resource_size_t, sp_rtc_probe() causes a compiler warning: drivers/rtc/rtc-sunplus.c: In function 'sp_rtc_probe': drivers/rtc/rtc-sunplus.c:243:33: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] 243 | dev_dbg(&plat_dev->dev, "res = 0x%x, reg_base = 0x%lx\n", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The best way to print a resource is the special %pR format string, and similarly to print a pointer we can use %p and avoid the cast. Fixes: fad6cbe9b2b4 ("rtc: Add driver for RTC in Sunplus SP7021") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230117172450.2938962-1-arnd@kernel.org Signed-off-by: Alexandre Belloni commit 5d235d6ce75c12a7fdee375eb211e4116f7ab01b Author: Pablo Neira Ayuso Date: Sat Jan 14 23:49:46 2023 +0100 netfilter: nft_set_rbtree: skip elements in transaction from garbage collection Skip interference with an ongoing transaction, do not perform garbage collection on inactive elements. Reset annotated previous end interval if the expired element is marked as busy (control plane removed the element right before expiration). Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support") Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit c9e6978e2725a7d4b6cd23b2facd3f11422c0643 Author: Pablo Neira Ayuso Date: Sat Jan 14 23:38:32 2023 +0100 netfilter: nft_set_rbtree: Switch to node list walk for overlap detection ...instead of a tree descent, which became overly complicated in an attempt to cover cases where expired or inactive elements would affect comparisons with the new element being inserted. Further, it turned out that it's probably impossible to cover all those cases, as inactive nodes might entirely hide subtrees consisting of a complete interval plus a node that makes the current insertion not overlap. To speed up the overlap check, descent the tree to find a greater element that is closer to the key value to insert. Then walk down the node list for overlap detection. Starting the overlap check from rb_first() unconditionally is slow, it takes 10 times longer due to the full linear traversal of the list. Moreover, perform garbage collection of expired elements when walking down the node list to avoid bogus overlap reports. For the insertion operation itself, this essentially reverts back to the implementation before commit 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion"), except that cases of complete overlap are already handled in the overlap detection phase itself, which slightly simplifies the loop to find the insertion point. Based on initial patch from Stefano Brivio, including text from the original patch description too. Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion") Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit e6b3086fddc0065a5ffb947d4d29dd0e6efc327b Author: Hans de Goede Date: Thu Jan 19 18:24:41 2023 +0100 ACPI: video: Add backlight=native DMI quirk for Asus U46E The Asus U46E backlight tables have a set of interesting problems: 1. Its ACPI tables do make _OSI ("Windows 2012") checks, so acpi_osi_is_win8() should return true. But the tables have 2 sets of _OSI calls, one from the usual global _INI method setting a global OSYS variable and a second set of _OSI calls from a MSOS method and the MSOS method is the only one calling _OSI ("Windows 2012"). The MSOS method only gets called in the following cases: 1. From some Asus specific WMI methods 2. From _DOD, which only runs after acpi_video_get_backlight_type() has already been called by the i915 driver 3. From other ACPI video bus methods which never run (see below) 4. From some EC query callbacks So when i915 calls acpi_video_get_backlight_type() MSOS has never run and acpi_osi_is_win8() returns false, so acpi_video_get_backlight_type() returns acpi_video as the desired backlight type, which causes the intel_backlight device to not register. 2. _DOD effectively does this: Return (Package (0x01) { 0x0400 }) causing acpi_video_device_in_dod() to return false, which causes the acpi_video backlight device to not register. Leaving the user with no backlight device at all. Note that before 6.1.y the i915 driver would register the intel_backlight device unconditionally and since that then was the only backlight device userspace would use that. Add a backlight=native DMI quirk for this special laptop to restore the old (and working) behavior of the intel_backlight device registering. Fixes: fb1836c91317 ("ACPI: video: Prefer native over vendor") Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 9dcb34234b8235144c96103266317da33321077e Author: Hans de Goede Date: Thu Jan 19 17:37:44 2023 +0100 ACPI: video: Add backlight=native DMI quirk for HP EliteBook 8460p The HP EliteBook 8460p predates Windows 8, so it defaults to using acpi_video# for backlight control. Starting with the 6.1.y kernels the native radeon_bl0 backlight is hidden in this case instead of relying on userspace preferring acpi_video# over native backlight devices. It turns out that for the acpi_video# interface to work on the HP EliteBook 8460p, the brightness needs to be set at least once through the native interface, which now no longer is done breaking backlight control. The native interface however always works without problems, so add a quirk to use native backlight on the EliteBook 8460p to fix this. Fixes: fb1836c91317 ("ACPI: video: Prefer native over vendor") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2161428 Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit d77596d432cc4142520af32b5388d512e52e0edb Author: Hans de Goede Date: Thu Jan 19 17:37:43 2023 +0100 ACPI: video: Add backlight=native DMI quirk for HP Pavilion g6-1d80nr The HP Pavilion g6-1d80nr predates Windows 8, so it defaults to using acpi_video# for backlight control, but this is non functional on this model. Add a DMI quirk to use the native backlight interface which does work properly. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 7bf70dbb18820b37406fdfa2aaf14c2f5c71a11a Merge: 9946f0981ff86 51cdc8bc120ef Author: Linus Torvalds Date: Mon Jan 23 11:56:07 2023 -0800 Merge tag 'vfio-v6.2-rc6' of https://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Honor reserved regions when testing for IOMMU find grained super page support, avoiding a regression on s390 for a firmware device where the existence of the mapping, even if unused can trigger an error state. (Niklas Schnelle) - Fix a deadlock in releasing KVM references by using the alternate .release() rather than .destroy() callback for the kvm-vfio device. (Yi Liu) * tag 'vfio-v6.2-rc6' of https://github.com/awilliam/linux-vfio: kvm/vfio: Fix potential deadlock on vfio group_lock vfio/type1: Respect IOMMU reserved regions in vfio_test_domain_fgsp() commit 9946f0981ff8698848ee79d739f432a2a3e68eed Merge: 2475bf0250dee e1fabbc83cb1d Author: Linus Torvalds Date: Mon Jan 23 11:46:19 2023 -0800 Merge tag 'efi-fixes-for-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: "Another couple of EFI fixes, of which the first two were already in -next when I sent out the previous PR, but they caused some issues on non-EFI boots so I let them simmer for a bit longer. - ensure the EFI ResetSystem and ACPI PRM calls are recognized as users of the EFI runtime, and therefore protected against exceptions - account for the EFI runtime stack in the stacktrace code - remove Matthew Garrett's MAINTAINERS entry for efivarfs" * tag 'efi-fixes-for-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Remove Matthew Garrett as efivarfs maintainer arm64: efi: Account for the EFI runtime stack in stack unwinder arm64: efi: Avoid workqueue to check whether EFI runtime is live commit 2255bbcdc39d5b0311968f86614ae4f25fdd465d Author: Arnd Bergmann Date: Tue Jan 17 17:37:29 2023 +0100 drm/i915/selftest: fix intel_selftest_modify_policy argument types The definition of intel_selftest_modify_policy() does not match the declaration, as gcc-13 points out: drivers/gpu/drm/i915/selftests/intel_scheduler_helpers.c:29:5: error: conflicting types for 'intel_selftest_modify_policy' due to enum/integer mismatch; have 'int(struct intel_engine_cs *, struct intel_selftest_saved_policy *, u32)' {aka 'int(struct intel_engine_cs *, struct intel_selftest_saved_policy *, unsigned int)'} [-Werror=enum-int-mismatch] 29 | int intel_selftest_modify_policy(struct intel_engine_cs *engine, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/gpu/drm/i915/selftests/intel_scheduler_helpers.c:11: drivers/gpu/drm/i915/selftests/intel_scheduler_helpers.h:28:5: note: previous declaration of 'intel_selftest_modify_policy' with type 'int(struct intel_engine_cs *, struct intel_selftest_saved_policy *, enum selftest_scheduler_modify)' 28 | int intel_selftest_modify_policy(struct intel_engine_cs *engine, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Change the type in the definition to match. Fixes: 617e87c05c72 ("drm/i915/selftest: Fix hangcheck self test for GuC submission") Signed-off-by: Arnd Bergmann Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230117163743.1003219-1-arnd@kernel.org (cherry picked from commit 8d7eb8ed3f83f248e01a4f548d9c500a950a2c2d) Signed-off-by: Rodrigo Vivi commit 75444cfffc12459273be70a56460035fb4c553f3 Author: Lucas De Marchi Date: Wed Jan 18 17:52:39 2023 -0800 drm/i915/mtl: Fix bcs default context Commit 0d0e7d1eea9e ("drm/i915/mtl: Define engine context layouts") added the engine context for Meteor Lake. In a second revision of the patch it was believed the xcs offsets were wrong due to a tagging issue in the spec. The first version was actually correct, as shown by the intel_lrc_live_selftests/live_lrc_layout test: i915: Running gt_lrc i915: Running intel_lrc_live_selftests/live_lrc_layout bcs0: LRI command mismatch at dword 1, expected 1108101d found 11081019 [drm:drm_helper_probe_single_connector_modes [drm_kms_helper]] [CONNECTOR:236:DP-1] disconnected bcs0: HW register image: [0000] 00000000 1108101d 00022244 ffff0008 00022034 00000088 00022030 00000088 ... bcs0: SW register image: [0000] 00000000 11081019 00022244 00090009 00022034 00000000 00022030 00000000 The difference in the 2 additional dwords (0x1d vs 0x19) are the offsets 0x120 / 0x124 that are indeed part of the context image. Bspec: 45585 Fixes: 0d0e7d1eea9e ("drm/i915/mtl: Define engine context layouts") Signed-off-by: Lucas De Marchi Signed-off-by: Radhakrishna Sripada Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230111235531.3353815-2-radhakrishna.sripada@intel.com (cherry picked from commit ca54a9a32da0f0ef7e5cbcd111b66f3c9d78b7d2) Signed-off-by: Rodrigo Vivi commit 98e3528012cd571c48bbae7c7c0f868823254b6c Author: Ross Lagerwall Date: Fri Jan 20 17:43:54 2023 +0000 nvme-fc: fix initialization order ctrl->ops is used by nvme_alloc_admin_tag_set() but set by nvme_init_ctrl() so reorder the calls to avoid a NULL pointer dereference. Fixes: 6dfba1c09c10 ("nvme-fc: use the tagset alloc/free helpers") Signed-off-by: Ross Lagerwall Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit d63f11c02b8d3e54bdb65d8c309f73b7f474aec4 Author: Mario Limonciello Date: Sat Jan 21 07:48:11 2023 -0600 gpiolib-acpi: Don't set GPIOs for wakeup in S3 mode commit 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") adjusted the policy to enable wakeup by default if the ACPI tables indicated that a device was wake capable. It was reported however that this broke suspend on at least two System76 systems in S3 mode and two Lenovo Gen2a systems, but only with S3. When the machines are set to s2idle, wakeup behaves properly. Configuring the GPIOs for wakeup with S3 doesn't work properly, so only set it when the system supports low power idle. Fixes: 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") Fixes: b38f2d5d9615c ("i2c: acpi: Use ACPI wake capability bit to set wake_irq") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2357 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2162013 Reported-by: Nathan Smythe Tested-by: Nathan Smythe Suggested-by: Raul Rangel Signed-off-by: Mario Limonciello Acked-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 4bdbba54e9b1c769da8ded9abd209d765715e1d6 Author: Jeff Layton Date: Fri Jan 20 14:52:14 2023 -0500 nfsd: don't free files unconditionally in __nfsd_file_cache_purge nfsd_file_cache_purge is called when the server is shutting down, in which case, tearing things down is generally fine, but it also gets called when the exports cache is flushed. Instead of walking the cache and freeing everything unconditionally, handle it the same as when we have a notification of conflicting access. Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache") Reported-by: Ruben Vestergaard Reported-by: Torkil Svensgaard Reported-by: Shachar Kagan Signed-off-by: Jeff Layton Tested-by: Shachar Kagan Signed-off-by: Chuck Lever commit 2f62847cf6ae49a54515421f67b1badffaa805f3 Author: Nathan Chancellor Date: Wed Jan 18 20:29:02 2023 +0100 ARM: 9287/1: Reduce __thumb2__ definition to crypto files that require it Commit 1d2e9b67b001 ("ARM: 9265/1: pass -march= only to compiler") added a __thumb2__ define to ASFLAGS to avoid build errors in the crypto code, which relies on __thumb2__ for preprocessing. Commit 59e2cf8d21e0 ("ARM: 9275/1: Drop '-mthumb' from AFLAGS_ISA") followed up on this by removing -mthumb from AFLAGS so that __thumb2__ would not be defined when the default target was ARMv7 or newer. Unfortunately, the second commit's fix assumes that the toolchain defaults to -mno-thumb / -marm, which is not the case for Debian's arm-linux-gnueabihf target, which defaults to -mthumb: $ echo | arm-linux-gnueabihf-gcc -dM -E - | grep __thumb #define __thumb2__ 1 #define __thumb__ 1 This target is used by several CI systems, which will still see redefined macro warnings, despite '-mthumb' not being present in the flags: : warning: "__thumb2__" redefined : note: this is the location of the previous definition Remove the global AFLAGS __thumb2__ define and move it to the crypto folder where it is required by the imported OpenSSL algorithms; the rest of the kernel should use the internal CONFIG_THUMB2_KERNEL symbol to know whether or not Thumb2 is being used or not. Be sure that __thumb2__ is undefined first so that there are no macro redefinition warnings. Link: https://github.com/ClangBuiltLinux/linux/issues/1772 Reported-by: "kernelci.org bot" Suggested-by: Ard Biesheuvel Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Fixes: 59e2cf8d21e0 ("ARM: 9275/1: Drop '-mthumb' from AFLAGS_ISA") Fixes: 1d2e9b67b001 ("ARM: 9265/1: pass -march= only to compiler") Signed-off-by: Russell King (Oracle) commit b00c51ef8f72ced0965d021a291b98ff822c5337 Author: Jens Axboe Date: Sun Jan 22 10:02:55 2023 -0700 io_uring/net: cache provided buffer group value for multishot receives If we're using ring provided buffers with multishot receive, and we end up doing an io-wq based issue at some points that also needs to select a buffer, we'll lose the initially assigned buffer group as io_ring_buffer_select() correctly clears the buffer group list as the issue isn't serialized by the ctx uring_lock. This is fine for normal receives as the request puts the buffer and finishes, but for multishot, we will re-arm and do further receives. On the next trigger for this multishot receive, the receive will try and pick from a buffer group whose value is the same as the buffer ID of the las receive. That is obviously incorrect, and will result in a premature -ENOUFS error for the receive even if we had available buffers in the correct group. Cache the buffer group value at prep time, so we can restore it for future receives. This only needs doing for the above mentioned case, but just do it by default to keep it easier to read. Cc: stable@vger.kernel.org Fixes: b3fdea6ecb55 ("io_uring: multishot recv") Fixes: 9bb66906f23e ("io_uring: support multishot in recvmsg") Cc: Dylan Yudaken Signed-off-by: Jens Axboe commit dcff8b7ca92d724bdaf474a3fa37a7748377813a Author: fengwk Date: Sun Jan 22 01:51:06 2023 +0800 ASoC: amd: yc: Add Xiaomi Redmi Book Pro 15 2022 into DMI table This model requires an additional detection quirk to enable the internal microphone - BIOS doesn't seem to support AcpDmicConnected (nothing in acpidump output). Signed-off-by: fengwk Link: https://lore.kernel.org/r/Y8wmCutc74j/tyHP@arch Signed-off-by: Mark Brown commit 9f535c870e493841ac7be390610ff2edec755762 Author: Gergely Risko Date: Thu Jan 19 14:40:41 2023 +0100 ipv6: fix reachability confirmation with proxy_ndp When proxying IPv6 NDP requests, the adverts to the initial multicast solicits are correct and working. On the other hand, when later a reachability confirmation is requested (on unicast), no reply is sent. This causes the neighbor entry expiring on the sending node, which is mostly a non-issue, as a new multicast request is sent. There are routers, where the multicast requests are intentionally delayed, and in these environments the current implementation causes periodic packet loss for the proxied endpoints. The root cause is the erroneous decrease of the hop limit, as this is checked in ndisc.c and no answer is generated when it's 254 instead of the correct 255. Cc: stable@vger.kernel.org Fixes: 46c7655f0b56 ("ipv6: decrease hop limit counter in ip6_forward()") Signed-off-by: Gergely Risko Tested-by: Gergely Risko Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 0ad999c1eec879f06cc52ef7df4d0dbee4a2d7eb Merge: e38553bdc377e 7c494a7749a7d Author: David S. Miller Date: Mon Jan 23 10:58:12 2023 +0000 Merge branch 'ethtool-mac-merge' Vladimir Oltean say: ==================== ethtool support for IEEE 802.3 MAC Merge layer Change log ---------- v3->v4: - add missing opening bracket in ocelot_port_mm_irq() - moved cfg.verify_time range checking so that it actually takes place for the updated rather than old value v3 at: https://patchwork.kernel.org/project/netdevbpf/cover/20230117085947.2176464-1-vladimir.oltean@nxp.com/ v2->v3: - made get_mm return int instead of void - deleted ETHTOOL_A_MM_SUPPORTED - renamed ETHTOOL_A_MM_ADD_FRAG_SIZE to ETHTOOL_A_MM_TX_MIN_FRAG_SIZE - introduced ETHTOOL_A_MM_RX_MIN_FRAG_SIZE - cleaned up documentation - rebased on top of PLCA changes - renamed ETHTOOL_STATS_SRC_* to ETHTOOL_MAC_STATS_SRC_* v2 at: https://patchwork.kernel.org/project/netdevbpf/cover/20230111161706.1465242-1-vladimir.oltean@nxp.com/ v1->v2: I've decided to focus just on the MAC Merge layer for now, which is why I am able to submit this patch set as non-RFC. v1 (RFC) at: https://patchwork.kernel.org/project/netdevbpf/cover/20220816222920.1952936-1-vladimir.oltean@nxp.com/ What is being introduced ------------------------ TL;DR: a MAC Merge layer as defined by IEEE 802.3-2018, clause 99 (interspersing of express traffic). This is controlled through ethtool netlink (ETHTOOL_MSG_MM_GET, ETHTOOL_MSG_MM_SET). The raw ethtool commands are posted here: https://patchwork.kernel.org/project/netdevbpf/cover/20230111153638.1454687-1-vladimir.oltean@nxp.com/ The MAC Merge layer has its own statistics counters (ethtool --include-statistics --show-mm swp0) as well as two member MACs, the statistics of which can be queried individually, through a new ethtool netlink attribute, corresponding to: $ ethtool -I --show-pause eno2 --src aggregate $ ethtool -S eno2 --groups eth-mac eth-phy eth-ctrl rmon -- --src pmac The core properties of the MAC Merge layer are described in great detail in patches 02/12 and 03/12. They can be viewed in "make htmldocs" format. Devices for which the API is supported -------------------------------------- I decided to start with the Ethernet switch on NXP LS1028A (Felix) because of the smaller patch set. I also have support for the ENETC controller pending. I would like to get confirmation that the UAPI being proposed here will not restrict any use cases known by other hardware vendors. Why is support for preemptible traffic classes not here? -------------------------------------------------------- There is legitimate concern whether the 802.1Q portion of the standard (which traffic classes go to the eMAC and which to the pMAC) should be modeled in Linux using tc or using another UAPI. I think that is stalling the entire series, but should be discussed separately instead. Removing FP adminStatus support makes me confident enough to submit this patch set without an RFC tag (meaning: I wouldn't mind if it was merged as is). What is submitted here is sufficient for an LLDP daemon to do its job. I've patched openlldp to advertise and configure frame preemption: https://github.com/vladimiroltean/openlldp/tree/frame-preemption-v3 In case someone wants to try it out, here are some commands I've used. # Configure the interfaces to receive and transmit LLDP Data Units lldptool -L -i eno0 adminStatus=rxtx lldptool -L -i swp0 adminStatus=rxtx # Enable the transmission of certain TLVs on switch's interface lldptool -T -i eno0 -V addEthCap enableTx=yes lldptool -T -i swp0 -V addEthCap enableTx=yes # Query LLDP statistics on switch's interface lldptool -S -i swp0 # Query the received neighbor TLVs lldptool -i swp0 -t -n -V addEthCap Additional Ethernet Capabilities TLV Preemption capability supported Preemption capability enabled Preemption capability active Additional fragment size: 60 octets So using this patch set, lldpad will be able to advertise and configure frame preemption, but still, no data packet will be sent as preemptible over the link, because there is no UAPI to control which traffic classes are sent as preemptible and which as express. Preemptable or preemptible? --------------------------- IEEE 802.3 uses "preemptable" throughout. IEEE 802.1Q uses "preemptible" throughout. Because the definition of "preemptible" falls under 802.1Q's jurisdiction and 802.3 just references it, I went with the 802.1Q naming even where supporting an 802.3 feature. Also, checkpatch agrees with this. ==================== Signed-off-by: David S. Miller commit 7c494a7749a7d6ee95cfae6a8c109c5d63103d88 Author: Vladimir Oltean Date: Thu Jan 19 14:26:53 2023 +0200 net: ethtool: netlink: introduce ethnl_update_bool() Due to the fact that the kernel-side data structures have been carried over from the ioctl-based ethtool, we are now in the situation where we have an ethnl_update_bool32() function, but the plain function that operates on a boolean value kept in an actual u8 netlink attribute doesn't exist. With new ethtool features that are exposed solely over netlink, the kernel data structures will use the "bool" type, so we will need this kind of helper. Introduce it now; it's needed for things like verify-disabled for the MAC merge configuration. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit e38553bdc377e3e7a6caa9dd9770d8b644d8dac3 Author: Wei Fang Date: Thu Jan 19 12:37:47 2023 +0800 net: fec: Use page_pool_put_full_page when freeing rx buffers The page_pool_release_page was used when freeing rx buffers, and this function just unmaps the page (if mapped) and does not recycle the page. So after hundreds of down/up the eth0, the system will out of memory. For more details, please refer to the following reproduce steps and bug logs. To solve this issue and refer to the doc of page pool, the page_pool_put_full_page should be used to replace page_pool_release_page. Because this API will try to recycle the page if the page refcnt equal to 1. After testing 20000 times, the issue can not be reproduced anymore (about testing 391 times the issue will occur on i.MX8MN-EVK before). Reproduce steps: Create the test script and run the script. The script content is as follows: LOOPS=20000 i=1 while [ $i -le $LOOPS ] do echo "TINFO:ENET $curface up and down test $i times" org_macaddr=$(cat /sys/class/net/eth0/address) ifconfig eth0 down ifconfig eth0 hw ether $org_macaddr up i=$(expr $i + 1) done sleep 5 if cat /sys/class/net/eth0/operstate | grep 'up';then echo "TEST PASS" else echo "TEST FAIL" fi Bug detail logs: TINFO:ENET up and down test 391 times [ 850.471205] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr=30be0000.ethernet-1:00, irq=POLL) [ 853.535318] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 853.541694] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 870.590531] page_pool_release_retry() stalled pool shutdown 199 inflight 60 sec [ 931.006557] page_pool_release_retry() stalled pool shutdown 199 inflight 120 sec TINFO:ENET up and down test 392 times [ 991.426544] page_pool_release_retry() stalled pool shutdown 192 inflight 181 sec [ 1051.838531] page_pool_release_retry() stalled pool shutdown 170 inflight 241 sec [ 1093.751217] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr=30be0000.ethernet-1:00, irq=POLL) [ 1096.446520] page_pool_release_retry() stalled pool shutdown 308 inflight 60 sec [ 1096.831245] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 1096.839092] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 1112.254526] page_pool_release_retry() stalled pool shutdown 103 inflight 302 sec [ 1156.862533] page_pool_release_retry() stalled pool shutdown 308 inflight 120 sec [ 1172.674516] page_pool_release_retry() stalled pool shutdown 103 inflight 362 sec [ 1217.278532] page_pool_release_retry() stalled pool shutdown 308 inflight 181 sec TINFO:ENET up and down test 393 times [ 1233.086535] page_pool_release_retry() stalled pool shutdown 103 inflight 422 sec [ 1277.698513] page_pool_release_retry() stalled pool shutdown 308 inflight 241 sec [ 1293.502525] page_pool_release_retry() stalled pool shutdown 86 inflight 483 sec [ 1338.110518] page_pool_release_retry() stalled pool shutdown 308 inflight 302 sec [ 1353.918540] page_pool_release_retry() stalled pool shutdown 32 inflight 543 sec [ 1361.179205] Qualcomm Atheros AR8031/AR8033 30be0000.ethernet-1:00: attached PHY driver (mii_bus:phy_addr=30be0000.ethernet-1:00, irq=POLL) [ 1364.255298] fec 30be0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 1364.263189] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 1371.998532] page_pool_release_retry() stalled pool shutdown 310 inflight 60 sec [ 1398.530542] page_pool_release_retry() stalled pool shutdown 308 inflight 362 sec [ 1414.334539] page_pool_release_retry() stalled pool shutdown 16 inflight 604 sec [ 1432.414520] page_pool_release_retry() stalled pool shutdown 310 inflight 120 sec [ 1458.942523] page_pool_release_retry() stalled pool shutdown 308 inflight 422 sec [ 1474.750521] page_pool_release_retry() stalled pool shutdown 16 inflight 664 sec TINFO:ENET up and down test 394 times [ 1492.830522] page_pool_release_retry() stalled pool shutdown 310 inflight 181 sec [ 1519.358519] page_pool_release_retry() stalled pool shutdown 308 inflight 483 sec [ 1535.166545] page_pool_release_retry() stalled pool shutdown 2 inflight 724 sec [ 1537.090278] eth_test2.sh invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=0 [ 1537.101192] CPU: 3 PID: 2379 Comm: eth_test2.sh Tainted: G C 6.1.1+g56321e101aca #1 [ 1537.110249] Hardware name: NXP i.MX8MNano EVK board (DT) [ 1537.115561] Call trace: [ 1537.118005] dump_backtrace.part.0+0xe0/0xf0 [ 1537.122289] show_stack+0x18/0x40 [ 1537.125608] dump_stack_lvl+0x64/0x80 [ 1537.129276] dump_stack+0x18/0x34 [ 1537.132592] dump_header+0x44/0x208 [ 1537.136083] oom_kill_process+0x2b4/0x2c0 [ 1537.140097] out_of_memory+0xe4/0x594 [ 1537.143766] __alloc_pages+0xb68/0xd00 [ 1537.147521] alloc_pages+0xac/0x160 [ 1537.151013] __get_free_pages+0x14/0x40 [ 1537.154851] pgd_alloc+0x1c/0x30 [ 1537.158082] mm_init+0xf8/0x1d0 [ 1537.161228] mm_alloc+0x48/0x60 [ 1537.164368] alloc_bprm+0x7c/0x240 [ 1537.167777] do_execveat_common.isra.0+0x70/0x240 [ 1537.172486] __arm64_sys_execve+0x40/0x54 [ 1537.176502] invoke_syscall+0x48/0x114 [ 1537.180255] el0_svc_common.constprop.0+0xcc/0xec [ 1537.184964] do_el0_svc+0x2c/0xd0 [ 1537.188280] el0_svc+0x2c/0x84 [ 1537.191340] el0t_64_sync_handler+0xf4/0x120 [ 1537.195613] el0t_64_sync+0x18c/0x190 [ 1537.199334] Mem-Info: [ 1537.201620] active_anon:342 inactive_anon:10343 isolated_anon:0 [ 1537.201620] active_file:54 inactive_file:112 isolated_file:0 [ 1537.201620] unevictable:0 dirty:0 writeback:0 [ 1537.201620] slab_reclaimable:2620 slab_unreclaimable:7076 [ 1537.201620] mapped:1489 shmem:2473 pagetables:466 [ 1537.201620] sec_pagetables:0 bounce:0 [ 1537.201620] kernel_misc_reclaimable:0 [ 1537.201620] free:136672 free_pcp:96 free_cma:129241 [ 1537.240419] Node 0 active_anon:1368kB inactive_anon:41372kB active_file:216kB inactive_file:5052kB unevictable:0kB isolated(anon):0kB isolated(file):0kB s [ 1537.271422] Node 0 DMA free:541636kB boost:0kB min:30000kB low:37500kB high:45000kB reserved_highatomic:0KB active_anon:1368kB inactive_anon:41372kB actiB [ 1537.300219] lowmem_reserve[]: 0 0 0 0 [ 1537.303929] Node 0 DMA: 1015*4kB (UMEC) 743*8kB (UMEC) 417*16kB (UMEC) 235*32kB (UMEC) 116*64kB (UMEC) 25*128kB (UMEC) 4*256kB (UC) 2*512kB (UC) 0*1024kBB [ 1537.323938] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1537.332708] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 1537.341292] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1537.349776] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 1537.358087] 2939 total pagecache pages [ 1537.361876] 0 pages in swap cache [ 1537.365229] Free swap = 0kB [ 1537.368147] Total swap = 0kB [ 1537.371065] 516096 pages RAM [ 1537.373959] 0 pages HighMem/MovableOnly [ 1537.377834] 17302 pages reserved [ 1537.381103] 163840 pages cma reserved [ 1537.384809] 0 pages hwpoisoned [ 1537.387902] Tasks state (memory values in pages): [ 1537.392652] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 1537.401356] [ 201] 993 201 1130 72 45056 0 0 rpcbind [ 1537.409772] [ 202] 0 202 4529 1640 77824 0 -250 systemd-journal [ 1537.418861] [ 222] 0 222 4691 801 69632 0 -1000 systemd-udevd [ 1537.427787] [ 248] 994 248 20914 130 65536 0 0 systemd-timesyn [ 1537.436884] [ 497] 0 497 620 31 49152 0 0 atd [ 1537.444938] [ 500] 0 500 854 77 53248 0 0 crond [ 1537.453165] [ 503] 997 503 1470 160 49152 0 -900 dbus-daemon [ 1537.461908] [ 505] 0 505 633 24 40960 0 0 firmwared [ 1537.470491] [ 513] 0 513 2507 180 61440 0 0 ofonod [ 1537.478800] [ 514] 990 514 69640 137 81920 0 0 parsec [ 1537.487120] [ 533] 0 533 599 39 40960 0 0 syslogd [ 1537.495518] [ 534] 0 534 4546 148 65536 0 0 systemd-logind [ 1537.504560] [ 535] 0 535 690 24 45056 0 0 tee-supplicant [ 1537.513564] [ 540] 996 540 2769 168 61440 0 0 systemd-network [ 1537.522680] [ 566] 0 566 3878 228 77824 0 0 connmand [ 1537.531168] [ 645] 998 645 1538 133 57344 0 0 avahi-daemon [ 1537.540004] [ 646] 998 646 1461 64 57344 0 0 avahi-daemon [ 1537.548846] [ 648] 992 648 781 41 45056 0 0 rpc.statd [ 1537.557415] [ 650] 64371 650 590 23 45056 0 0 ninfod [ 1537.565754] [ 653] 61563 653 555 24 45056 0 0 rdisc [ 1537.573971] [ 655] 0 655 374569 2999 290816 0 -999 containerd [ 1537.582621] [ 658] 0 658 1311 20 49152 0 0 agetty [ 1537.590922] [ 663] 0 663 1529 97 49152 0 0 login [ 1537.599138] [ 666] 0 666 3430 202 69632 0 0 wpa_supplicant [ 1537.608147] [ 667] 0 667 2344 96 61440 0 0 systemd-userdbd [ 1537.617240] [ 677] 0 677 2964 314 65536 0 100 systemd [ 1537.625651] [ 679] 0 679 3720 646 73728 0 100 (sd-pam) [ 1537.634138] [ 687] 0 687 1289 403 45056 0 0 sh [ 1537.642108] [ 789] 0 789 970 93 45056 0 0 eth_test2.sh [ 1537.650955] [ 2355] 0 2355 2346 94 61440 0 0 systemd-userwor [ 1537.660046] [ 2356] 0 2356 2346 94 61440 0 0 systemd-userwor [ 1537.669137] [ 2358] 0 2358 2346 95 57344 0 0 systemd-userwor [ 1537.678258] [ 2379] 0 2379 970 93 45056 0 0 eth_test2.sh [ 1537.687098] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/user@0.service,tas0 [ 1537.703009] Out of memory: Killed process 679 ((sd-pam)) total-vm:14880kB, anon-rss:2584kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_ad0 [ 1553.246526] page_pool_release_retry() stalled pool shutdown 310 inflight 241 sec Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers") Signed-off-by: Wei Fang Reviewed-by: shenwei wang Reviewed-by: Jesse Brandeburg Signed-off-by: David S. Miller commit 87978e6ad45a16835cc58234451111091be3c59a Author: Cezary Rojewski Date: Thu Jan 19 15:32:35 2023 +0100 ALSA: hda: Do not unset preset when cleaning up codec Several functions that take part in codec's initialization and removal are re-used by ASoC codec drivers implementations. Drivers mimic the behavior of hda_codec_driver_probe/remove() found in sound/pci/hda/hda_bind.c with their component->probe/remove() instead. One of the reasons for that is the expectation of snd_hda_codec_device_new() to receive a valid pointer to an instance of struct snd_card. This expectation can be met only once sound card components probing commences. As ASoC sound card may be unbound without codec device being actually removed from the system, unsetting ->preset in snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load scenario causing null-ptr-deref. Preset is assigned only once, during device/driver matching whereas ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack. Suggested-by: Takashi Iwai Signed-off-by: Cezary Rojewski Link: https://lore.kernel.org/r/20230119143235.1159814-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai commit b6ee896385380aa621102e8ea402ba12db1cabff Author: Eric Dumazet Date: Fri Jan 20 13:02:49 2023 +0000 xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") Signed-off-by: Eric Dumazet Cc: Dmitry Safonov Cc: Steffen Klassert Reviewed-by: Dmitry Safonov Signed-off-by: Steffen Klassert commit 2475bf0250dee99b477e0c56d7dc9d7ac3f04117 Merge: ab2f408731cc7 5f5cc9ed992cb Author: Linus Torvalds Date: Sun Jan 22 12:14:58 2023 -0800 Merge tag 'sched_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Make sure the scheduler doesn't use stale frequency scaling values when latter get disabled due to a value error - Fix a NULL pointer access on UP configs - Use the proper locking when updating CPU capacity * tag 'sched_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings sched/core: Fix NULL pointer access fault in sched_setaffinity() with non-SMP configs sched/fair: Fixes for capacity inversion detection sched/uclamp: Fix a uninitialized variable warnings commit ab2f408731cc7e03ef2e5dc7dada649220e4dcd2 Merge: 2b299a1cd4327 977c6ba624f24 Author: Linus Torvalds Date: Sun Jan 22 12:10:47 2023 -0800 Merge tag 'edac_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - Respect user-supplied polling value in the EDAC device code - Fix a use-after-free issue in qcom_edac * tag 'edac_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info EDAC/device: Respect any driver-supplied workqueue polling value commit 2b299a1cd43271ffb582342a2a3c227aea0f32ac Merge: 3c006ad74d68b 5a8a05f165fb1 Author: Linus Torvalds Date: Sun Jan 22 12:06:18 2023 -0800 Merge tag 'perf_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Add Emerald Rapids model support to more perf machinery * tag 'perf_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/cstate: Add Emerald Rapids perf/x86/intel: Add Emerald Rapids commit 3c006ad74d68be45ee36ca68fd9c053974fb6b0f Merge: 2241ab53cbb5c 95ecbd0f162fc Author: Linus Torvalds Date: Sun Jan 22 11:56:33 2023 -0800 Merge tag 'gfs2-v6.2-rc4-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 writepage fix from Andreas Gruenbacher: - Fix a regression introduced by commit "gfs2: stop using generic_writepages in gfs2_ail1_start_one". * tag 'gfs2-v6.2-rc4-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one" commit 6601fc0d15ffc20654e39486f9bef35567106d68 Author: Dean Luick Date: Thu Jan 12 13:16:02 2023 -0500 IB/hfi1: Restore allocated resources on failed copyout Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 27b5de622ea3fe0ad5a31a0ebd9f7a0a276932d1 Author: Nathan Chancellor Date: Fri Jan 20 09:58:27 2023 -0700 x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block LLVM 16 will have support for this flag so move it out of the GCC-only block to allow LLVM builds to take advantage of it. Signed-off-by: Nathan Chancellor Signed-off-by: Ingo Molnar Tested-by: Nick Desaulniers Reviewed-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://github.com/ClangBuiltLinux/linux/issues/1665 Link: https://github.com/llvm/llvm-project/commit/6f867f9102838ebe314c1f3661fdf95700386e5a Link: https://lore.kernel.org/r/20230120165826.2469302-1-nathan@kernel.org commit c2c46b10d52624376322b01654095a84611c7e09 Author: Vipin Sharma Date: Wed Jan 11 10:34:08 2023 -0800 KVM: selftests: Make reclaim_period_ms input always be positive reclaim_period_ms used to be positive only but the commit 0001725d0f9b ("KVM: selftests: Add atoi_positive() and atoi_non_negative() for input validation") incorrectly changed it to non-negative validation. Change validation to allow only positive input. Fixes: 0001725d0f9b ("KVM: selftests: Add atoi_positive() and atoi_non_negative() for input validation") Signed-off-by: Vipin Sharma Reported-by: Ben Gardon Reviewed-by: Ben Gardon Reviewed-by: Sean Christopherson Message-Id: <20230111183408.104491-1-vipinsh@google.com> Signed-off-by: Paolo Bonzini commit a44b331614e6f7e63902ed7dff7adc8c85edd8bc Author: Hendrik Borghorst Date: Mon Nov 14 16:48:23 2022 +0000 KVM: x86/vmx: Do not skip segment attributes if unusable bit is set When serializing and deserializing kvm_sregs, attributes of the segment descriptors are stored by user space. For unusable segments, vmx_segment_access_rights skips all attributes and sets them to 0. This means we zero out the DPL (Descriptor Privilege Level) for unusable entries. Unusable segments are - contrary to their name - usable in 64bit mode and are used by guests to for example create a linear map through the NULL selector. VMENTER checks if SS.DPL is correct depending on the CS segment type. For types 9 (Execute Only) and 11 (Execute Read), CS.DPL must be equal to SS.DPL [1]. We have seen real world guests setting CS to a usable segment with DPL=3 and SS to an unusable segment with DPL=3. Once we go through an sregs get/set cycle, SS.DPL turns to 0. This causes the virtual machine to crash reproducibly. This commit changes the attribute logic to always preserve attributes for unusable segments. According to [2] SS.DPL is always saved on VM exits, regardless of the unusable bit so user space applications should have saved the information on serialization correctly. [3] specifies that besides SS.DPL the rest of the attributes of the descriptors are undefined after VM entry if unusable bit is set. So, there should be no harm in setting them all to the previous state. [1] Intel SDM Vol 3C 26.3.1.2 Checks on Guest Segment Registers [2] Intel SDM Vol 3C 27.3.2 Saving Segment Registers and Descriptor-Table Registers [3] Intel SDM Vol 3C 26.3.2.2 Loading Guest Segment Registers and Descriptor-Table Registers Cc: Alexander Graf Cc: stable@vger.kernel.org Signed-off-by: Hendrik Borghorst Reviewed-by: Jim Mattson Reviewed-by: Alexander Graf Message-Id: <20221114164823.69555-1-hborghor@amazon.de> Signed-off-by: Paolo Bonzini commit 50aa870ba2f7735f556e52d15f61cd0f359c4c0b Author: Paolo Bonzini Date: Sun Jan 22 04:04:50 2023 -0500 selftests: kvm: move declaration at the beginning of main() Placing a declaration of evt_reset is pedantically invalid according to the C standard. While GCC does not really care and only warns with -Wpedantic, clang ignores the declaration altogether with an error: x86_64/xen_shinfo_test.c:965:2: error: expected expression struct kvm_xen_hvm_attr evt_reset = { ^ x86_64/xen_shinfo_test.c:969:38: error: use of undeclared identifier evt_reset vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset); ^ Reported-by: Yu Zhang Reported-by: Sean Christopherson Fixes: a79b53aaaab5 ("KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET", 2022-12-28) Signed-off-by: Paolo Bonzini commit 95ecbd0f162fc06ef4c4045a66f653f47b62a2d3 Author: Andreas Gruenbacher Date: Thu Jan 19 20:14:42 2023 +0100 Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one" Commit b2b0a5e97855 switched from generic_writepages() to filemap_fdatawrite_wbc() in gfs2_ail1_start_one() on the path to replacing ->writepage() with ->writepages() and eventually eliminating the former. Function gfs2_ail1_start_one() is called from gfs2_log_flush(), our main function for flushing the filesystem log. Unfortunately, at least as implemented today, ->writepage() and ->writepages() are entirely different operations for journaled data inodes: while the former creates and submits transactions covering the data to be written, the latter flushes dirty buffers out to disk. With gfs2_ail1_start_one() now calling ->writepages(), we end up creating filesystem transactions while we are in the course of a log flush, which immediately deadlocks on the sdp->sd_log_flush_lock semaphore. Work around that by going back to how things used to work before commit b2b0a5e97855 for now; figuring out a superior solution will take time we don't have available right now. However ... Since the removal of generic_writepages() is imminent, open-code it here. We're already inside a blk_start_plug() ... blk_finish_plug() section here, so skip that part of the original generic_writepages(). This reverts commit b2b0a5e978552e348f85ad9c7568b630a5ede659. Signed-off-by: Andreas Gruenbacher Acked-by: Christoph Hellwig commit d732cbf78d616c0b63201eb9e5e4af3fe9b90dc4 Merge: 2241ab53cbb5c ef3691683d7bf Author: Paolo Bonzini Date: Sun Jan 22 03:46:14 2023 -0500 Merge tag 'kvmarm-fixes-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.2, take #2 - Pass the correct address to mte_clear_page_tags() on initialising a tagged page - Plug a race against a GICv4.1 doorbell interrupt while saving the vgic-v3 pending state. commit a1550700629f30c5bd554161524f14f14600d554 Author: Hans Verkuil Date: Wed Dec 28 18:02:27 2022 +0100 media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line The patch that fixed string control support somehow got mangled when it was merged in mainline: the added line ended up in the wrong place. Fix this. Fixes: 73278d483378 ("media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1") Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 2241ab53cbb5cdb08a6b2d4688feb13971058f65 Author: Linus Torvalds Date: Sat Jan 21 16:27:01 2023 -0800 Linux 6.2-rc5 commit 95f184d0e1e14e6fd4368a804db5f870e5f841d2 Merge: f671440228853 8caa03f10bf92 Author: Linus Torvalds Date: Sat Jan 21 16:21:56 2023 -0800 Merge tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux Pull another io_uring fix from Jens Axboe: "Just a single fix for a regression that happened in this release due to a poll change. Normally I would've just deferred it to next week, but since the original fix got picked up by stable, I think it's better to just send this one off separately. The issue is around the poll race fix, and how it mistakenly also got applied to multishot polling. Those don't need the race fix, and we should not be doing any reissues for that case. Exhaustive test cases were written and committed to the liburing regression suite for the reported issue, and additions for similar issues" * tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux: io_uring/poll: don't reissue in case of poll race on multishot request commit f67144022885344375ad03593e7a290cc614da34 Merge: c88a311470642 3daed6345d588 Author: Linus Torvalds Date: Sat Jan 21 11:20:55 2023 -0800 Merge tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc and other subsystem driver fixes for 6.2-rc5 to resolve a few reported issues. They include: - long time pending fastrpc fixes (should have gone into 6.1, my fault) - mei driver/bus fixes and new device ids - interconnect driver fixes for reported problems - vmci bugfix - w1 driver bugfixes for reported problems Almost all of these have been in linux-next with no reported problems, the rest have all passed 0-day bot testing in my tree and on the mailing lists where they have sat too long due to me taking a long time to catch up on my pending patch queue" * tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: VMCI: Use threaded irqs instead of tasklets misc: fastrpc: Pass bitfield into qcom_scm_assign_mem gsmi: fix null-deref in gsmi_get_variable misc: fastrpc: Fix use-after-free race condition for maps misc: fastrpc: Don't remove map on creater_process and device_release misc: fastrpc: Fix use-after-free and race in fastrpc_map_find misc: fastrpc: fix error code in fastrpc_req_mmap() mei: me: add meteor lake point M DID mei: bus: fix unlink on bus in error path w1: fix WARNING after calling w1_process() w1: fix deadloop in __w1_remove_master_device() comedi: adv_pci1760: Fix PWM instruction handling interconnect: qcom: rpm: Use _optional func for provider clocks interconnect: qcom: msm8996: Fix regmap max_register values interconnect: qcom: msm8996: Provide UFS clocks to A2NoC dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC commit c88a3114706429c9edf89e0bf2cd6757270c00f8 Merge: bb86d65775cc3 739790605705d Author: Linus Torvalds Date: Sat Jan 21 11:17:23 2023 -0800 Merge tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are three small driver and kernel core fixes for 6.2-rc5. They include: - potential gadget fixup in do_prlimit - device property refcount leak fix - test_async_probe bugfix for reported problem" * tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: prlimit: do_prlimit needs to have a speculation check driver core: Fix test_async_probe_init saves device in wrong array device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() commit bb86d65775cc3835152c08882384c2534b56f1d3 Merge: bd5cc6ee8f4e8 7d83299351fe7 Author: Linus Torvalds Date: Sat Jan 21 11:15:21 2023 -0800 Merge tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fix from Greg KH: "Here is a single staging driver fix for 6.2-rc5. It resolves a build issue reported and Fixed by Arnd in the vc04_services driver. It's been in linux-next this week with no reported problems" * tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: vchiq_arm: fix enum vchiq_status return types commit bd5cc6ee8f4e823e466a075a79db3cd355cee28e Merge: e67da28898e9e 14ee78d5932af Author: Linus Torvalds Date: Sat Jan 21 11:12:42 2023 -0800 Merge tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for 6.2-rc5 that resolve a number of tiny reported issues and some new device ids. They include: - new device id for the exar serial driver - speakup tty driver bugfix - atmel serial driver baudrate fixup - stm32 serial driver bugfix and then revert as the bugfix broke the build. That will come back in a later pull request once it is all worked out properly. - amba-pl011 serial driver rs486 mode bugfix - qcom_geni serial driver bugfix Most of these have been in linux-next with no reported problems (well, other than the build breakage which generated the revert), the new device id passed 0-day testing" * tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: exar: Add support for Sealevel 7xxxC serial cards Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" tty: serial: qcom_geni: avoid duplicate struct member init serial: atmel: fix incorrect baudrate setup tty: fix possible null-ptr-defer in spk_ttyio_release serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler serial: amba-pl011: fix high priority character transmission in rs486 mode serial: pch_uart: Pass correct sg to dma_unmap_sg() tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer commit e67da28898e9e219176412f2fd2f415dece474ab Merge: 83cd5fd014c0a 14ff7460bb586 Author: Linus Torvalds Date: Sat Jan 21 11:10:03 2023 -0800 Merge tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are a number of small USB and Thunderbolt driver fixes and new device id changes for 6.2-rc5. Included in here are: - thunderbolt bugfixes for reported problems - new usb-serial driver ids added - onboard_hub usb driver fixes for much-reported problems - xhci bugfixes - typec bugfixes - ehci-fsl driver module alias fix - iowarrior header size fix - usb gadget driver fixes All of these, except for the iowarrior fix, have been in linux-next with no reported issues. The iowarrior fix passed the 0-day testing and is a one digit change based on a reported problem in the driver (which was written to a spec, not the real device that is now available)" * tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits) USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 usb: host: ehci-fsl: Fix module alias usb: dwc3: fix extcon dependency usb: core: hub: disable autosuspend for TI TUSB8041 USB: fix misleading usb_set_intfdata() kernel doc usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() USB: gadget: Add ID numbers to configfs-gadget driver names usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail usb: gadget: g_webcam: Send color matching descriptor per frame usb: typec: altmodes/displayport: Use proper macro for pin assignment check usb: typec: altmodes/displayport: Fix pin assignment calculation usb: typec: altmodes/displayport: Add pin assignment helper usb: gadget: f_fs: Ensure ep0req is dequeued before free_request usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: misc: onboard_hub: Move 'attach' work to the driver usb: misc: onboard_hub: Invert driver registration order usb: ucsi: Ensure connector delayed work items are flushed usb: musb: fix error return code in omap2430_probe() usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch) xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables ... commit 83cd5fd014c0abfd3cf6d8e4189333d099630845 Merge: f3bbac32475b2 13e1df09284da Author: Linus Torvalds Date: Sat Jan 21 10:56:37 2023 -0800 Merge tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Hide LDFLAGS_vmlinux from decompressor Makefiles to fix error messages when GNU Make 4.4 is used. - Fix 'make modules' build error when CONFIG_DEBUG_INFO_BTF_MODULES=y. - Fix warnings emitted by GNU Make 4.4 in scripts/kconfig/Makefile. - Support GNU Make 4.4 for scripts/jobserver-exec. - Show clearer error message when kernel/gen_kheaders.sh fails due to missing cpio. * tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kheaders: explicitly validate existence of cpio command scripts: support GNU make 4.4 in jobserver-exec kconfig: Update all declared targets scripts: rpm: make clear that mkspec script contains 4.13 feature init/Kconfig: fix LOCALVERSION_AUTO help text kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux init/version-timestamp.c: remove unneeded #include docs: kbuild: remove mention to dropped $(objtree) feature commit 2acd031347f645871959a799238a7caf6803aa18 Author: Carlos Song Date: Wed Jan 18 15:42:27 2023 +0800 iio: imu: fxos8700: fix MAGN sensor scale and unit +/-1200uT is a MAGN sensor full measurement range. Magnetometer scale is the magnetic sensitivity parameter. It is referenced as 0.1uT according to datasheet and magnetometer channel unit is Gauss in sysfs-bus-iio documentation. Gauss and uTesla unit conversion relationship as follows: 0.1uT = 0.001Gs. Set magnetometer scale and available magnetometer scale as fixed 0.001Gs. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20230118074227.1665098-5-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit ff5e2cd92ffda9a25ffa2cbdb3a0cf17650172a6 Author: Carlos Song Date: Wed Jan 18 15:42:26 2023 +0800 iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN FXOS8700_CTRL_ODR_MIN is not used but value is probably wrong. Remove it for a good readability. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20230118074227.1665098-4-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit eb6d8f8705bc19141bac81d8161461f9e256948a Author: Carlos Song Date: Wed Jan 18 15:42:25 2023 +0800 iio: imu: fxos8700: fix failed initialization ODR mode assignment The absence of correct offset leads a failed initialization ODR mode assignment. Select MAX ODR mode as the initialization ODR mode by field mask and FIELD_PREP. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20230118074227.1665098-3-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 78ad6864e9e012cdba7c353d044d21ffcfd5f34b Author: Carlos Song Date: Wed Jan 18 15:42:24 2023 +0800 iio: imu: fxos8700: fix incorrect ODR mode readback The absence of a correct offset leads an incorrect ODR mode readback after use a hexadecimal number to mark the value from FXOS8700_CTRL_REG1. Get ODR mode by field mask and FIELD_GET clearly and conveniently. And attach other additional fix for keeping the original code logic and a good readability. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20230118074227.1665098-2-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit f3bbac32475b27f49be201f896d98d4009de1562 Author: Linus Torvalds Date: Tue Jan 17 20:27:23 2023 -0800 ext4: deal with legacy signed xattr name hash values We potentially have old hashes of the xattr names generated on systems with signed 'char' types. Now that everybody uses '-funsigned-char', those hashes will no longer match. This only happens if you use xattrs names that have the high bit set, which probably doesn't happen in practice, but the xfstest generic/454 shows it. Instead of adding a new "signed xattr hash filesystem" bit and having to deal with all the possible combinations, just calculate the hash both ways if the first one fails, and always generate new hashes with the proper unsigned char version. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202212291509.704a11c9-oliver.sang@intel.com Link: https://lore.kernel.org/all/CAHk-=whUNjwqZXa-MH9KMmc_CpQpoFKFjAB9ZKHuu=TbsouT4A@mail.gmail.com/ Exposed-by: 3bc753c06dd0 ("kbuild: treat char as always unsigned") Cc: Eric Biggers Cc: Andreas Dilger Cc: Theodore Ts'o , Cc: Jason Donenfeld Cc: Masahiro Yamada Signed-off-by: Linus Torvalds commit ee3c5b644a0fdcfed27515a39fb2dd3a016704c1 Author: Kai-Heng Feng Date: Thu Jan 19 01:04:22 2023 +0800 iio: light: cm32181: Fix PM support on system with 2 I2C resources Commit c1e62062ff54 ("iio: light: cm32181: Handle CM3218 ACPI devices with 2 I2C resources") creates a second client for the actual I2C address, but the "struct device" passed to PM ops is the first I2C client that can't talk to the sensor. That means the I2C transfers in both suspend and resume routines can fail and blocking the whole suspend process. Instead of using the first client for I2C transfer, use the I2C client stored in the cm32181 private struct so the PM ops can get the correct I2C client to really talk to the sensor device. Fixes: 68c1b3dd5c48 ("iio: light: cm32181: Add PM support") BugLink: https://bugs.launchpad.net/bugs/1988346 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152281 Tested-by: Wahaj Signed-off-by: Kai-Heng Feng Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230118170422.339619-1-kai.heng.feng@canonical.com Cc: Signed-off-by: Jonathan Cameron commit 739790605705ddcf18f21782b9c99ad7d53a8c11 Author: Greg Kroah-Hartman Date: Fri Jan 20 11:03:20 2023 +0100 prlimit: do_prlimit needs to have a speculation check do_prlimit() adds the user-controlled resource value to a pointer that will subsequently be dereferenced. In order to help prevent this codepath from being used as a spectre "gadget" a barrier needs to be added after checking the range. Reported-by: Jordy Zomer Tested-by: Jordy Zomer Suggested-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ef3691683d7bfd0a2acf48812e4ffe894f10bfa8 Author: Marc Zyngier Date: Thu Jan 19 11:07:59 2023 +0000 KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation To save the vgic LPI pending state with GICv4.1, the VPEs must all be unmapped from the ITSs so that the sGIC caches can be flushed. The opposite is done once the state is saved. This is all done by using the activate/deactivate irqdomain callbacks directly from the vgic code. Crutially, this is done without holding the irqdesc lock for the interrupts that represent the VPE. And these callbacks are changing the state of the irqdesc. What could possibly go wrong? If a doorbell fires while we are messing with the irqdesc state, it will acquire the lock and change the interrupt state concurrently. Since we don't hole the lock, curruption occurs in on the interrupt state. Oh well. While acquiring the lock would fix this (and this was Shanker's initial approach), this is still a layering violation we could do without. A better approach is actually to free the VPE interrupt, do what we have to do, and re-request it. It is more work, but this usually happens only once in the lifetime of the VM and we don't really care about this sort of overhead. Fixes: f66b7b151e00 ("KVM: arm64: GICv4.1: Try to save VLPI state in save_pending_tables") Reported-by: Shanker Donthineni Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230118022348.4137094-1-sdonthineni@nvidia.com commit c3b37c2d77a2c735857c55492ee81e88e855497d Author: Catalin Marinas Date: Thu Jan 19 17:09:02 2023 +0000 KVM: arm64: Pass the actual page address to mte_clear_page_tags() Commit d77e59a8fccd ("arm64: mte: Lock a page for MTE tag initialisation") added a call to mte_clear_page_tags() in case a prior mte_copy_tags_from_user() failed in order to avoid stale tags in the guest page (it should have really been a separate commit). Unfortunately, the argument passed to this function was the address of the struct page rather than the actual page address. Fix this function call. Fixes: d77e59a8fccd ("arm64: mte: Lock a page for MTE tag initialisation") Signed-off-by: Catalin Marinas Cc: Marc Zyngier Reviewed-by: Oliver Upton Reviewed-by: Anshuman Khandual Reviewed-by: Cornelia Huck Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230119170902.1574756-1-catalin.marinas@arm.com commit 71ab9c3e2253619136c31c89dbb2c69305cc89b1 Author: Paolo Abeni Date: Thu Jan 19 19:55:45 2023 +0100 net: fix UaF in netns ops registration error path If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in such error path, the gen pointer itself has not been modified yet, and the existing and accessed one is smaller than the accessed index, causing an out-of-bounds error: BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320 Write of size 8 at addr ffff888109124978 by task modprobe/1018 CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: dump_stack_lvl+0x6a/0x9f print_address_description.constprop.0+0x86/0x2b5 print_report+0x11b/0x1fb kasan_report+0x87/0xc0 ops_init+0x2de/0x320 register_pernet_operations+0x2e4/0x750 register_pernet_subsys+0x24/0x40 tcf_register_action+0x9f/0x560 do_one_initcall+0xf9/0x570 do_init_module+0x190/0x650 load_module+0x1fa5/0x23c0 __do_sys_finit_module+0x10d/0x1b0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f42518f778d Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003 RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000 This change addresses the issue by skipping the gen pointer de-reference in the mentioned error-path. Found by code inspection and verified with explicit error injection on a kasan-enabled kernel. Fixes: d266935ac43d ("net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed") Signed-off-by: Paolo Abeni Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/cec4e0f3bb2c77ac03a6154a8508d3930beb5f0f.1674154348.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit fd941bd64f0776e4c51d8934f8e666cfbe14406a Author: Yoshihiro Shimoda Date: Fri Jan 20 09:19:59 2023 +0900 net: ethernet: renesas: rswitch: Fix ethernet-ports handling If one of ports in the ethernet-ports was disabled, this driver failed to probe all ports. So, fix it. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Jiri Pirko Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20230120001959.1059850-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Jakub Kicinski commit 20e3028c39a5bf882e91e717da96d14f1acec40e Author: Haiyang Zhang Date: Thu Jan 19 12:59:10 2023 -0800 net: mana: Fix IRQ name - add PCI and queue number The PCI and queue number info is missing in IRQ names. Add PCI and queue number to IRQ names, to allow CPU affinity tuning scripts to work. Cc: stable@vger.kernel.org Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Haiyang Zhang Reviewed-by: Jesse Brandeburg Link: https://lore.kernel.org/r/1674161950-19708-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski commit f0950402e8c76e7dcb08563f1b4e8000fbc62455 Author: Eric Dumazet Date: Thu Jan 19 11:01:50 2023 +0000 netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions. Fixes: bfa83a9e03cf ("[NETLINK]: Type-safe netlink messages/attributes interface") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230119110150.2678537-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f883675bf6522b52cd75dc3de791680375961769 Merge: 4e31badaa188d 4cb786180dfb5 Author: Linus Torvalds Date: Fri Jan 20 17:13:55 2023 -0800 Merge tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a potential race condition and always set GPIOs used as interrupt source to input in gpio-mxc - fix a GPIO ACPI-related issue with system suspend on Clevo NL5xRU * tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock commit 4e31badaa188d0e2923f5082c041083c05bda3ff Merge: 8440ffcd68c64 a1b7c8457ecc0 Author: Linus Torvalds Date: Fri Jan 20 14:28:49 2023 -0800 Merge tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: - important fix for packet signature calculation error - three fixes to correct DFS deadlock, and DFS refresh problem - remove an unused DFS function, and duplicate tcon refresh code - DFS cache lookup fix - uninitialized rc fix * tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: remove unused function cifs: do not include page data when checking signature cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() cifs: handle cache lookup errors different than -ENOENT cifs: remove duplicate code in __refresh_tcon() cifs: don't take exclusive lock for updating target hints cifs: avoid re-lookups in dfs_cache_find() cifs: fix potential deadlock in cache_refresh_path() commit 8440ffcd68c644e846ce6b23ff13b348d49b2abf Merge: 8974efaa33859 431d153146603 Author: Linus Torvalds Date: Fri Jan 20 14:22:56 2023 -0800 Merge tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Compilation fix for Sunplus sp7021 - Add some missing headers after a cleanup to the Nomadik driver - Fix pull type and mux routes on Rockchip RK3568 * tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: rockchip: fix mux route data for rk3568 pinctrl: rockchip: fix reading pull type on rk3568 pinctrl: nomadik: Add missing header(s) pinctrl: sp7021: fix unused function warning commit efaeb5f9f83965010c83c59665840541a54bbaf4 Merge: 1b929c02afd37 86d884f5287f4 Author: Stephen Boyd Date: Fri Jan 20 14:19:25 2023 -0800 Merge tag 'clk-microchip-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-fixes Pull a Microchip clock fix from Claudiu Beznea: Only one fix for Polarfire SoCs at this time as follows: - replace devm_kzalloc() with devm_kasprintf(); this has been marked as fix to avoid having registered 2 clocks with the same or invalid name in case device tree node addresses will be longer such that clocks registered with name patern "ccc_pll" will exeed the allocated space. * tag 'clk-microchip-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: microchip: mpfs-ccc: Use devm_kasprintf() for allocating formatted strings commit 8974efaa3385959e7ea1019a4b63acff28631e6d Merge: edc00350d205d 0f097f08c9b3c Author: Linus Torvalds Date: Fri Jan 20 14:15:51 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Several hfi1 patches fixing some long standing driver bugs - Overflow when working with sg lists with elements greater than 4G - An rxe regression with object numbering after the mrs reach their limit - A theoretical problem with the scatterlist merging code * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: lib/scatterlist: Fix to calculate the last_pg properly IB/hfi1: Remove user expected buffer invalidate race IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Reserve user expected TIDs IB/hfi1: Reject a zero-length user expected buffer RDMA/core: Fix ib block iterator counter overflow RDMA/rxe: Prevent faulty rkey generation RDMA/rxe: Fix inaccurate constants in rxe_type_info commit 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 Author: Jens Axboe Date: Fri Jan 20 15:08:21 2023 -0700 io_uring/poll: don't reissue in case of poll race on multishot request A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests. Cc: stable@vger.kernel.org Fixes: 6e5aedb9324a ("io_uring/poll: attempt request issue after racy poll wakeup") Reported-and-tested-by: Olivier Langlois Link: https://github.com/axboe/liburing/issues/778 Signed-off-by: Jens Axboe commit 5fde3c21cf33830eda7bfd006dc7f4bf07ec9fe6 Author: Marios Makassikis Date: Wed Jan 11 17:39:02 2023 +0100 ksmbd: do not sign response to session request for guest login If ksmbd.mountd is configured to assign unknown users to the guest account ("map to guest = bad user" in the config), ksmbd signs the response. This is wrong according to MS-SMB2 3.3.5.5.3: 12. If the SMB2_SESSION_FLAG_IS_GUEST bit is not set in the SessionFlags field, and Session.IsAnonymous is FALSE, the server MUST sign the final session setup response before sending it to the client, as follows: [...] This fixes libsmb2 based applications failing to establish a session ("Wrong signature in received"). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0d0d4680db22eda1eea785c47bbf66a9b33a8b16 Author: Namjae Jeon Date: Thu Dec 29 18:33:25 2022 +0900 ksmbd: add max connections parameter Add max connections parameter to limit number of maximum simultaneous connections. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reviewed-by: Sergey Senozhatsky Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit edc00350d205d2de8871b514c8f9b403d588e5d1 Merge: 9c38747f0cdb2 955bc12299b17 Author: Linus Torvalds Date: Fri Jan 20 12:44:41 2023 -0800 Merge tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Various little tweaks all over the place: - NVMe pull request via Christoph: - fix controller shutdown regression in nvme-apple (Janne Grunau) - fix a polling on timeout regression in nvme-pci (Keith Busch) - Fix a bug in the read request side request allocation caching (Pavel) - pktcdvd was brought back after we configured a NULL return on bio splits, make it consistent with the others (me) - BFQ refcount fix (Yu) - Block cgroup policy activation fix (Yu) - Fix for an md regression introduced in the 6.2 cycle (Adrian)" * tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux: nvme-pci: fix timeout request state check nvme-apple: only reset the controller when RTKit is running nvme-apple: reset controller during shutdown block: fix hctx checks for batch allocation block/rnbd-clt: fix wrong max ID in ida_alloc_max blk-cgroup: fix missing pd_online_fn() while activating policy pktcdvd: check for NULL returna fter calling bio_split_to_limits() block, bfq: switch 'bfqg->ref' to use atomic refcount apis md: fix incorrect declaration about claim_rdev in md_import_device commit 9c38747f0cdb20516de3d708f39720762786750a Merge: 26e57507a0f04 8579538c89e33 Author: Linus Torvalds Date: Fri Jan 20 12:39:45 2023 -0800 Merge tag 'io_uring-6.2-2023-01-20' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Fixes for the MSG_RING opcode. Nothing really major: - Fix an overflow missing serialization around posting CQEs to the target ring (me) - Disable MSG_RING on a ring that isn't enabled yet. There's nothing really wrong with allowing it, but 1) it's somewhat odd as nobody can receive them yet, and 2) it means that using the right delivery mechanism might change. As nobody should be sending CQEs to a ring that isn't enabled yet, let's just disable it (Pavel) - Tweak to when we decide to post remotely or not for MSG_RING (Pavel)" * tag 'io_uring-6.2-2023-01-20' of git://git.kernel.dk/linux: io_uring/msg_ring: fix remote queue to disabled ring io_uring/msg_ring: fix flagging remote execution io_uring/msg_ring: fix missing lock on overflow for IOPOLL io_uring/msg_ring: move double lock/unlock helpers higher up commit 26e57507a0f04ae0e472afe4799784e2ed19e1b0 Merge: d9166cb31cb08 b7adbf9ada351 Author: Linus Torvalds Date: Fri Jan 20 11:59:01 2023 -0800 Merge tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix potential out-of-bounds access to leaf data when seeking in an inline file - fix potential crash in quota when rescan races with disable - reimplement super block signature scratching by marking page/folio dirty and syncing block device, allow removing write_one_page * tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix race between quota rescan and disable leading to NULL pointer deref btrfs: fix invalid leaf access due to inline extent during lseek btrfs: stop using write_one_page in btrfs_scratch_superblock btrfs: factor out scratching of one regular super block commit d9166cb31cb08f027011e8b6159966810bb514e3 Merge: dc18175938e65 9fdaca2c1e157 Author: Linus Torvalds Date: Fri Jan 20 11:35:21 2023 -0800 Merge tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fix from Shuah Khan: "Fix an error seen during unconfigured LLVM builds" * tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftest: Fix error message for unconfigured LLVM builds commit dc18175938e65e979b866f23dc5b93e81d649cc4 Merge: fe563a2c554c8 6c54b7bc8a31c Author: Linus Torvalds Date: Fri Jan 20 11:14:41 2023 -0800 Merge tag 'thermal-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Modify __thermal_cooling_device_register() to make it call put_device() after invoking device_register() and fix up a few error paths calling thermal_cooling_device_destroy_sysfs() unnecessarily (Viresh Kumar)" * tag 'thermal-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: call put_device() only after device_register() fails commit fe563a2c554c8cd07078eb1dacd3ea6148bd4681 Merge: 1670d7e69b044 3bdd346ebda37 Author: Linus Torvalds Date: Fri Jan 20 11:11:35 2023 -0800 Merge tag 'acpi-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These update the ACPICA entry in MAINTAINERS, add a backlight handling quirk and fix the ACPI PRM (platform runtime) mechanism support. Specifics: - Update the ACPICA development list address in MAINTAINERS to the new one that does not bounce (Rafael Wysocki) - Check whether EFI runtime is available when registering the ACPI PRM address space handler and when running it (Ard Biesheuvel) - Add backlight=native DMI quirk for Acer Aspire 4810T to the ACPI video driver (Hans de Goede)" * tag 'acpi-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PRM: Check whether EFI runtime is available ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T MAINTAINERS: Update the ACPICA development list address commit 1670d7e69b044e900bb6a3d57a03c9202ea387ae Merge: 1ed46384f85bc 8509419758f2c Author: Linus Torvalds Date: Fri Jan 20 11:04:59 2023 -0800 Merge tag 'mmc-v6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - sunxi-mmc: Fix clock refcount imbalance during unbind - sdhci-esdhc-imx: Fix some tuning settings * tag 'mmc-v6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sunxi-mmc: Fix clock refcount imbalance during unbind mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting commit 1ed46384f85bcf05fc9b6605f9fd54e1f81a331d Merge: ff83fec8179e3 d2c865553adb7 Author: Linus Torvalds Date: Fri Jan 20 11:00:03 2023 -0800 Merge tag 'soc-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC DT and driver fixes from Arnd Bergmann: "Lots of dts fixes for Qualcomm Snapdragon and NXP i.MX platforms, including: - A regression fix for SDHCI controllers on Inforce 6540, and another SDHCI fix on SM8350 - Reenable cluster idle on sm8250 after the the code fix is upstream - multiple fixes for the QMP PHY binding, needing an incompatible dt change - The reserved memory map is updated on Xiaomi Mi 4C and Huawei Nexus 6P, to avoid instabilities caused by use of protected memory regions - Fix i.MX8MP DT for missing GPC Interrupt, power-domain typo and USB clock error - A couple of verdin-imx8mm DT fixes for audio playback support - Fix pca9547 i2c-mux node name for i.MX and Vybrid device trees - Fix an imx93-11x11-evk uSDHC pad setting problem that causes Micron eMMC CMD8 CRC error in HS400ES/HS400 mode The remaining ARM and RISC-V platforms only have very few smaller dts bugfixes this time: - A fix for the SiFive unmatched board's PCI memory space - A revert to fix a regression with GPIO on Marvell Armada - A fix for the UART address on Marvell AC5 - Missing chip-select phandles for stm32 boards - Selecting the correct clock for the sam9x60 memory controller - Amlogic based Odroid-HC4 needs a revert to restore USB functionality. And finally, there are some minor code fixes: - Build fixes for OMAP1, pxa, riscpc, raspberry pi firmware, and zynq firmware - memory controller driver fixes for an OMAP regression and older bugs on tegra, atmel and mvebu - reset controller fixes for ti-sci and uniphier platforms - ARM SCMI firmware fixes for a couple of rare corner cases - Qualcomm platform driver fixes for incorrect error handling and a backwards compatibility fix for the apr driver using older dtb - NXP i.MX SoC driver fixes for HDMI output, error handling in the imx8 soc-id and missing reference counting on older cpuid code" * tag 'soc-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (60 commits) firmware: zynqmp: fix declarations for gcc-13 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 ARM: omap1: fix building gpio15xx ARM: omap1: fix !ARCH_OMAP1_ANY link failures firmware: raspberrypi: Fix type assignment arm64: dts: qcom: msm8992-libra: Fix the memory map arm64: dts: qcom: msm8992: Don't use sfpb mutex PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() arm64: dts: msm8994-angler: fix the memory map arm64: dts: marvell: AC5/AC5X: Fix address for UART1 ARM: footbridge: drop unnecessary inclusion Revert "ARM: dts: armada-39x: Fix compatible string for gpios" Revert "ARM: dts: armada-38x: Fix compatible string for gpios" ARM: pxa: enable PXA310/PXA320 for DT-only build riscv: dts: sifive: fu740: fix size of pcie 32bit memory soc: qcom: apr: Make qcom,protection-domain optional again ... commit 977c6ba624f24ae20cf0faee871257a39348d4a9 Author: Manivannan Sadhasivam Date: Wed Jan 18 20:38:50 2023 +0530 EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver. Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs") Reported-by: Steev Klimaszewski Signed-off-by: Manivannan Sadhasivam Signed-off-by: Borislav Petkov (AMD) Tested-by: Steev Klimaszewski # Thinkpad X13s Tested-by: Andrew Halaney # sa8540p-ride Cc: # 4.20 Link: https://lore.kernel.org/r/20230118150904.26913-4-manivannan.sadhasivam@linaro.org commit ff83fec8179e392be2f472f0a9ec3da8f6d529c6 Merge: 35929dae72332 3f30a6e67ce49 Author: Linus Torvalds Date: Fri Jan 20 10:43:07 2023 -0800 Merge tag 'drm-fixes-2023-01-20' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Just a pretty regular week for this stage of things, amdgpu and i915, along with some msm and misc others. fb-helper: - switcheroo fix msm: - kexec shutdown fix - fix potential double free i915: - Reject display plane with height == 0 - re-disable RC6p on Sandy Bridge - Fix hugepages' selftest - DG2 hw workarounds - switcheroo fix vc4: - fix a memory leak panfrost: - Kconfig fix amdgpu: - Fix display scaling - Fix RN/CZN power reporting on some firmware versions - Colorspace fixes - Fix resource freeing in error case in CS IOCTL - Fix warning on driver unload - GC11 fixes - DCN 3.1.4/5 S/G display workarounds" * tag 'drm-fixes-2023-01-20' of git://anongit.freedesktop.org/drm/drm: (24 commits) drm/amd/display: disable S/G display on DCN 3.1.4 drm/amd/display: disable S/G display on DCN 3.1.5 drm/amdgpu: allow multipipe policy on ASICs with one MEC drm/amdgpu: correct MEC number for gfx11 APUs drm/amd/display: fix issues with driver unload drm/amdgpu: fix amdgpu_job_free_resources v2 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix drm/amd/display: Calculate output_color_space after pixel encoding adjustment drm/amdgpu: fix cleaning up reserved VMID on release drm/amdgpu: Correct the power calcultion for Renior/Cezanne. drm/amd/display: Fix set scaling doesn's work drm/i915: Remove unused variable drm/i915/dg2: Introduce Wa_18019271663 drm/i915/dg2: Introduce Wa_18018764978 drm/fb-helper: Set framebuffer for vga-switcheroo clients drm/i915: Allow switching away via vga-switcheroo if uninitialized drm/i915/selftests: Unwind hugepages to drop wakeref on error drm/i915: re-disable RC6p on Sandy Bridge drm/panfrost: fix GENERIC_ATOMIC64 dependency drm/i915/display: Check source height is > 0 ... commit 35929dae72332e41cb11b56439999fd0295d5a64 Merge: aaaf919c2ef59 95e5fda3b5f9e Author: Linus Torvalds Date: Fri Jan 20 10:23:14 2023 -0800 Merge tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - email address Update for Jie Hai - fix double increment of client_count in dma_chan_get() - idxd driver fixes: use after free, probe error handling and callback on wq disable - fix for qcom gpi driver GO tre - ptdma locking fix - tegra & imx-sdma mem leak fix * tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: ptdma: pt_core_execute_cmd() should use spinlock dmaengine: tegra: Fix memory leak in terminate_all() dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init dmaengine: Fix double increment of client_count in dma_chan_get() dmaengine: tegra210-adma: fix global intr clear Add exception protection processing for vd in axi_chan_handle_err function dmaengine: lgm: Move DT parsing after initialization MAINTAINERS: update Jie Hai's email address dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable dmaengine: idxd: Prevent use after free on completion memory dmaengine: idxd: Let probe fail when workqueue cannot be enabled dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation commit aaaf919c2ef595ab9a8a6810f53a6db685dbba40 Merge: 5deaa98587aca bc30c15f27548 Author: Linus Torvalds Date: Fri Jan 20 10:10:52 2023 -0800 Merge tag 'phy-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - binding fix for g12a phys - Kconfig operator precedence for TI driver - renesas: register setting - sunplus: null deref fix - rockchip-inno fix for clk_disable_unprepare() - MDM9607 init sequence revert due to regression * tag 'phy-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: phy-can-transceiver: Skip warning if no "max-bitrate" dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation phy: freescale: imx8m-pcie: Add one missing error return phy: Revert "phy: qualcomm: usb28nm: Add MDM9607 init sequence" phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() phy: renesas: r8a779f0-eth-serdes: Fix register setting phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe() phy: ti: fix Kconfig warning and operator precedence commit 5deaa98587aca2f0e7605388e89cfa1df4bad5cb Merge: 4a0c7a6831a0a 45a919bbb21c6 Author: Linus Torvalds Date: Fri Jan 20 09:58:44 2023 -0800 Merge tag 'net-6.2-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless, bluetooth, bpf and netfilter. Current release - regressions: - Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf", fix nsna_ping mode of team - wifi: mt76: fix bugs in Rx queue handling and DMA mapping - eth: mlx5: - add missing mutex_unlock in error reporter - protect global IPsec ASO with a lock Current release - new code bugs: - rxrpc: fix wrong error return in rxrpc_connect_call() Previous releases - regressions: - bluetooth: hci_sync: fix use of HCI_OP_LE_READ_BUFFER_SIZE_V2 - wifi: - mac80211: fix crashes on Rx due to incorrect initialization of rx->link and rx->link_sta - mac80211: fix bugs in iTXQ conversion - Tx stalls, incorrect aggregation handling, crashes - brcmfmac: fix regression for Broadcom PCIe wifi devices - rndis_wlan: prevent buffer overflow in rndis_query_oid - netfilter: conntrack: handle tcp challenge acks during connection reuse - sched: avoid grafting on htb_destroy_class_offload when destroying - virtio-net: correctly enable callback during start_xmit, fix stalls - tcp: avoid the lookup process failing to get sk in ehash table - ipa: disable ipa interrupt during suspend - eth: stmmac: enable all safety features by default Previous releases - always broken: - bpf: - fix pointer-leak due to insufficient speculative store bypass mitigation (Spectre v4) - skip task with pid=1 in send_signal_common() to avoid a splat - fix BPF program ID information in BPF_AUDIT_UNLOAD as well as PERF_BPF_EVENT_PROG_UNLOAD events - fix potential deadlock in htab_lock_bucket from same bucket index but different map_locked index - bluetooth: - fix a buffer overflow in mgmt_mesh_add() - hci_qca: fix driver shutdown on closed serdev - ISO: fix possible circular locking dependency - CIS: hci_event: fix invalid wait context - wifi: brcmfmac: fixes for survey dump handling - mptcp: explicitly specify sock family at subflow creation time - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits - tcp: fix rate_app_limited to default to 1 - l2tp: close all race conditions in l2tp_tunnel_register() - eth: mlx5: fixes for QoS config and eswitch configuration - eth: enetc: avoid deadlock in enetc_tx_onestep_tstamp() - eth: stmmac: fix invalid call to mdiobus_get_phy() Misc: - ethtool: add netlink attr in rss get reply only if the value is not empty" * tag 'net-6.2-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits) Revert "Merge branch 'octeontx2-af-CPT'" tcp: fix rate_app_limited to default to 1 bnxt: Do not read past the end of test names net: stmmac: enable all safety features by default octeontx2-af: add mbox to return CPT_AF_FLT_INT info octeontx2-af: update cpt lf alloc mailbox octeontx2-af: restore rxc conf after teardown sequence octeontx2-af: optimize cpt pf identification octeontx2-af: modify FLR sequence for CPT octeontx2-af: add mbox for CPT LF reset octeontx2-af: recover CPT engine when it gets fault net: dsa: microchip: ksz9477: port map correction in ALU table entry register selftests/net: toeplitz: fix race on tpacket_v3 block close net/ulp: use consistent error code when blocking ULP octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt tcp: avoid the lookup process failing to get sk in ehash table Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf" MAINTAINERS: add networking entries for Willem net: sched: gred: prevent races when adding offloads to stats l2tp: prevent lockdep issue in l2tp_tunnel_register() ... commit 29f316a1d7e0a570be9a47fa283ece53a67cebb7 Author: Takahiro Fujii Date: Fri Jan 20 03:30:02 2023 +0900 HID: elecom: add support for TrackBall 056E:011C Make function buttons on ELECOM M-HT1DRBK trackball mouse work. This model has two devices with different device IDs (010D and 011C). Both of them misreports the number of buttons as 5 in the report descriptor, even though they have 8 buttons. hid-elecom overwrites the report to fix them, but supports only on 010D and does not work on 011C. This patch fixes 011C in the similar way but with specialized position parameters. In fact, it is sufficient to rewrite only 17th byte (05 -> 08). However I followed the existing way. Signed-off-by: Takahiro Fujii Signed-off-by: Jiri Kosina commit 3bdd346ebda37f4cb12461d5e83a5b9d575afc63 Merge: 81aae5cbd36da 182da6f2b81a7 8ba5fc4c154ae Author: Rafael J. Wysocki Date: Fri Jan 20 18:42:16 2023 +0100 Merge branches 'acpi-prm' and 'acpi-video' Merge an ACPI PRM (platform runtime) support fix and an ACPI backlight quirk for 6.2-rc5: - Check whether EFI runtime is available when registering the ACPI PRM address space handler and when running it (Ard Biesheuvel). - Add backlight=native DMI quirk for Acer Aspire 4810T to the ACPI video driver (Hans de Goede). * acpi-prm: ACPI: PRM: Check whether EFI runtime is available * acpi-video: ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T commit db105c37a4d69d684c1edf2915557463d0ba172c Author: Arnd Bergmann Date: Tue Jan 17 17:50:26 2023 +0100 kunit: Export kunit_running() Using kunit_fail_current_test() in a loadable module causes a link error like: ERROR: modpost: "kunit_running" [drivers/gpu/drm/vc4/vc4.ko] undefined! Export the symbol to allow using it from modules. Fixes: da43ff045c3f ("drm/vc4: tests: Fail the current test if we access a register") Signed-off-by: Arnd Bergmann Reviewed-by: David Gow Signed-off-by: Shuah Khan commit e2b53ea5a7c1fb484277ad12cd075f502cf03b04 Author: Stefan Assmann Date: Tue Jan 10 09:00:18 2023 +0100 iavf: schedule watchdog immediately when changing primary MAC iavf_replace_primary_mac() utilizes queue_work() to schedule the watchdog task but that only ensures that the watchdog task is queued to run. To make sure the watchdog is executed asap use mod_delayed_work(). Without this patch it may take up to 2s until the watchdog task gets executed, which may cause long delays when setting the MAC address. Fixes: a3e839d539e0 ("iavf: Add usage of new virtchnl format to set default MAC") Signed-off-by: Stefan Assmann Reviewed-by: Michal Schmidt Tested-by: Michal Schmidt Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 7598f4b40bd60e4a4280de645eb2893eea80b59d Author: Marcin Szycik Date: Tue Jan 3 17:42:27 2023 +0100 iavf: Move netdev_update_features() into watchdog task Remove netdev_update_features() from iavf_adminq_task(), as it can cause deadlocks due to needing rtnl_lock. Instead use the IAVF_FLAG_SETUP_NETDEV_FEATURES flag to indicate that netdev features need to be updated in the watchdog task. iavf_set_vlan_offload_features() and iavf_set_queue_vlan_tag_loc() can be called directly from iavf_virtchnl_completion(). Suggested-by: Phani Burra Signed-off-by: Marcin Szycik Reviewed-by: Alexander Lobakin Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 4411a608f7c8df000cb1a9f7881982dd8e10839a Author: Michal Schmidt Date: Thu Dec 15 23:50:48 2022 +0100 iavf: fix temporary deadlock and failure to set MAC address We are seeing an issue where setting the MAC address on iavf fails with EAGAIN after the 2.5s timeout expires in iavf_set_mac(). There is the following deadlock scenario: iavf_set_mac(), holding rtnl_lock, waits on: iavf_watchdog_task (within iavf_wq) to send a message to the PF, and iavf_adminq_task (within iavf_wq) to receive a response from the PF. In this adapter state (>=__IAVF_DOWN), these tasks do not need to take rtnl_lock, but iavf_wq is a global single-threaded workqueue, so they may get stuck waiting for another adapter's iavf_watchdog_task to run iavf_init_config_adapter(), which does take rtnl_lock. The deadlock resolves itself by the timeout in iavf_set_mac(), which results in EAGAIN returned to userspace. Let's break the deadlock loop by changing iavf_wq into a per-adapter workqueue, so that one adapter's tasks are not blocked by another's. Fixes: 35a2443d0910 ("iavf: Add waiting for response from PF in set mac") Co-developed-by: Ivan Vecera Signed-off-by: Ivan Vecera Signed-off-by: Michal Schmidt Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 8579538c89e33ce78be2feb41e07489c8cbf8f31 Author: Pavel Begunkov Date: Fri Jan 20 16:38:06 2023 +0000 io_uring/msg_ring: fix remote queue to disabled ring IORING_SETUP_R_DISABLED rings don't have the submitter task set, so it's not always safe to use ->submitter_task. Disallow posting msg_ring messaged to disabled rings. Also add task NULL check for loosy sync around testing for IORING_SETUP_R_DISABLED. Cc: stable@vger.kernel.org Fixes: 6d043ee1164ca ("io_uring: do msg_ring in target task via tw") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 56d8e3180c065c9b78ed77afcd0cf99677a4e22f Author: Pavel Begunkov Date: Fri Jan 20 16:38:05 2023 +0000 io_uring/msg_ring: fix flagging remote execution There is a couple of problems with queueing a tw in io_msg_ring_data() for remote execution. First, once we queue it the target ring can go away and so setting IORING_SQ_TASKRUN there is not safe. Secondly, the userspace might not expect IORING_SQ_TASKRUN. Extract a helper and uniformly use TWA_SIGNAL without TWA_SIGNAL_NO_IPI tricks for now, just as it was done in the original patch. Cc: stable@vger.kernel.org Fixes: 6d043ee1164ca ("io_uring: do msg_ring in target task via tw") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 45a919bbb21c642e0c34dac483d1e003560159dc Author: Jakub Kicinski Date: Fri Jan 20 08:38:16 2023 -0800 Revert "Merge branch 'octeontx2-af-CPT'" This reverts commit b4fbf0b27fa9dd2594b3371532341bd4636a00f9, reversing changes made to 6c977c5c2e4c5d8ad1b604724cc344e38f96fe9b. This seems like net-next material. Signed-off-by: Jakub Kicinski commit 74bc3a5acc82f020d2e126f56c535d02d1e74e37 Author: Jiri Olsa Date: Fri Jan 20 13:21:48 2023 +0100 bpf: Add missing btf_put to register_btf_id_dtor_kfuncs We take the BTF reference before we register dtors and we need to put it back when it's done. We probably won't se a problem with kernel BTF, but module BTF would stay loaded (because of the extra ref) even when its module is removed. Cc: Kumar Kartikeya Dwivedi Fixes: 5ce937d613a4 ("bpf: Populate pairs of btf_id and destructor kfunc in btf") Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20230120122148.1522359-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 51cdc8bc120ef6e42f6fb758341f5d91bc955952 Author: Yi Liu Date: Fri Jan 20 07:05:28 2023 -0800 kvm/vfio: Fix potential deadlock on vfio group_lock Currently it is possible that the final put of a KVM reference comes from vfio during its device close operation. This occurs while the vfio group lock is held; however, if the vfio device is still in the kvm device list, then the following call chain could result in a deadlock: VFIO holds group->group_lock/group_rwsem -> kvm_put_kvm -> kvm_destroy_vm -> kvm_destroy_devices -> kvm_vfio_destroy -> kvm_vfio_file_set_kvm -> vfio_file_set_kvm -> try to hold group->group_lock/group_rwsem The key function is the kvm_destroy_devices() which triggers destroy cb of kvm_device_ops. It calls back to vfio and try to hold group_lock. So if this path doesn't call back to vfio, this dead lock would be fixed. Actually, there is a way for it. KVM provides another point to free the kvm-vfio device which is the point when the device file descriptor is closed. This can be achieved by providing the release cb instead of the destroy cb. Also rename kvm_vfio_destroy() to be kvm_vfio_release(). /* * Destroy is responsible for freeing dev. * * Destroy may be called before or after destructors are called * on emulated I/O regions, depending on whether a reference is * held by a vcpu or other kvm component that gets destroyed * after the emulated I/O. */ void (*destroy)(struct kvm_device *dev); /* * Release is an alternative method to free the device. It is * called when the device file descriptor is closed. Once * release is called, the destroy method will not be called * anymore as the device is removed from the device list of * the VM. kvm->lock is held. */ void (*release)(struct kvm_device *dev); Fixes: 421cfe6596f6 ("vfio: remove VFIO_GROUP_NOTIFY_SET_KVM") Reported-by: Alex Williamson Suggested-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Yi Liu Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/r/20230114000351.115444-1-mjrosato@linux.ibm.com Link: https://lore.kernel.org/r/20230120150528.471752-1-yi.l.liu@intel.com [aw: update comment as well, s/destroy/release/] Signed-off-by: Alex Williamson commit 955bc12299b17aa60325e1748336e1fd1e664ed0 Merge: 7746564793978 1c5842085851f Author: Jens Axboe Date: Fri Jan 20 08:08:29 2023 -0700 Merge tag 'nvme-6.2-2023-01-20' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - fix controller shutdown regression in nvme-apple (Janne Grunau) - fix a polling on timeout regression in nvme-pci (Keith Busch)" * tag 'nvme-6.2-2023-01-20' of git://git.infradead.org/nvme: nvme-pci: fix timeout request state check nvme-apple: only reset the controller when RTKit is running nvme-apple: reset controller during shutdown commit 4bb3d82a1820c1b609ede8eb2332f3cb038c5840 Author: Krzysztof Kozlowski Date: Fri Jan 20 14:14:47 2023 +0100 regulator: dt-bindings: samsung,s2mps14: add lost samsung,ext-control-gpios The samsung,ext-control-gpios property was lost during conversion to DT schema: exynos3250-artik5-eval.dtb: pmic@66: regulators:LDO11: Unevaluated properties are not allowed ('samsung,ext-control-gpios' was unexpected) Fixes: ea98b9eba05c ("regulator: dt-bindings: samsung,s2m: convert to dtschema") Cc: Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230120131447.289702-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit fb4293600cc651cfe4d48ec489f1d175adf6e2f8 Author: Peter Ujfalusi Date: Fri Jan 20 12:21:25 2023 +0200 ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on sink failure If the swidget is NULL we skip the preparing of the widget and jump to handle the sink path of the widget. If the prepare fails in this case we would undo the prepare but the swidget is NULL (we skipped the prepare for the widget). To avoid NULL pointer dereference in this case we must check swidget against NULL pointer once again. Fixes: 0ad84b11f2f8 ("ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Peter Ujfalusi Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230120102125.30653-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 2855e16f47ae0ad881e724d4a619fdeebcff09fb Merge: 54650eb17132a b3c00316a2f84 Author: Mark Brown Date: Fri Jan 20 14:09:28 2023 +0000 ASoC: Intel: set dpcm_capture for amps Merge series from Kai Vehmanen : This series addresses problems with echo reference devices reported in: "[BUG][ADL-N] Kernel panic when echo reference stream is opened" https://github.com/thesofproject/linux/issues/4083 commit 14ff7460bb58662d86aa50298943cc7d25532e28 Author: Greg Kroah-Hartman Date: Fri Jan 20 14:53:30 2023 +0100 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 The USB_DEVICE_ID_CODEMERCS_IOW100 header size was incorrect, it should be 12, not 13. Cc: stable Fixes: 17a82716587e ("USB: iowarrior: fix up report size handling for some devices") Reported-by: Christoph Jung Link: https://lore.kernel.org/r/20230120135330.3842518-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c Author: Alexander Stein Date: Fri Jan 20 13:27:14 2023 +0100 usb: host: ehci-fsl: Fix module alias Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module") changed DRV_NAME which was used for MODULE_ALIAS as well. Starting from this the module alias didn't match the platform device name created in fsl-mph-dr-of.c Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of. This is needed for module autoloading on ls1021a. Fixes: ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module") Cc: stable Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20230120122714.3848784-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 300b655db1b5152d6101bcb6801d50899b20c2d6 Author: David Morley Date: Thu Jan 19 19:00:28 2023 +0000 tcp: fix rate_app_limited to default to 1 The initial default value of 0 for tp->rate_app_limited was incorrect, since a flow is indeed application-limited until it first sends data. Fixing the default to be 1 is generally correct but also specifically will help user-space applications avoid using the initial tcpi_delivery_rate value of 0 that persists until the connection has some non-zero bandwidth sample. Fixes: eb8329e0a04d ("tcp: export data delivery rate") Suggested-by: Yuchung Cheng Signed-off-by: David Morley Signed-off-by: Neal Cardwell Tested-by: David Morley Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit d3e599c090fc6977331150c5f0a69ab8ce87da21 Author: Kees Cook Date: Wed Jan 18 12:35:01 2023 -0800 bnxt: Do not read past the end of test names Test names were being concatenated based on a offset beyond the end of the first name, which tripped the buffer overflow detection logic: detected buffer overflow in strnlen [...] Call Trace: bnxt_ethtool_init.cold+0x18/0x18 Refactor struct hwrm_selftest_qlist_output to use an actual array, and adjust the concatenation to use snprintf() rather than a series of strncat() calls. Reported-by: Niklas Cassel Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/ Tested-by: Niklas Cassel Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") Cc: Michael Chan Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Michael Chan Reviewed-by: Niklas Cassel Signed-off-by: David S. Miller commit 14ee78d5932afeb710c8305196a676a715bfdea8 Author: Matthew Howell Date: Thu Jan 19 14:40:29 2023 -0500 serial: exar: Add support for Sealevel 7xxxC serial cards Add support for Sealevel 7xxxC serial cards. This patch: * Adds IDs to recognize 7xxxC cards from Sealevel Systems. * Updates exar_pci_probe() to set nr_ports to last two bytes of primary dev ID for these cards. Signed-off-by: Matthew Howell Cc: stable Link: https://lore.kernel.org/r/alpine.DEB.2.21.2301191440010.22558@tstest-VirtualBox Signed-off-by: Greg Kroah-Hartman commit 3daed6345d5880464f46adab871d208e1baa2f3a Author: Vishnu Dasa Date: Tue Nov 29 23:05:11 2022 -0800 VMCI: Use threaded irqs instead of tasklets The vmci_dispatch_dgs() tasklet function calls vmci_read_data() which uses wait_event() resulting in invalid sleep in an atomic context (and therefore potentially in a deadlock). Use threaded irqs to fix this issue and completely remove usage of tasklets. [ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145 [ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd [ 20.264645] preempt_count: 101, expected: 0 [ 20.264646] RCU nest depth: 0, expected: 0 [ 20.264647] 1 lock held by vmtoolsd/762: [ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock] [ 20.264658] Preemption disabled at: [ 20.264659] [] vmci_send_datagram+0x44/0xa0 [vmw_vmci] [ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1 [ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020 [ 20.264668] Call trace: [ 20.264669] dump_backtrace+0xc4/0x130 [ 20.264672] show_stack+0x24/0x80 [ 20.264673] dump_stack_lvl+0x88/0xb4 [ 20.264676] dump_stack+0x18/0x34 [ 20.264677] __might_resched+0x1a0/0x280 [ 20.264679] __might_sleep+0x58/0x90 [ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci] [ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci] [ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150 [ 20.264688] tasklet_action+0x40/0x50 [ 20.264689] __do_softirq+0x23c/0x6b4 [ 20.264690] __irq_exit_rcu+0x104/0x214 [ 20.264691] irq_exit_rcu+0x1c/0x50 [ 20.264693] el1_interrupt+0x38/0x6c [ 20.264695] el1h_64_irq_handler+0x18/0x24 [ 20.264696] el1h_64_irq+0x68/0x6c [ 20.264697] preempt_count_sub+0xa4/0xe0 [ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0 [ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci] [ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci] [ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci] [ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport] [ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport] [ 20.264713] vsock_connect+0x278/0x330 [vsock] [ 20.264715] __sys_connect_file+0x8c/0xc0 [ 20.264718] __sys_connect+0x84/0xb4 [ 20.264720] __arm64_sys_connect+0x2c/0x3c [ 20.264721] invoke_syscall+0x78/0x100 [ 20.264723] el0_svc_common.constprop.0+0x68/0x124 [ 20.264724] do_el0_svc+0x38/0x4c [ 20.264725] el0_svc+0x60/0x180 [ 20.264726] el0t_64_sync_handler+0x11c/0x150 [ 20.264728] el0t_64_sync+0x190/0x194 Signed-off-by: Vishnu Dasa Suggested-by: Zack Rusin Reported-by: Nadav Amit Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Fixes: 463713eb6164 ("VMCI: dma dg: add support for DMA datagrams receive") Cc: # v5.18+ Cc: VMware PV-Drivers Reviewers Cc: Greg Kroah-Hartman Cc: Bryan Tan Reviewed-by: Bryan Tan Reviewed-by: Zack Rusin Link: https://lore.kernel.org/r/20221130070511.46558-1-vdasa@vmware.com Signed-off-by: Greg Kroah-Hartman commit aaca766c77fcf5aabda846d3372a1d40b0d4735d Author: Elliot Berman Date: Thu Jan 12 10:23:12 2023 -0800 misc: fastrpc: Pass bitfield into qcom_scm_assign_mem The srcvm parameter of qcom_scm_assign_mem is a pointer to a bitfield of VMIDs. The bitfield is updated with which VMIDs have permissions after the qcom_scm_assign_mem call. This makes it simpler for clients to make qcom_scm_assign_mem calls later, they always pass in same srcvm bitfield and do not need to closely track whether memory was originally shared. When restoring permissions to HLOS, fastrpc is incorrectly using the first VMID directly -- neither the BIT nor the other possible VMIDs the memory was already assigned to. We already have a field intended for this purpose: "perms" in the struct fastrpc_channel_ctx, but it was never used. Start using the perms field. Cc: Abel Vesa Cc: Vamsi Krishna Gattupalli Cc: Srinivas Kandagatla Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map") Fixes: 0871561055e6 ("misc: fastrpc: Add support for audiopd") Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool") Tested-by: Srinivas Kandagatla Signed-off-by: Elliot Berman drivers/misc/fastrpc.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) Link: https://lore.kernel.org/r/20230112182313.521467-1-quic_eberman@quicinc.com Signed-off-by: Greg Kroah-Hartman commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 Author: Khazhismel Kumykov Date: Tue Jan 17 17:02:12 2023 -0800 gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi. Fixes: 74c5b31c6618 ("driver: Google EFI SMI") Cc: stable Signed-off-by: Khazhismel Kumykov Link: https://lore.kernel.org/r/20230118010212.1268474-1-khazhy@google.com Signed-off-by: Greg Kroah-Hartman commit 96b328d119eca7563c1edcc4e1039a62e6370ecb Author: Ola Jeppsson Date: Thu Nov 24 17:49:41 2022 +0000 misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable Signed-off-by: Ola Jeppsson Signed-off-by: Abel Vesa Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20221124174941.418450-4-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 5bb96c8f9268e2fdb0e5321cbc358ee5941efc15 Author: Abel Vesa Date: Thu Nov 24 17:49:40 2022 +0000 misc: fastrpc: Don't remove map on creater_process and device_release Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead. The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0. Fixes: b49f6d83e290 ("misc: fastrpc: Fix a possible double free") Cc: stable Co-developed-by: Ola Jeppsson Signed-off-by: Ola Jeppsson Signed-off-by: Abel Vesa Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20221124174941.418450-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 9446fa1683a7e3937d9970248ced427c1983a1c5 Author: Abel Vesa Date: Thu Nov 24 17:49:39 2022 +0000 misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Currently, there is a race window between the point when the mutex is unlocked in fastrpc_map_lookup and the reference count increasing (fastrpc_map_get) in fastrpc_map_find, which can also lead to use-after-free. So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us to both protect the maps list by also taking the &fl->lock spinlock and the reference count, since the spinlock will be released only after. Add take_ref argument to make this suitable for all callers. Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") Cc: stable Co-developed-by: Ola Jeppsson Signed-off-by: Ola Jeppsson Signed-off-by: Abel Vesa Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20221124174941.418450-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 5023adc364df004bd8e57afe89a4bd8019485c3d Author: Dan Carpenter Date: Tue Nov 29 12:45:16 2022 +0300 misc: fastrpc: fix error code in fastrpc_req_mmap() The "err" variable shadows an earlier global variable so this code returns success instead of a negative error code. Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Y4XUrMETCl1O6t0A@kili Signed-off-by: Greg Kroah-Hartman commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 Author: Alexander Usyskin Date: Tue Dec 13 00:02:47 2022 +0200 mei: me: add meteor lake point M DID Add Meteor Lake Point M device id. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20221212220247.286019-2-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit a43866856125c3c432e2fbb6cc63cee1539ec4a7 Author: Alexander Usyskin Date: Tue Dec 13 00:02:46 2022 +0200 mei: bus: fix unlink on bus in error path Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads to call of the mei_cl_unlink without corresponding mei_cl_link. This leads to miscalculation of open_handle_count (decrease without increase). Call unlink in mei_cldev_enable fail path and remove blanket unlink from mei_cl_bus_dev_release. Fixes: 34f1166afd67 ("mei: bus: need to unlink client before freeing") Cc: Signed-off-by: Alexander Usyskin Reviewed-by: Tomas Winkler Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20221212220247.286019-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 54650eb17132a099100264caf59bb2210f65085a Author: Kuninori Morimoto Date: Fri Jan 20 06:32:52 2023 +0000 ASoC: hdmi-codec: zero clear HDMI pdata commit f77a066f4ed307d ("ASoC: hdmi-codec: Allow playback and capture to be disabled") added new no_i2s_playback/capture. We need to zero clear HDMI pdata first, otherwise unexpected flag will be added. Fixes: f77a066f4ed3 ("ASoC: hdmi-codec: Allow playback and capture to be disabled") Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87k01hlnqj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ea57680af47587397f5005d7758022441ed66d54 Author: Dan Carpenter Date: Thu Jan 19 17:58:54 2023 +0300 ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() The "id" comes from the user. Change the type to unsigned to prevent an array underflow. Fixes: f4ea22f7aa75 ("ASoC: SOF: ipc4: Add support for mtrace log extraction") Signed-off-by: Dan Carpenter Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/Y8laruWOEwOC/dx9@kili Signed-off-by: Mark Brown commit 732065df5deb5d565f66780a97990e77fc9bc49f Merge: 36225a7c72e9e dd42ec8ea5b97 Author: Greg Kroah-Hartman Date: Fri Jan 20 11:40:04 2023 +0100 Merge tag 'icc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v6.2-rc This contains fixes for a rare boot hang issue that has been reported on the db820c dragonboard. - dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC - interconnect: qcom: msm8996: Provide UFS clocks to A2NoC - interconnect: qcom: msm8996: Fix regmap max_register values - interconnect: qcom: rpm: Use _optional func for provider clocks Signed-off-by: Georgi Djakov * tag 'icc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: rpm: Use _optional func for provider clocks interconnect: qcom: msm8996: Fix regmap max_register values interconnect: qcom: msm8996: Provide UFS clocks to A2NoC dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC commit 2cbafffbf69addd7509072f4be5917f81d238cf6 Author: Greg Kroah-Hartman Date: Fri Jan 20 11:16:59 2023 +0100 Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" This reverts commit f24771b62a83239f0dce816bddf0f6807f436235 as it is reported to break the build. Reported-by: kernel test robot Link: https://lore.kernel.org/r/202301200130.ttBiTzfO-lkp@intel.com Fixes: f24771b62a83 ("serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler") Cc: Sebastian Andrzej Siewior Cc: Valentin Caron # V3 Cc: Marek Vasut Cc: Johan Hovold Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman commit d2c865553adb7ad9abf3894cbb209cf1bc95484a Author: Arnd Bergmann Date: Tue Jan 17 17:41:14 2023 +0100 firmware: zynqmp: fix declarations for gcc-13 gcc-13.0.1 reports a type mismatch for two functions: drivers/firmware/xilinx/zynqmp.c:1228:5: error: conflicting types for 'zynqmp_pm_set_rpu_mode' due to enum/integer mismatch; have 'int(u32, enum rpu_oper_mode)' {aka 'int(unsigned int, enum rpu_oper_mode)'} [-Werror=enum-int-mismatch] 1228 | int zynqmp_pm_set_rpu_mode(u32 node_id, enum rpu_oper_mode rpu_mode) | ^~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/firmware/xilinx/zynqmp.c:25: include/linux/firmware/xlnx-zynqmp.h:552:5: note: previous declaration of 'zynqmp_pm_set_rpu_mode' with type 'int(u32, u32)' {aka 'int(unsigned int, unsigned int)'} 552 | int zynqmp_pm_set_rpu_mode(u32 node_id, u32 arg1); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/firmware/xilinx/zynqmp.c:1246:5: error: conflicting types for 'zynqmp_pm_set_tcm_config' due to enum/integer mismatch; have 'int(u32, enum rpu_tcm_comb)' {aka 'int(unsigned int, enum rpu_tcm_comb)'} [-Werror=enum-int-mismatch] 1246 | int zynqmp_pm_set_tcm_config(u32 node_id, enum rpu_tcm_comb tcm_mode) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/firmware/xlnx-zynqmp.h:553:5: note: previous declaration of 'zynqmp_pm_set_tcm_config' with type 'int(u32, u32)' {aka 'int(unsigned int, unsigned int)'} 553 | int zynqmp_pm_set_tcm_config(u32 node_id, u32 arg1); | ^~~~~~~~~~~~~~~~~~~~~~~~ Change the declaration in the header to match the function definition. Acked-by: Michal Simek Signed-off-by: Arnd Bergmann commit aca5d87d934384f81cc948e34c01052367d67788 Merge: b7b0742883e08 9bfa2544dbd11 Author: Arnd Bergmann Date: Fri Jan 20 10:40:51 2023 +0100 Merge tag 'at91-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 6.2: It contains: - fix the clock provided via DT for DDR controller on SAM9X60 * tag 'at91-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 Link: https://lore.kernel.org/r/20230119112101.42045-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit b7b0742883e0839e6d81f0538735bf9a9a1e7d6f Merge: e2f7096f1e768 175281f806955 Author: Arnd Bergmann Date: Fri Jan 20 10:39:42 2023 +0100 Merge tag 'stm32-dt-for-v6.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into arm/fixes STM32 DT fixes for v6.2, round 1 Highlights: ----------- -STM32MP15: - Fix missing chip select phandle in several stm32mp15x based boards. * tag 'stm32-dt-for-v6.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som Link: https://lore.kernel.org/r/3fe26bf9-297b-5c78-682b-37fa6d8b6190@foss.st.com Signed-off-by: Arnd Bergmann commit fdfc76a116b5e9d3e98e6c96fe83b42d011d21d4 Author: Andrew Halaney Date: Wed Jan 18 10:56:38 2023 -0600 net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e ("net: stmmac: Add support for DWMAC5 and implement Safety Features") all safety features were enabled by default. Later it seems some implementations didn't have support for all the features, so in commit 5ac712dcdfef ("net: stmmac: enable platform specific safety features") the safety_feat_cfg structure was added to the callback and defined for some platforms to selectively enable these safety features. The problem is that only certain platforms were given that software support. If the automotive safety package bit is set in the hardware features register the safety feature callback is called for the platform, and for platforms that didn't get a safety_feat_cfg defined this results in the following NULL pointer dereference: [ 7.933303] Call trace: [ 7.935812] dwmac5_safety_feat_config+0x20/0x170 [stmmac] [ 7.941455] __stmmac_open+0x16c/0x474 [stmmac] [ 7.946117] stmmac_open+0x38/0x70 [stmmac] [ 7.950414] __dev_open+0x100/0x1dc [ 7.954006] __dev_change_flags+0x18c/0x204 [ 7.958297] dev_change_flags+0x24/0x6c [ 7.962237] do_setlink+0x2b8/0xfa4 [ 7.965827] __rtnl_newlink+0x4ec/0x840 [ 7.969766] rtnl_newlink+0x50/0x80 [ 7.973353] rtnetlink_rcv_msg+0x12c/0x374 [ 7.977557] netlink_rcv_skb+0x5c/0x130 [ 7.981500] rtnetlink_rcv+0x18/0x2c [ 7.985172] netlink_unicast+0x2e8/0x340 [ 7.989197] netlink_sendmsg+0x1a8/0x420 [ 7.993222] ____sys_sendmsg+0x218/0x280 [ 7.997249] ___sys_sendmsg+0xac/0x100 [ 8.001103] __sys_sendmsg+0x84/0xe0 [ 8.004776] __arm64_sys_sendmsg+0x24/0x30 [ 8.008983] invoke_syscall+0x48/0x114 [ 8.012840] el0_svc_common.constprop.0+0xcc/0xec [ 8.017665] do_el0_svc+0x38/0xb0 [ 8.021071] el0_svc+0x2c/0x84 [ 8.024212] el0t_64_sync_handler+0xf4/0x120 [ 8.028598] el0t_64_sync+0x190/0x194 Go back to the original behavior, if the automotive safety package is found to be supported in hardware enable all the features unless safety_feat_cfg is passed in saying this particular platform only supports a subset of the features. Fixes: 5ac712dcdfef ("net: stmmac: enable platform specific safety features") Reported-by: Ning Cai Signed-off-by: Andrew Halaney Signed-off-by: David S. Miller commit 0582d984793d30442da88fe458674502bad1ad29 Author: Randy Dunlap Date: Thu Jan 12 22:38:05 2023 -0800 i2c: rk3x: fix a bunch of kernel-doc warnings Fix multiple W=1 kernel-doc warnings in i2c-rk3x.c: drivers/i2c/busses/i2c-rk3x.c:83: warning: missing initial short description on line: * struct i2c_spec_values: drivers/i2c/busses/i2c-rk3x.c:139: warning: missing initial short description on line: * struct rk3x_i2c_calced_timings: drivers/i2c/busses/i2c-rk3x.c:162: warning: missing initial short description on line: * struct rk3x_i2c_soc_data: drivers/i2c/busses/i2c-rk3x.c:242: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Generate a START condition, which triggers a REG_INT_START interrupt. drivers/i2c/busses/i2c-rk3x.c:261: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Generate a STOP condition, which triggers a REG_INT_STOP interrupt. drivers/i2c/busses/i2c-rk3x.c:304: warning: expecting prototype for Setup a read according to i2c(). Prototype was for rk3x_i2c_prepare_read() instead drivers/i2c/busses/i2c-rk3x.c:335: warning: expecting prototype for Fill the transmit buffer with data from i2c(). Prototype was for rk3x_i2c_fill_transmit_buf() instead drivers/i2c/busses/i2c-rk3x.c:535: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get timing values of I2C specification drivers/i2c/busses/i2c-rk3x.c:552: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Calculate divider values for desired SCL frequency drivers/i2c/busses/i2c-rk3x.c:713: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Calculate timing values for desired SCL frequency drivers/i2c/busses/i2c-rk3x.c:963: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Setup I2C registers for an I2C operation specified by msgs, num. Signed-off-by: Randy Dunlap Signed-off-by: Wolfram Sang commit e49560f02716839a74a7907200a589c1f990261b Author: Randy Dunlap Date: Thu Jan 12 22:37:56 2023 -0800 i2c: axxia: use 'struct' for kernel-doc notation Add "struct" to prevent this kernel-doc warning: drivers/i2c/busses/i2c-axxia.c:135: warning: cannot understand function prototype: 'struct axxia_i2c_dev ' Signed-off-by: Randy Dunlap Signed-off-by: Wolfram Sang commit b4fbf0b27fa9dd2594b3371532341bd4636a00f9 Merge: 6c977c5c2e4c5 8299ffe3dc3dc Author: David S. Miller Date: Fri Jan 20 09:00:08 2023 +0000 Merge branch 'octeontx2-af-CPT' Srujana Challa says: ==================== octeontx2-af: Miscellaneous changes for CPT This patchset consists of miscellaneous changes for CPT. - Adds a new mailbox to reset the requested CPT LF. - Modify FLR sequence as per HW team suggested. - Adds support to recover CPT engines when they gets fault. - Updates CPT inbound inline IPsec configuration mailbox, as per new generation of the OcteonTX2 chips. - Adds a new mailbox to return CPT FLT Interrupt info. --- v2: - Addressed a review comment. v1: - Dropped patch "octeontx2-af: Fix interrupt name strings completely" to submit to net. --- ==================== Signed-off-by: David S. Miller commit 8299ffe3dc3dc9ac2bd60e3a8332008f03156aca Author: Srujana Challa Date: Wed Jan 18 17:33:54 2023 +0530 octeontx2-af: add mbox to return CPT_AF_FLT_INT info CPT HW would trigger the CPT AF FLT interrupt when CPT engines hits some uncorrectable errors and AF is the one which receives the interrupt and recovers the engines. This patch adds a mailbox for CPT VFs to request for CPT faulted and recovered engines info. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit c0688ec002a451d04a51d43b849765c5ce6cb36f Author: Srujana Challa Date: Wed Jan 18 17:33:53 2023 +0530 octeontx2-af: update cpt lf alloc mailbox The CN10K CPT coprocessor contains a context processor to accelerate updates to the IPsec security association contexts. The context processor contains a context cache. This patch updates CPT LF ALLOC mailbox to config ctx_ilen requested by VFs. CPT_LF_ALLOC:ctx_ilen is the size of initial context fetch. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit d5b2e0a299f36c6ccdda4830525ca20550243536 Author: Nithin Dabilpuram Date: Wed Jan 18 17:33:52 2023 +0530 octeontx2-af: restore rxc conf after teardown sequence CN10K CPT coprocessor includes a component named RXC which is responsible for reassembly of inner IP packets. RXC has the feature to evict oldest entries based on age/threshold. The age/threshold is being set to minimum values to evict all entries at the time of teardown. This patch adds code to restore timeout and threshold config after teardown sequence is complete as it is global config. Signed-off-by: Nithin Dabilpuram Signed-off-by: David S. Miller commit 9adb04ff62f51265002c2c83e718bcf459e06e48 Author: Srujana Challa Date: Wed Jan 18 17:33:51 2023 +0530 octeontx2-af: optimize cpt pf identification Optimize CPT PF identification in mbox handling for faster mbox response by doing it at AF driver probe instead of every mbox message. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit 1286c50ae9e0f5025b165c8f2321b3ce3b558002 Author: Srujana Challa Date: Wed Jan 18 17:33:50 2023 +0530 octeontx2-af: modify FLR sequence for CPT On OcteonTX2 platform CPT instruction enqueue is only possible via LMTST operations. The existing FLR sequence mentioned in HRM requires a dummy LMTST to CPT but LMTST can't be submitted from AF driver. So, HW team provided a new sequence to avoid dummy LMTST. This patch adds code for the same. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit f58cf765e8f5f4860ea094aa12c156d9195a4c28 Author: Srujana Challa Date: Wed Jan 18 17:33:49 2023 +0530 octeontx2-af: add mbox for CPT LF reset On OcteonTX2 SoC, the admin function (AF) is the only one with all priviliges to configure HW and alloc resources, PFs and it's VFs have to request AF via mailbox for all their needs. This patch adds a new mailbox for CPT VFs to request for CPT LF reset. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit 07ea567d84cdf0add274d66db7c02b55b818d517 Author: Srujana Challa Date: Wed Jan 18 17:33:48 2023 +0530 octeontx2-af: recover CPT engine when it gets fault When CPT engine has uncorrectable errors, it will get halted and must be disabled and re-enabled. This patch adds code for the same. Signed-off-by: Srujana Challa Signed-off-by: David S. Miller commit 0a4eecf96c640886226f1ca7fdbb11bb20bc55b9 Author: Fabrizio Castro Date: Tue Jan 17 17:50:17 2023 +0000 dt-bindings: i2c: renesas,rzv2m: Fix SoC specific string The preferred form for Renesas' compatible strings is: ",-" Somehow the compatible string for the r9a09g011 I2C IP was upstreamed as renesas,i2c-r9a09g011 instead of renesas,r9a09g011-i2c, which is really confusing, especially considering the generic fallback is renesas,rzv2m-i2c. The first user of renesas,i2c-r9a09g011 in the kernel is not yet in a kernel release, it will be in v6.1, therefore it can still be fixed in v6.1. Even if we don't fix it before v6.2, I don't think there is any harm in making such a change. s/renesas,i2c-r9a09g011/renesas,r9a09g011-i2c/g for consistency. Fixes: ba7a4d15e2c4 ("dt-bindings: i2c: Document RZ/V2M I2C controller") Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 24b5308cf5ee9f52dd22f3af78a5b0cdc9d35e72 Author: Pengfei Xu Date: Wed Jan 11 16:15:31 2023 +0800 selftests/filesystems: grant executable permission to run_fat_tests.sh When use tools/testing/selftests/kselftest_install.sh to make the kselftest-list.txt under tools/testing/selftests/kselftest_install. Then use tools/testing/selftests/kselftest_install/run_kselftest.sh to run all the kselftests in kselftest-list.txt, it will be blocked by case "filesystems/fat: run_fat_tests.sh" with "Warning: file run_fat_tests.sh is not executable", so grant executable permission to run_fat_tests.sh to fix this issue. Link: https://lkml.kernel.org/r/dfdbba6df8a1ab34bb1e81cd8bd7ca3f9ed5c369.1673424747.git.pengfei.xu@intel.com Fixes: dd7c9be330d8 ("selftests/filesystems: add a vfat RENAME_EXCHANGE test") Signed-off-by: Pengfei Xu Reviewed-by: Javier Martinez Canillas Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3f30a6e67ce49c0068f8058893326db46b6db11f Merge: 6bb517df54bd8 a52287d66dfa1 Author: Dave Airlie Date: Fri Jan 20 11:21:19 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-01-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-01-19: amdgpu: - Fix display scaling - Fix RN/CZN power reporting on some firmware versions - Colorspace fixes - Fix resource freeing in error case in CS IOCTL - Fix warning on driver unload - GC11 fixes - DCN 3.1.4/5 S/G display workarounds Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230119195908.7670-1-alexander.deucher@amd.com commit 6bb517df54bd80106c38d001d7b2dd6101c195e6 Merge: d6cf886fbd90e 2293a73ad4f3b Author: Dave Airlie Date: Fri Jan 20 11:17:11 2023 +1000 Merge tag 'drm-misc-fixes-2023-01-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A fix for vc4 to address a memory leak when allocating a buffer, a Kconfig fix for panfrost and two fixes for i915 and fb-helper to address some bugs with vga-switcheroo. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230119082059.h32bs7zqoxmjbcvn@houat commit 5b89c6f9b2df2b7cf6da8e0b2b87c8995b378cad Author: Masahiro Yamada Date: Sat Jan 7 01:12:13 2023 +0900 riscv: fix -Wundef warning for CONFIG_RISCV_BOOT_SPINWAIT Since commit 80b6093b55e3 ("kbuild: add -Wundef to KBUILD_CPPFLAGS for W=1 builds"), building with W=1 detects misuse of #if. $ make W=1 ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- arch/riscv/kernel/ [snip] AS arch/riscv/kernel/head.o arch/riscv/kernel/head.S:329:5: warning: "CONFIG_RISCV_BOOT_SPINWAIT" is not defined, evaluates to 0 [-Wundef] 329 | #if CONFIG_RISCV_BOOT_SPINWAIT | ^~~~~~~~~~~~~~~~~~~~~~~~~~ CONFIG_RISCV_BOOT_SPINWAIT is a bool option. #ifdef should be used. Signed-off-by: Masahiro Yamada Fixes: 2ffc48fc7071 ("RISC-V: Move spinwait booting method to its own config") Link: https://lore.kernel.org/r/20230106161213.2374093-1-masahiroy@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 6d0cc1b1f22adb254408a42043d3939bed65545d Author: Conor Dooley Date: Fri Jan 6 12:53:45 2023 +0000 MAINTAINERS: add an IRC entry for RISC-V I remember being told "Just ping me on IRC" about patches, but googling at the time was not helpful. #riscv on libera is not linux specific, but a bunch of contributors etc do hang out there. Add a link to the maintainers entry to help others find it in the future! Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230106125344.1685266-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit d374a16539b14dde0b8a3e69fb9169a7454a806c Author: Heiko Stuebner Date: Thu Jan 5 20:26:10 2023 +0100 RISC-V: fix compile error from deduplicated __ALTERNATIVE_CFG_2 On the non-assembler-side wrapping alternative-macros inside other macros to prevent duplication of code works, as the end result will just be a string that gets fed to the asm instruction. In real assembler code, wrapping .macro blocks inside other .macro blocks brings more restrictions on usage it seems and the optimization done by commit 2ba8c7dc71c0 ("riscv: Don't duplicate __ALTERNATIVE_CFG in __ALTERNATIVE_CFG_2") results in a compile error like: ../arch/riscv/lib/strcmp.S: Assembler messages: ../arch/riscv/lib/strcmp.S:15: Error: too many positional arguments ../arch/riscv/lib/strcmp.S:15: Error: backward ref to unknown label "886:" ../arch/riscv/lib/strcmp.S:15: Error: backward ref to unknown label "887:" ../arch/riscv/lib/strcmp.S:15: Error: backward ref to unknown label "886:" ../arch/riscv/lib/strcmp.S:15: Error: backward ref to unknown label "887:" ../arch/riscv/lib/strcmp.S:15: Error: backward ref to unknown label "886:" ../arch/riscv/lib/strcmp.S:15: Error: attempt to move .org backwards Wrapping the variables containing assembler code in quotes solves this issue, compilation and the code in question still works and objdump also shows sane decompiled results of the affected code. Fixes: 2ba8c7dc71c0 ("riscv: Don't duplicate __ALTERNATIVE_CFG in __ALTERNATIVE_CFG_2") Signed-off-by: Heiko Stuebner Reviewed-by: Palmer Dabbelt Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230105192610.1940841-1-heiko@sntech.de Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit d6cf886fbd90efae3ec763e092a5f930037c0bd7 Merge: fc70e13dd1a64 afdecb232740a Author: Dave Airlie Date: Fri Jan 20 09:25:09 2023 +1000 Merge tag 'drm-intel-fixes-2023-01-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Reject display plane with height == 0 (Drew) - re-disable RC6p on Sandy Bridge (Sasa) - Fix hugepages' selftest (Chris) - DG2 hw workarounds (Matt Atwood) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y8mf3/ANNWctpc7R@intel.com commit 4a0c7a6831a0aa56db78a80f5a3e1ad5412d0fa8 Merge: d368967cb1039 3d9c07c4cfc06 Author: Linus Torvalds Date: Thu Jan 19 15:22:28 2023 -0800 Merge tag 'perf-tools-fixes-for-v6.2-3-2023-01-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Prevent reading into undefined memory in the expression lexer, accounting for a trailer backslash followed by the null byte. - Fix file mode when copying files to the build id cache, the problem happens when the cache directory is in a different file system than the file being cached, otherwise the mode was preserved as only a hard link would be done to save space. - Fix a related build-id 'perf test' entry that checked that permission when caching PE (Portable Executable) files, used when profiling Windows executables under wine. - Sync the tools/ copies of kvm headers, build_bug.h, socket.h and arm64's cputype.h with the kernel sources. * tag 'perf-tools-fixes-for-v6.2-3-2023-01-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf test build-id: Fix test check for PE file perf buildid-cache: Fix the file mode with copyfile() while adding file to build-id cache perf expr: Prevent normalize() from reading into undefined memory in the expression lexer tools headers: Syncronize linux/build_bug.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources tools headers arm64: Sync arm64's cputype.h with the kernel sources tools kvm headers arm64: Update KVM header from the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources commit 2eecf81e149cd718754f52a4b688b237d2a8244d Merge: bdb7fdb0aca8b b9fa9bc839291 Author: Alexei Starovoitov Date: Thu Jan 19 15:19:23 2023 -0800 Merge branch 'bpf: Fix to preserve reg parent/live fields when copying range info' Eduard Zingerman says: ==================== Struct bpf_reg_state is copied directly in several places including: - check_stack_write_fixed_off() (via save_register_state()); - check_stack_read_fixed_off(); - find_equal_scalars(). However, a literal copy of this struct also copies the following fields: struct bpf_reg_state { ... struct bpf_reg_state *parent; ... enum bpf_reg_liveness live; ... }; This breaks register parentage chain and liveness marking logic. The commit message for the first patch has a detailed example. This patch-set replaces direct copies with a call to a function copy_register_state(dst,src), which preserves 'parent' and 'live' fields of the 'dst'. The fix comes with a significant verifier runtime penalty for some selftest binaries listed in tools/testing/selftests/bpf/veristat.cfg and cilium BPF binaries (see [1]): $ ./veristat -e file,prog,states -C -f 'states_diff>10' master-baseline.log current.log File Program States (A) States (B) States (DIFF) -------------------------- -------------------------------- ---------- ---------- --------------- bpf_host.o tail_handle_ipv4_from_host 231 299 +68 (+29.44%) bpf_host.o tail_handle_nat_fwd_ipv4 1088 1320 +232 (+21.32%) bpf_host.o tail_handle_nat_fwd_ipv6 716 729 +13 (+1.82%) bpf_host.o tail_nodeport_nat_ingress_ipv4 281 314 +33 (+11.74%) bpf_host.o tail_nodeport_nat_ingress_ipv6 245 256 +11 (+4.49%) bpf_lxc.o tail_handle_nat_fwd_ipv4 1088 1320 +232 (+21.32%) bpf_lxc.o tail_handle_nat_fwd_ipv6 716 729 +13 (+1.82%) bpf_lxc.o tail_ipv4_ct_egress 239 262 +23 (+9.62%) bpf_lxc.o tail_ipv4_ct_ingress 239 262 +23 (+9.62%) bpf_lxc.o tail_ipv4_ct_ingress_policy_only 239 262 +23 (+9.62%) bpf_lxc.o tail_ipv6_ct_egress 181 195 +14 (+7.73%) bpf_lxc.o tail_ipv6_ct_ingress 181 195 +14 (+7.73%) bpf_lxc.o tail_ipv6_ct_ingress_policy_only 181 195 +14 (+7.73%) bpf_lxc.o tail_nodeport_nat_ingress_ipv4 281 314 +33 (+11.74%) bpf_lxc.o tail_nodeport_nat_ingress_ipv6 245 256 +11 (+4.49%) bpf_overlay.o tail_handle_nat_fwd_ipv4 799 829 +30 (+3.75%) bpf_overlay.o tail_nodeport_nat_ingress_ipv4 281 314 +33 (+11.74%) bpf_overlay.o tail_nodeport_nat_ingress_ipv6 245 256 +11 (+4.49%) bpf_sock.o cil_sock4_connect 47 70 +23 (+48.94%) bpf_sock.o cil_sock4_sendmsg 45 68 +23 (+51.11%) bpf_sock.o cil_sock6_post_bind 31 42 +11 (+35.48%) bpf_xdp.o tail_lb_ipv4 4413 6457 +2044 (+46.32%) bpf_xdp.o tail_lb_ipv6 6876 7249 +373 (+5.42%) test_cls_redirect.bpf.o cls_redirect 4704 4799 +95 (+2.02%) test_tcp_hdr_options.bpf.o estab 180 206 +26 (+14.44%) xdp_synproxy_kern.bpf.o syncookie_tc 21059 21485 +426 (+2.02%) xdp_synproxy_kern.bpf.o syncookie_xdp 21857 23122 +1265 (+5.79%) -------------------------- -------------------------------- ---------- ---------- --------------- I looked through verification log for bpf_xdp.o tail_lb_ipv4 program in order to identify the reason for ~50% visited states increase. The slowdown is triggered by a difference in handling of three stack slots: fp-56, fp-72 and fp-80, with the main difference coming from fp-72. In fact the following change removes all the difference: @@ -3256,7 +3256,10 @@ static void save_register_state(struct bpf_func_state *state, { int i; - copy_register_state(&state->stack[spi].spilled_ptr, reg); + if ((spi == 6 /*56*/ || spi == 8 /*72*/ || spi == 9 /*80*/) && size != BPF_REG_SIZE) + state->stack[spi].spilled_ptr = *reg; + else + copy_register_state(&state->stack[spi].spilled_ptr, reg); For fp-56 I found the following pattern for divergences between verification logs with and w/o this patch: - At some point insn 1862 is reached and checkpoint is created; - At some other point insn 1862 is reached again: - with this patch: - the current state is considered *not* equivalent to the old checkpoint; - the reason for mismatch is the state of fp-56: - current state: fp-56=????mmmm - checkpoint: fp-56_rD=mmmmmmmm - without this patch the current state is considered equivalent to the checkpoint, the fp-56 is not present in the checkpoint. Here is a fragment of the verification log for when the checkpoint in question created at insn 1862: checkpoint 1862: ... fp-56=mmmmmmmm ... 1862: ... 1863: ... 1864: (61) r1 = *(u32 *)(r0 +0) 1865: ... 1866: (63) *(u32 *)(r10 -56) = r1 ; R1_w=scalar(...) R10=fp0 fp-56= 1867: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 1868: (07) r2 += -56 ; R2_w=fp-56 ; return map_lookup_elem(&LB4_BACKEND_MAP_V2, &backend_id); 1869: (18) r1 = 0xffff888100286000 ; R1_w=map_ptr(off=0,ks=4,vs=8,imm=0) 1871: (85) call bpf_map_lookup_elem#1 - Without this patch: - at insn 1864 r1 liveness is set to REG_LIVE_WRITTEN; - at insn 1866 fp-56 liveness is set REG_LIVE_WRITTEN mark because of the direct r1 copy in save_register_state(); - at insn 1871 REG_LIVE_READ is not propagated to fp-56 at checkpoint 1862 because of the REG_LIVE_WRITTEN mark; - eventually fp-56 is pruned from checkpoint at 1862 in clean_func_state(). - With this patch: - at insn 1864 r1 liveness is set to REG_LIVE_WRITTEN; - at insn 1866 fp-56 liveness is *not* set to REG_LIVE_WRITTEN mark because write size is not equal to BPF_REG_SIZE; - at insn 1871 REG_LIVE_READ is propagated to fp-56 at checkpoint 1862. Hence more states have to be visited by verifier with this patch compared to current master. Similar patterns could be found for both fp-72 and fp-80, although these are harder to track trough the log because of a big number of insns between slot write and bpf_map_lookup_elem() call triggering read mark, boils down to the following C code: struct ipv4_frag_id frag_id = { .daddr = ip4->daddr, .saddr = ip4->saddr, .id = ip4->id, .proto = ip4->protocol, .pad = 0, }; ... map_lookup_elem(..., &frag_id); Where: - .id is mapped to fp-72, write of size u16; - .saddr is mapped to fp-80, write of size u32. This patch-set is a continuation of discussion from [2]. Changes v1 -> v2 (no changes in the code itself): - added analysis for the tail_lb_ipv4 verification slowdown; - rebase against fresh master branch. [1] git@github.com:anakryiko/cilium.git [2] https://lore.kernel.org/bpf/517af2c57ee4b9ce2d96a8cf33f7295f2d2dfe13.camel@gmail.com/ ==================== Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit b9fa9bc839291020b362ab5392e5f18ba79657ac Author: Eduard Zingerman Date: Fri Jan 6 16:22:14 2023 +0200 selftests/bpf: Verify copy_register_state() preserves parent/live fields A testcase to check that verifier.c:copy_register_state() preserves register parentage chain and livness information. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230106142214.1040390-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 71f656a50176915d6813751188b5758daa8d012b Author: Eduard Zingerman Date: Fri Jan 6 16:22:13 2023 +0200 bpf: Fix to preserve reg parent/live fields when copying range info Register range information is copied in several places. The intent is to transfer range/id information from one register/stack spill to another. Currently this is done using direct register assignment, e.g.: static void find_equal_scalars(..., struct bpf_reg_state *known_reg) { ... struct bpf_reg_state *reg; ... *reg = *known_reg; ... } However, such assignments also copy the following bpf_reg_state fields: struct bpf_reg_state { ... struct bpf_reg_state *parent; ... enum bpf_reg_liveness live; ... }; Copying of these fields is accidental and incorrect, as could be demonstrated by the following example: 0: call ktime_get_ns() 1: r6 = r0 2: call ktime_get_ns() 3: r7 = r0 4: if r0 > r6 goto +1 ; r0 & r6 are unbound thus generated ; branch states are identical 5: *(u64 *)(r10 - 8) = 0xdeadbeef ; 64-bit write to fp[-8] --- checkpoint --- 6: r1 = 42 ; r1 marked as written 7: *(u8 *)(r10 - 8) = r1 ; 8-bit write, fp[-8] parent & live ; overwritten 8: r2 = *(u64 *)(r10 - 8) 9: r0 = 0 10: exit This example is unsafe because 64-bit write to fp[-8] at (5) is conditional, thus not all bytes of fp[-8] are guaranteed to be set when it is read at (8). However, currently the example passes verification. First, the execution path 1-10 is examined by verifier. Suppose that a new checkpoint is created by is_state_visited() at (6). After checkpoint creation: - r1.parent points to checkpoint.r1, - fp[-8].parent points to checkpoint.fp[-8]. At (6) the r1.live is set to REG_LIVE_WRITTEN. At (7) the fp[-8].parent is set to r1.parent and fp[-8].live is set to REG_LIVE_WRITTEN, because of the following code called in check_stack_write_fixed_off(): static void save_register_state(struct bpf_func_state *state, int spi, struct bpf_reg_state *reg, int size) { ... state->stack[spi].spilled_ptr = *reg; // <--- parent & live copied if (size == BPF_REG_SIZE) state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ... } Note the intent to mark stack spill as written only if 8 bytes are spilled to a slot, however this intent is spoiled by a 'live' field copy. At (8) the checkpoint.fp[-8] should be marked as REG_LIVE_READ but this does not happen: - fp[-8] in a current state is already marked as REG_LIVE_WRITTEN; - fp[-8].parent points to checkpoint.r1, parentage chain is used by mark_reg_read() to mark checkpoint states. At (10) the verification is finished for path 1-10 and jump 4-6 is examined. The checkpoint.fp[-8] never gets REG_LIVE_READ mark and this spill is pruned from the cached states by clean_live_states(). Hence verifier state obtained via path 1-4,6 is deemed identical to one obtained via path 1-6 and program marked as safe. Note: the example should be executed with BPF_F_TEST_STATE_FREQ flag set to force creation of intermediate verifier states. This commit revisits the locations where bpf_reg_state instances are copied and replaces the direct copies with a call to a function copy_register_state(dst, src) that preserves 'parent' and 'live' fields of the 'dst'. Fixes: 679c782de14b ("bpf/verifier: per-register parent pointers") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230106142214.1040390-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41 Author: Juergen Gross Date: Tue Jan 17 16:57:23 2023 +0100 acpi: Fix suspend with Xen PV Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing real_mode_header, leading to dereferencing NULL when suspending the system under Xen: [ 348.284004] PM: suspend entry (deep) [ 348.289532] Filesystems sync: 0.005 seconds [ 348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done. [ 348.292457] OOM killer disabled. [ 348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done. [ 348.396612] printk: Suspending console(s) (use no_console_suspend to debug) [ 348.749228] PM: suspend devices took 0.352 seconds [ 348.769713] ACPI: EC: interrupt blocked [ 348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c [ 348.816080] #PF: supervisor read access in kernel mode [ 348.816081] #PF: error_code(0x0000) - not-present page [ 348.816083] PGD 0 P4D 0 [ 348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1 [ 348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022 [ 348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20 Fix that by adding an optional acpi callback allowing to skip setting the wakeup address, as in the Xen PV case this will be handled by the hypervisor anyway. Fixes: f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Signed-off-by: Dave Hansen Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/all/20230117155724.22940-1-jgross%40suse.com commit fc70e13dd1a643565b7628dbe5b130c260a52cf8 Merge: 5dc4c995db9eb a66f1efcf748f Author: Dave Airlie Date: Fri Jan 20 07:49:00 2023 +1000 Merge tag 'drm-msm-fixes-2023-01-16' of https://gitlab.freedesktop.org/drm/msm into drm-fixes msm-fixes for v6.3-rc5 Two GPU fixes which were meant to be part of the previous pull request, but I'd forgotten to fetch from gitlab after the MR was merged so that git tag was applied to the wrong commit. - kexec shutdown fix - fix potential double free Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGskguoVsz2wqAK2k+f32LwcVY5JC6+e2RwLqZswz3RY2Q@mail.gmail.com commit d368967cb1039b5c4cccb62b5a4b9468c50cd143 Merge: a03df4ec37291 21493c6e96e55 Author: Linus Torvalds Date: Thu Jan 19 12:32:07 2023 -0800 Merge tag 'printk-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixes from Petr Mladek: - Prevent a potential deadlock when configuring kgdb console - Fix a kernel doc warning * tag 'printk-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: kernel/printk/printk.c: Fix W=1 kernel-doc warning tty: serial: kgdboc: fix mutex locking order for configure_kgdboc() commit a03df4ec37291de74987e4fbfbbcaebb5a8f9a2e Merge: 46f0cba31ccc2 41e1992665a27 Author: Linus Torvalds Date: Thu Jan 19 12:28:53 2023 -0800 Merge tag 's390-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 build fix from Heiko Carstens: - Workaround invalid gcc-11 out of bounds read warning caused by s390's S390_lowcore definition. This happens only with gcc 11.1.0 and 11.2.0. The code which causes this warning will be gone with the next merge window. Therefore just replace the memcpy() with a for loop to get rid of the warning. * tag 's390-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: workaround invalid gcc-11 out of bounds read warning commit 46f0cba31ccc28cfb3e65d0ab49a9a7e58c0ef9f Merge: 081edded9b38b cc2e9d2b26c86 Author: Linus Torvalds Date: Thu Jan 19 12:24:39 2023 -0800 Merge tag 'slab-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "Just a single fix, since the lkp report originally for a slub-tiny commit ended up being a gcov/compiler bug: - periodically resched in SLAB's drain_freelist(), by David Rientjes" * tag 'slab-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm, slab: periodically resched in drain_freelist() commit 6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8 Author: Viresh Kumar Date: Wed Jan 18 14:08:24 2023 +0530 thermal: core: call put_device() only after device_register() fails put_device() shouldn't be called before a prior call to device_register(). __thermal_cooling_device_register() doesn't follow that properly and needs fixing. Also thermal_cooling_device_destroy_sysfs() is getting called unnecessarily on few error paths. Fix all this by placing the calls at the right place. Based on initial work done by Caleb Connolly. Fixes: 4748f9687caa ("thermal: core: fix some possible name leaks in error paths") Fixes: c408b3d1d9bb ("thermal: Validate new state in cur_state_store()") Reported-by: Caleb Connolly Signed-off-by: Viresh Kumar Tested-by: Frank Rowand Reviewed-by: Yang Yingliang Tested-by: Caleb Connolly Signed-off-by: Rafael J. Wysocki commit dcbf1742ed10ede31b2e68c1412503db9fc6cfaf Merge: 7d80dbd708c18 71dfd381a7c05 Author: Greg Kroah-Hartman Date: Thu Jan 19 20:03:14 2023 +0100 Merge tag 'usb-serial-6.2-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: "USB-serial fixes for 6.2-rc5 Here are some new device ids, mostly for Quectel modems. All have been in linux-next with no reported issues." * tag 'usb-serial-6.2-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel EM05CN modem USB: serial: option: add Quectel EM05CN (SG) modem USB: serial: cp210x: add SCALANCE LPE-9000 device id USB: serial: option: add Quectel EC200U modem USB: serial: option: add Quectel EM05-G (RS) modem USB: serial: option: add Quectel EM05-G (GR) modem USB: serial: option: add Quectel EM05-G (CS) modem commit 081edded9b38ba6a3a8fa045cfa0d374343da08a Merge: 7287904c8771b a608da3bd730d Author: Linus Torvalds Date: Thu Jan 19 09:54:08 2023 -0800 Merge tag 'zonefs-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: - A single patch to fix sync write operations to detect and handle errors due to external zone corruptions resulting in writes at invalid location, from me. * tag 'zonefs-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Detect append writes at invalid locations commit e12d7a46f65ae4b7d58a5e0c1cbfa825cf8d830d Author: Jens Axboe Date: Thu Jan 19 09:04:40 2023 -0700 io_uring/msg_ring: fix missing lock on overflow for IOPOLL If the target ring is configured with IOPOLL, then we always need to hold the target ring uring_lock before posting CQEs. We could just grab it unconditionally, but since we don't expect many target rings to be of this type, make grabbing the uring_lock conditional on the ring type. Link: https://lore.kernel.org/io-uring/Y8krlYa52%2F0YGqkg@ip-172-31-85-199.ec2.internal/ Reported-by: Xingyuan Mo Signed-off-by: Jens Axboe commit 6c977c5c2e4c5d8ad1b604724cc344e38f96fe9b Author: Rakesh Sankaranarayanan Date: Wed Jan 18 23:17:35 2023 +0530 net: dsa: microchip: ksz9477: port map correction in ALU table entry register ALU table entry 2 register in KSZ9477 have bit positions reserved for forwarding port map. This field is referred in ksz9477_fdb_del() for clearing forward port map and alu table. But current fdb_del refer ALU table entry 3 register for accessing forward port map. Update ksz9477_fdb_del() to get forward port map from correct alu table entry register. With this bug, issue can be observed while deleting static MAC entries. Delete any specific MAC entry using "bridge fdb del" command. This should clear all the specified MAC entries. But it is observed that entries with self static alone are retained. Tested on LAN9370 EVB since ksz9477_fdb_del() is used common across LAN937x and KSZ series. Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") Signed-off-by: Rakesh Sankaranarayanan Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230118174735.702377-1-rakesh.sankaranarayanan@microchip.com Signed-off-by: Jakub Kicinski commit 903848249a781d76d59561d51676c95b3a4d7162 Author: Willem de Bruijn Date: Wed Jan 18 10:18:47 2023 -0500 selftests/net: toeplitz: fix race on tpacket_v3 block close Avoid race between process wakeup and tpacket_v3 block timeout. The test waits for cfg_timeout_msec for packets to arrive. Packets arrive in tpacket_v3 rings, which pass packets ("frames") to the process in batches ("blocks"). The sk waits for req3.tp_retire_blk_tov msec to release a block. Set the block timeout lower than the process waiting time, else the process may find that no block has been released by the time it scans the socket list. Convert to a ring of more than one, smaller, blocks with shorter timeouts. Blocks must be page aligned, so >= 64KB. Fixes: 5ebfb4cc3048 ("selftests/net: toeplitz test") Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230118151847.4124260-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 8ccc99362b60c6f27bb46f36fdaaccf4ef0303de Author: Paolo Abeni Date: Wed Jan 18 13:24:12 2023 +0100 net/ulp: use consistent error code when blocking ULP The referenced commit changed the error code returned by the kernel when preventing a non-established socket from attaching the ktls ULP. Before to such a commit, the user-space got ENOTCONN instead of EINVAL. The existing self-tests depend on such error code, and the change caused a failure: RUN global.non_established ... tls.c:1673:non_established:Expected errno (22) == ENOTCONN (107) non_established: Test failed at step #3 FAIL global.non_established In the unlikely event existing applications do the same, address the issue by restoring the prior error code in the above scenario. Note that the only other ULP performing similar checks at init time - smc_ulp_ops - also fails with ENOTCONN when trying to attach the ULP to a non-established socket. Reported-by: Sabrina Dubroca Fixes: 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status") Signed-off-by: Paolo Abeni Reviewed-by: Sabrina Dubroca Link: https://lore.kernel.org/r/7bb199e7a93317fb6f8bf8b9b2dc71c18f337cde.1674042685.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit b3c00316a2f847791bae395ea6dd91aa7a221471 Author: Pierre-Louis Bossart Date: Thu Jan 19 18:34:59 2023 +0200 ASoC: Intel: sof_ssp_amp: always set dpcm_capture for amplifiers The amplifier may provide hardware support for I/V feedback, or alternatively the firmware may generate an echo reference attached to the SSP and dailink used for the amplifier. To avoid any issues with invalid/NULL substreams in the latter case, always unconditionally set dpcm_capture. Link: https://github.com/thesofproject/linux/issues/4083 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20230119163459.2235843-5-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 36a71a0eb7cdb5ccf4b0214dbd41ab00dff18c7f Author: Pierre-Louis Bossart Date: Thu Jan 19 18:34:58 2023 +0200 ASoC: Intel: sof_nau8825: always set dpcm_capture for amplifiers The amplifier may provide hardware support for I/V feedback, or alternatively the firmware may generate an echo reference attached to the SSP and dailink used for the amplifier. To avoid any issues with invalid/NULL substreams in the latter case, always unconditionally set dpcm_capture. Link: https://github.com/thesofproject/linux/issues/4083 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20230119163459.2235843-4-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit e0a52220344ab7defe25b9cdd58fe1dc1122e67c Author: Pierre-Louis Bossart Date: Thu Jan 19 18:34:57 2023 +0200 ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers The amplifier may provide hardware support for I/V feedback, or alternatively the firmware may generate an echo reference attached to the SSP and dailink used for the amplifier. To avoid any issues with invalid/NULL substreams in the latter case, always unconditionally set dpcm_capture. Link: https://github.com/thesofproject/linux/issues/4083 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20230119163459.2235843-3-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 324f065cdbaba1b879a63bf07e61ca156b789537 Author: Pierre-Louis Bossart Date: Thu Jan 19 18:34:56 2023 +0200 ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers The amplifier may provide hardware support for I/V feedback, or alternatively the firmware may generate an echo reference attached to the SSP and dailink used for the amplifier. To avoid any issues with invalid/NULL substreams in the latter case, always unconditionally set dpcm_capture. Link: https://github.com/thesofproject/linux/issues/4083 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20230119163459.2235843-2-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 8c29f016540532582721cec1dbf6d144873433ba Author: Nikunj A Dadhania Date: Wed Jan 18 11:49:43 2023 +0530 x86/sev: Add SEV-SNP guest feature negotiation support The hypervisor can enable various new features (SEV_FEATURES[1:63]) and start a SNP guest. Some of these features need guest side implementation. If any of these features are enabled without it, the behavior of the SNP guest will be undefined. It may fail booting in a non-obvious way making it difficult to debug. Instead of allowing the guest to continue and have it fail randomly later, detect this early and fail gracefully. The SEV_STATUS MSR indicates features which the hypervisor has enabled. While booting, SNP guests should ascertain that all the enabled features have guest side implementation. In case a feature is not implemented in the guest, the guest terminates booting with GHCB protocol Non-Automatic Exit(NAE) termination request event, see "SEV-ES Guest-Hypervisor Communication Block Standardization" document (currently at https://developer.amd.com/wp-content/resources/56421.pdf), section "Termination Request". Populate SW_EXITINFO2 with mask of unsupported features that the hypervisor can easily report to the user. More details in the AMD64 APM Vol 2, Section "SEV_STATUS MSR". [ bp: - Massage. - Move snp_check_features() call to C code. Note: the CC:stable@ aspect here is to be able to protect older, stable kernels when running on newer hypervisors. Or not "running" but fail reliably and in a well-defined manner instead of randomly. ] Fixes: cbd3d4f7c4e5 ("x86/sev: Check SEV-SNP features support") Signed-off-by: Nikunj A Dadhania Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Cc: Link: https://lore.kernel.org/r/20230118061943.534309-1-nikunj@amd.com commit 9be182da0a7526f1b9a3777a336f83baa2e64d23 Author: Chen Zhongjin Date: Fri Nov 25 14:35:41 2022 +0800 driver core: Fix test_async_probe_init saves device in wrong array In test_async_probe_init, second set of asynchronous devices are saved in sync_dev[sync_id], which should be async_dev[async_id]. This makes these devices not unregistered when exit. > modprobe test_async_driver_probe && \ > modprobe -r test_async_driver_probe && \ > modprobe test_async_driver_probe ... > sysfs: cannot create duplicate filename '/devices/platform/test_async_driver.4' > kobject_add_internal failed for test_async_driver.4 with -EEXIST, don't try to register things with the same name in the same directory. Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity") Signed-off-by: Chen Zhongjin Link: https://lore.kernel.org/r/20221125063541.241328-1-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman commit 36225a7c72e9e3e1ce4001b6ce72849f5c9a2d3b Author: Yang Yingliang Date: Mon Dec 5 18:15:58 2022 +0800 w1: fix WARNING after calling w1_process() I got the following WARNING message while removing driver(ds2482): ------------[ cut here ]------------ do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire] WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0 CPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G N 6.1.0-rc3+ #307 RIP: 0010:__might_sleep+0x98/0xa0 Call Trace: exit_signals+0x6c/0x550 do_exit+0x2b4/0x17e0 kthread_exit+0x52/0x60 kthread+0x16d/0x1e0 ret_from_fork+0x1f/0x30 The state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(), set it to TASK_RUNNING when it breaks out of the loop to avoid the warning. Fixes: 3c52e4e62789 ("W1: w1_process, block or sleep") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221205101558.3599162-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 25d5648802f12ae486076ceca5d7ddf1fef792b2 Author: Yang Yingliang Date: Mon Dec 5 16:04:34 2022 +0800 w1: fix deadloop in __w1_remove_master_device() I got a deadloop report while doing device(ds2482) add/remove test: [ 162.241881] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. [ 163.272251] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. [ 164.296157] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. ... __w1_remove_master_device() can't return, because the dev->refcnt is not zero. w1_add_master_device() | w1_alloc_dev() | atomic_set(&dev->refcnt, 2) | kthread_run() | |__w1_remove_master_device() | kthread_stop() // KTHREAD_SHOULD_STOP is set, | // threadfn(w1_process) won't be | // called. | kthread() | | // refcnt will never be 0, it's deadloop. | while (atomic_read(&dev->refcnt)) {...} After calling w1_add_master_device(), w1_process() is not really invoked, before w1_process() starting, if kthread_stop() is called in __w1_remove_master_device(), w1_process() will never be called, the refcnt can not be decreased, then it causes deadloop in remove function because of non-zero refcnt. We need to make sure w1_process() is really started, so move the set refcnt into w1_process() to fix this problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221205080434.3149205-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 2efb6edd52dc50273f5e68ad863dd1b1fb2f2d1c Author: Ian Abbott Date: Tue Jan 3 14:37:54 2023 +0000 comedi: adv_pci1760: Fix PWM instruction handling (Actually, this is fixing the "Read the Current Status" command sent to the device's outgoing mailbox, but it is only currently used for the PWM instructions.) The PCI-1760 is operated mostly by sending commands to a set of Outgoing Mailbox registers, waiting for the command to complete, and reading the result from the Incoming Mailbox registers. One of these commands is the "Read the Current Status" command. The number of this command is 0x07 (see the User's Manual for the PCI-1760 at . The `PCI1760_CMD_GET_STATUS` macro defined in the driver should expand to this command number 0x07, but unfortunately it currently expands to 0x03. (Command number 0x03 is not defined in the User's Manual.) Correct the definition of the `PCI1760_CMD_GET_STATUS` macro to fix it. This is used by all the PWM subdevice related instructions handled by `pci1760_pwm_insn_config()` which are probably all broken. The effect of sending the undefined command number 0x03 is not known. Fixes: 14b93bb6bbf0 ("staging: comedi: adv_pci_dio: separate out PCI-1760 support") Cc: # v4.5+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20230103143754.17564-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 423d5081d0451faa59a707e57373801da5b40141 Author: Jens Axboe Date: Thu Jan 19 09:01:27 2023 -0700 io_uring/msg_ring: move double lock/unlock helpers higher up In preparation for needing them somewhere else, move them and get rid of the unused 'issue_flags' for the unlock side. No functional changes in this patch. Signed-off-by: Jens Axboe commit 5342ab0af45064cbdc773645b93ab70c24ee161f Author: Arnd Bergmann Date: Thu Dec 15 17:54:24 2022 +0100 tty: serial: qcom_geni: avoid duplicate struct member init When -Woverride-init is enabled in a build, gcc points out that qcom_geni_serial_pm_ops contains conflicting initializers: drivers/tty/serial/qcom_geni_serial.c:1586:20: error: initialized field overwritten [-Werror=override-init] 1586 | .restore = qcom_geni_serial_sys_hib_resume, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/tty/serial/qcom_geni_serial.c:1586:20: note: (near initialization for 'qcom_geni_serial_pm_ops.restore') drivers/tty/serial/qcom_geni_serial.c:1587:17: error: initialized field overwritten [-Werror=override-init] 1587 | .thaw = qcom_geni_serial_sys_hib_resume, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Open-code the initializers with the version that was already used, and use the pm_sleep_ptr() method to deal with unused ones, in place of the __maybe_unused annotation. Fixes: 35781d8356a2 ("tty: serial: qcom-geni-serial: Add support for Hibernation feature") Signed-off-by: Arnd Bergmann Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20221215165453.1864836-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f Author: Tobias Schramm Date: Mon Jan 9 08:29:40 2023 +0100 serial: atmel: fix incorrect baudrate setup Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup") changed uart_set_options to select the correct baudrate configuration based on the absolute error between requested baudrate and available standard baudrate settings. Prior to that commit the baudrate was selected based on which predefined standard baudrate did not exceed the requested baudrate. This change of selection logic was never reflected in the atmel serial driver. Thus the comment left in the atmel serial driver is no longer accurate. Additionally the manual rounding up described in that comment and applied via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses tty_termios_encode_baud_rate to determine the appropriate baudrate flags this can cause baudrate selection to fail entirely because tty_termios_encode_baud_rate will only select a baudrate if relative error between requested and selected baudrate does not exceed +/-2%. Fix that by requesting actual, exact baudrate used by the serial. Fixes: ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup") Cc: stable Signed-off-by: Tobias Schramm Acked-by: Richard Genoud Link: https://lore.kernel.org/r/20230109072940.202936-1-t.schramm@manjaro.org Signed-off-by: Greg Kroah-Hartman commit 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 Author: Gaosheng Cui Date: Fri Dec 2 14:06:33 2022 +0800 tty: fix possible null-ptr-defer in spk_ttyio_release Run the following tests on the qemu platform: syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow: syzkaller:~# modprobe -r speakup_audptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutex_lock+0x14/0x30 Call Trace: spk_ttyio_release+0x19/0x70 [speakup] synth_release.part.6+0xac/0xc0 [speakup] synth_remove+0x56/0x60 [speakup] __x64_sys_delete_module+0x156/0x250 ? fpregs_assert_state_consistent+0x1d/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer: in_synth->dev was not initialized during modprobe, so we add check for in_synth->dev to fix this bug. Fixes: 4f2a81f3a882 ("speakup: Reference synth from tty and tty from synth") Cc: stable Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221202060633.217364-1-cuigaosheng1@huawei.com Reviewed-by: Samuel Thibault Signed-off-by: Greg Kroah-Hartman commit 5c312574e683a3e59d86fa99f2822c0c7aa74be6 Merge: 55ba18dc62def 2c1e1b9490249 Author: Paolo Abeni Date: Thu Jan 19 15:39:37 2023 +0100 Merge tag 'mlx5-fixes-2023-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net: mlx5: eliminate anonymous module_init & module_exit net/mlx5: E-switch, Fix switchdev mode after devlink reload net/mlx5e: Protect global IPsec ASO net/mlx5e: Remove optimization which prevented update of ESN state net/mlx5e: Set decap action based on attr for sample net/mlx5e: QoS, Fix wrongfully setting parent_element_id on MODIFY_SCHEDULING_ELEMENT net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT net/mlx5e: Remove redundant xsk pointer check in mlx5e_mpwrq_validate_xsk net/mlx5e: Avoid false lock dependency warning on tc_ht even more net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() ==================== Link: https://lore.kernel.org/r/ Signed-off-by: Paolo Abeni commit 21493c6e96e550509ead696ecca9f0d7196ee91c Merge: 98d0052d0d9dc 4fe59a130c112 Author: Petr Mladek Date: Thu Jan 19 14:56:38 2023 +0100 Merge branch 'rework/console-list-lock' into for-linus commit f24771b62a83239f0dce816bddf0f6807f436235 Author: Marek Vasut Date: Thu Jan 12 19:04:17 2023 +0100 serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Requesting an interrupt with IRQF_ONESHOT will run the primary handler in the hard-IRQ context even in the force-threaded mode. The force-threaded mode is used by PREEMPT_RT in order to avoid acquiring sleeping locks (spinlock_t) in hard-IRQ context. This combination makes it impossible and leads to "sleeping while atomic" warnings. Use one interrupt handler for both handlers (primary and secondary) and drop the IRQF_ONESHOT flag which is not needed. Fixes: e359b4411c283 ("serial: stm32: fix threaded interrupt handling") Reviewed-by: Sebastian Andrzej Siewior Tested-by: Valentin Caron # V3 Signed-off-by: Marek Vasut Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230112180417.25595-1-marex@denx.de Signed-off-by: Greg Kroah-Hartman commit 4f39aca2360c82dccd2f5179d77e94aab665bea6 Author: Lino Sanfilippo Date: Sun Jan 8 19:17:35 2023 +0100 serial: amba-pl011: fix high priority character transmission in rs486 mode In RS485 mode the transmission of a high priority character fails since it is written to the data register before the transmitter is enabled. Fix this in pl011_tx_chars() by enabling RS485 transmission before writing the character. Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support") Cc: stable@vger.kernel.org Signed-off-by: Lino Sanfilippo Link: https://lore.kernel.org/r/20230108181735.10937-1-LinoSanfilippo@gmx.de Signed-off-by: Greg Kroah-Hartman commit e8914b52e5b024e4af3d810a935fe0805eee8a36 Author: Ilpo Järvinen Date: Tue Jan 3 11:34:35 2023 +0200 serial: pch_uart: Pass correct sg to dma_unmap_sg() A local variable sg is used to store scatterlist pointer in pch_dma_tx_complete(). The for loop doing Tx byte accounting before dma_unmap_sg() alters sg in its increment statement. Therefore, the pointer passed into dma_unmap_sg() won't match to the one given to dma_map_sg(). To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg() instead of the local variable. Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") Cc: stable@vger.kernel.org Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230103093435.4396-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 Author: Krzysztof Kozlowski Date: Wed Dec 21 17:40:22 2022 +0100 tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer. Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20221221164022.1087814-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 39af728649b05e88a2b40e714feeee6451c3f18e Author: Yang Yingliang Date: Wed Nov 23 10:25:42 2022 +0800 device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() The 'parent' returned by fwnode_graph_get_port_parent() with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the parent is const, introduce a new variable to store the returned fwnode, then put it before returning from fwnode_graph_get_next_endpoint(). Fixes: b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()") Signed-off-by: Yang Yingliang Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Reviewed-and-tested-by: Daniel Scally Link: https://lore.kernel.org/r/20221123022542.2999510-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 95e5fda3b5f9ed8239b145da3fa01e641cf5d53c Author: Eric Pilmore Date: Wed Jan 18 19:39:08 2023 -0800 ptdma: pt_core_execute_cmd() should use spinlock The interrupt handler (pt_core_irq_handler()) of the ptdma driver can be called from interrupt context. The code flow in this function can lead down to pt_core_execute_cmd() which will attempt to grab a mutex, which is not appropriate in interrupt context and ultimately leads to a kernel panic. The fix here changes this mutex to a spinlock, which has been verified to resolve the issue. Fixes: fa5d823b16a9 ("dmaengine: ptdma: Initial driver for the AMD PTDMA") Signed-off-by: Eric Pilmore Link: https://lore.kernel.org/r/20230119033907.35071-1-epilmore@gigaio.com Signed-off-by: Vinod Koul commit 7d80dbd708c18c683dd34f79b600a05307707ce8 Author: Arnd Bergmann Date: Wed Jan 18 10:01:41 2023 +0100 usb: dwc3: fix extcon dependency The dwc3 core support now links against the extcon subsystem, so it cannot be built-in when extcon is a loadable module: arm-linux-gnueabi-ld: drivers/usb/dwc3/core.o: in function `dwc3_get_extcon': core.c:(.text+0x572): undefined reference to `extcon_get_edev_by_phandle' arm-linux-gnueabi-ld: core.c:(.text+0x596): undefined reference to `extcon_get_extcon_dev' arm-linux-gnueabi-ld: core.c:(.text+0x5ea): undefined reference to `extcon_find_edev_by_node' There was already a Kconfig dependency in the dual-role support, but this is now needed for the entire dwc3 driver. It is still possible to build dwc3 without extcon, but this prevents it from being set to built-in when extcon is a loadable module. Fixes: d182c2e1bc92 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") Signed-off-by: Arnd Bergmann Reviewed-by: Andy Shevchenko Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230118090147.2126563-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0220e4fe178c3390eb0291cdb34912d66972db8a Author: Nirmoy Das Date: Tue Jan 17 18:52:36 2023 +0100 drm/i915: Fix a memory leak with reused mmap_offset drm_vma_node_allow() and drm_vma_node_revoke() should be called in balanced pairs. We call drm_vma_node_allow() once per-file everytime a user calls mmap_offset, but only call drm_vma_node_revoke once per-file on each mmap_offset. As the mmap_offset is reused by the client, the per-file vm_count may remain non-zero and the rbtree leaked. Call drm_vma_node_allow_once() instead to prevent that memory leak. Cc: Tvrtko Ursulin Cc: Andi Shyti Signed-off-by: Nirmoy Das Fixes: 786555987207 ("drm/i915/gem: Store mmap_offsets in an rbtree rather than a plain list") Reported-by: Chuansheng Liu Reported-by: Mirsad Todorovac Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20230117175236.22317-2-nirmoy.das@intel.com Signed-off-by: Maxime Ripard commit 899d3a3c19ac0e5da013ce34833dccb97d19b5e4 Author: Nirmoy Das Date: Tue Jan 17 18:52:35 2023 +0100 drm/drm_vma_manager: Add drm_vma_node_allow_once() Currently there is no easy way for a drm driver to safely check and allow drm_vma_offset_node for a drm file just once. Allow drm drivers to call non-refcounted version of drm_vma_node_allow() so that a driver doesn't need to keep track of each drm_vma_node_allow() to call subsequent drm_vma_node_revoke() to prevent memory leak. Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Daniel Vetter Cc: Tvrtko Ursulin Cc: Andi Shyti Suggested-by: Chris Wilson Signed-off-by: Nirmoy Das Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20230117175236.22317-1-nirmoy.das@intel.com Signed-off-by: Maxime Ripard commit 55ba18dc62deff5910c0fa64486dea1ff20832ff Author: Kevin Hao Date: Wed Jan 18 15:13:00 2023 +0800 octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt The commit 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free") uses the get/put_cpu() to protect the usage of percpu pointer in ->aura_freeptr() callback, but it also unnecessarily disable the preemption for the blockable memory allocation. The commit 87b93b678e95 ("octeontx2-pf: Avoid use of GFP_KERNEL in atomic context") tried to fix these sleep inside atomic warnings. But it only fix the one for the non-rt kernel. For the rt kernel, we still get the similar warnings like below. BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by swapper/0/1: #0: ffff800009fc5fe8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x24/0x30 #1: ffff000100c276c0 (&mbox->lock){+.+.}-{3:3}, at: otx2_init_hw_resources+0x8c/0x3a4 #2: ffffffbfef6537e0 (&cpu_rcache->lock){+.+.}-{2:2}, at: alloc_iova_fast+0x1ac/0x2ac Preemption disabled at: [] otx2_rq_aura_pool_init+0x14c/0x284 CPU: 20 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-rt1-yocto-preempt-rt #1 Hardware name: Marvell OcteonTX CN96XX board (DT) Call trace: dump_backtrace.part.0+0xe8/0xf4 show_stack+0x20/0x30 dump_stack_lvl+0x9c/0xd8 dump_stack+0x18/0x34 __might_resched+0x188/0x224 rt_spin_lock+0x64/0x110 alloc_iova_fast+0x1ac/0x2ac iommu_dma_alloc_iova+0xd4/0x110 __iommu_dma_map+0x80/0x144 iommu_dma_map_page+0xe8/0x260 dma_map_page_attrs+0xb4/0xc0 __otx2_alloc_rbuf+0x90/0x150 otx2_rq_aura_pool_init+0x1c8/0x284 otx2_init_hw_resources+0xe4/0x3a4 otx2_open+0xf0/0x610 __dev_open+0x104/0x224 __dev_change_flags+0x1e4/0x274 dev_change_flags+0x2c/0x7c ic_open_devs+0x124/0x2f8 ip_auto_config+0x180/0x42c do_one_initcall+0x90/0x4dc do_basic_setup+0x10c/0x14c kernel_init_freeable+0x10c/0x13c kernel_init+0x2c/0x140 ret_from_fork+0x10/0x20 Of course, we can shuffle the get/put_cpu() to only wrap the invocation of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only two ->aura_freeptr() callbacks, otx2_aura_freeptr() and cn10k_aura_freeptr(). There is no usage of perpcu variable in the otx2_aura_freeptr() at all, so the get/put_cpu() seems redundant to it. We can move the get/put_cpu() into the corresponding callback which really has the percpu variable usage and avoid the sprinkling of get/put_cpu() in several places. Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free") Signed-off-by: Kevin Hao Link: https://lore.kernel.org/r/20230118071300.3271125-1-haokexin@gmail.com Signed-off-by: Paolo Abeni commit 3f4ca5fafc08881d7a57daa20449d171f2887043 Author: Jason Xing Date: Wed Jan 18 09:59:41 2023 +0800 tcp: avoid the lookup process failing to get sk in ehash table While one cpu is working on looking up the right socket from ehash table, another cpu is done deleting the request socket and is about to add (or is adding) the big socket from the table. It means that we could miss both of them, even though it has little chance. Let me draw a call trace map of the server side. CPU 0 CPU 1 ----- ----- tcp_v4_rcv() syn_recv_sock() inet_ehash_insert() -> sk_nulls_del_node_init_rcu(osk) __inet_lookup_established() -> __sk_nulls_add_node_rcu(sk, list) Notice that the CPU 0 is receiving the data after the final ack during 3-way shakehands and CPU 1 is still handling the final ack. Why could this be a real problem? This case is happening only when the final ack and the first data receiving by different CPUs. Then the server receiving data with ACK flag tries to search one proper established socket from ehash table, but apparently it fails as my map shows above. After that, the server fetches a listener socket and then sends a RST because it finds a ACK flag in the skb (data), which obeys RST definition in RFC 793. Besides, Eric pointed out there's one more race condition where it handles tw socket hashdance. Only by adding to the tail of the list before deleting the old one can we avoid the race if the reader has already begun the bucket traversal and it would possibly miss the head. Many thanks to Eric for great help from beginning to end. Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/lkml/20230112065336.41034-1-kerneljasonxing@gmail.com/ Link: https://lore.kernel.org/r/20230118015941.1313-1-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit cec669ff716cc83505c77b242aecf6f7baad869d Author: Manivannan Sadhasivam Date: Wed Jan 18 20:38:48 2023 +0530 EDAC/device: Respect any driver-supplied workqueue polling value The EDAC drivers may optionally pass the poll_msec value. Use that value if available, else fall back to 1000ms. [ bp: Touchups. ] Fixes: e27e3dac6517 ("drivers/edac: add edac_device class") Reported-by: Luca Weiss Signed-off-by: Manivannan Sadhasivam Signed-off-by: Borislav Petkov (AMD) Tested-by: Steev Klimaszewski # Thinkpad X13s Tested-by: Andrew Halaney # sa8540p-ride Cc: # 4.9 Link: https://lore.kernel.org/r/COZYL8MWN97H.MROQ391BGA09@otso commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa Author: Artemii Karasev Date: Thu Jan 19 00:22:59 2023 -0800 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs") Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru Signed-off-by: Takashi Iwai commit 1104693cdfcd337e73ab585a225f05445ff7a864 Author: Jonas Karlman Date: Sun Jan 15 21:15:56 2023 +0000 arm64: dts: rockchip: fix probe of analog sound card on rock-3a The following was observed on my Radxa ROCK 3 Model A board: rockchip-pinctrl pinctrl: pin gpio1-9 already requested by vcc-cam-regulator; cannot claim for fe410000.i2s ... platform rk809-sound: deferred probe pending Fix this by supplying a board specific pinctrl with the i2s1 pins used by pmic codec according to the schematic [1]. [1] https://dl.radxa.com/rock3/docs/hw/3a/ROCK-3A-V1.3-SCH.pdf Signed-off-by: Jonas Karlman Acked-by: Michael Riesch Link: https://lore.kernel.org/r/20230115211553.445007-1-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 86d884f5287f4369c198811aaa4931a3a11f36d2 Author: Geert Uytterhoeven Date: Tue Jan 3 17:45:30 2023 +0100 clk: microchip: mpfs-ccc: Use devm_kasprintf() for allocating formatted strings In various places, string buffers of a fixed size are allocated, and filled using snprintf() with the same fixed size, which is error-prone. Replace this by calling devm_kasprintf() instead, which always uses the appropriate size. While at it, remove an unneeded intermediate variable, which allows us to drop a cast as a bonus. With the initial behavior it would have been possible to have a device tree with a node address that would make "ccc_pll" exceed 18 characters. If that happened, the would be cut off & both pll 0 & 1 would be named identically. If that happens, pll1 would fail to register. Thus, the fixes tag has been added to this commit. Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Conor Dooley Tested-by: Conor Dooley [claudiu.beznea: added the rationale behind fixes tag] Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/f904fd28b2087d1463ea65f059924e3b1acc193c.1672764239.git.geert+renesas@glider.be commit 1c5842085851f786eba24a39ecd02650ad892064 Author: Keith Busch Date: Wed Jan 18 08:44:16 2023 -0800 nvme-pci: fix timeout request state check Polling the completion can progress the request state to IDLE, either inline with the completion, or through softirq. Either way, the state may not be COMPLETED, so don't check for that. We only care if the state isn't IN_FLIGHT. This is fixing an issue where the driver aborts an IO that we just completed. Seeing the "aborting" message instead of "polled" is very misleading as to where the timeout problem resides. Fixes: bf392a5dc02a9b ("nvme-pci: Remove tag from process cq") Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit c0a4a1eafbd48e02829045bba3e6163c03037276 Author: Janne Grunau Date: Tue Jan 17 19:25:01 2023 +0100 nvme-apple: only reset the controller when RTKit is running NVMe controller register access hangs indefinitely when the co-processor is not running. A missed reset is preferable over a hanging thread since it could be recoverable. Signed-off-by: Janne Grunau Signed-off-by: Christoph Hellwig commit c06ba7b892a50b48522ad441a40053f483dfee9e Author: Janne Grunau Date: Tue Jan 17 19:25:00 2023 +0100 nvme-apple: reset controller during shutdown This is a functional revert of c76b8308e4c9 ("nvme-apple: fix controller shutdown in apple_nvme_disable"). The commit broke suspend/resume since apple_nvme_reset_work() tries to disable the controller on resume. This does not work for the apple NVMe controller since register access only works while the co-processor firmware is running. Disabling the NVMe controller in the shutdown path is also required for shutting the co-processor down. The original code was appropriate for this hardware. Add a comment to prevent a similar breaking changes in the future. Fixes: c76b8308e4c9 ("nvme-apple: fix controller shutdown in apple_nvme_disable") Reported-by: Janne Grunau Link: https://lore.kernel.org/all/20230110174745.GA3576@jannau.net/ Signed-off-by: Janne Grunau [hch: updated with a more descriptive comment from Hector Martin] Signed-off-by: Christoph Hellwig commit 4fb58ac3368c6058e61194ec047a5503059d90ae Author: Xin Long Date: Tue Jan 17 13:42:12 2023 -0500 Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf" This reverts commit 0aa64df30b382fc71d4fb1827d528e0eb3eff854. Currently IFF_NO_ADDRCONF is used to prevent all ipv6 addrconf for the slave ports of team, bonding and failover devices and it means no ipv6 packets can be sent out through these slave ports. However, for team device, "nsna_ping" link_watch requires ipv6 addrconf. Otherwise, the link will be marked failure. This patch removes the IFF_NO_ADDRCONF flag set for team port, and we will fix the original issue in another patch, as Jakub suggested. Fixes: 0aa64df30b38 ("net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf") Signed-off-by: Xin Long Link: https://lore.kernel.org/r/63e09531fc47963d2e4eff376653d3db21b97058.1673980932.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit e0be11a833e8447f51f428b213c91a9b05601815 Author: Jakub Kicinski Date: Tue Jan 17 11:01:41 2023 -0800 MAINTAINERS: add networking entries for Willem We often have to ping Willem asking for reviews of patches because he doesn't get included in the CC list. Add MAINTAINERS entries for some of the areas he covers so that ./scripts/ will know to add him. Acked-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230117190141.60795-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 339346d49ae0859fe19b860998867861d37f1a76 Author: Jakub Kicinski Date: Thu Jan 12 20:41:37 2023 -0800 net: sched: gred: prevent races when adding offloads to stats Naresh reports seeing a warning that gred is calling u64_stats_update_begin() with preemption enabled. Arnd points out it's coming from _bstats_update(). We should be holding the qdisc lock when writing to stats, they are also updated from the datapath. Reported-by: Linux Kernel Functional Testing Link: https://lore.kernel.org/all/CA+G9fYsTr9_r893+62u6UGD3dVaCE-kN9C-Apmb2m=hxjc1Cqg@mail.gmail.com/ Fixes: e49efd5288bd ("net: sched: gred: support reporting stats from offloads") Link: https://lore.kernel.org/r/20230113044137.1383067-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a52287d66dfa1cca32e6273623b63ba39d87f126 Author: Alex Deucher Date: Wed Jan 18 09:21:22 2023 -0500 drm/amd/display: disable S/G display on DCN 3.1.4 Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue. Cc: roman.li@amd.com Cc: yifan1.zhang@amd.com Acked-by: Christian König Reviewed-by: Roman Li Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb Author: Alex Deucher Date: Wed Jan 18 09:19:21 2023 -0500 drm/amd/display: disable S/G display on DCN 3.1.5 Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2354 Cc: roman.li@amd.com Cc: yifan1.zhang@amd.com Acked-by: Christian König Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit dc88063b87775971be564d79dc1b05f7b8b5c135 Author: Lang Yu Date: Wed Jan 11 09:32:15 2023 +0800 drm/amdgpu: allow multipipe policy on ASICs with one MEC Always enable multipipe policy on ASICs with GC VERSION > 9.0.0 instead of MEC number > 1. This will allow multipipe policy on ASICs with one MEC, e.g., gfx11 APUs. Signed-off-by: Lang Yu Reviewed-by: Aaron Liu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 0ddadc3a2208aedb1b27dbb76d0b4e722b5b527a Author: Lang Yu Date: Wed Jan 11 09:52:11 2023 +0800 drm/amdgpu: correct MEC number for gfx11 APUs There is only one MEC on these APUs. Signed-off-by: Lang Yu Reviewed-by: Aaron Liu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit e433adc60f7f847e734c56246b09291532f29b6d Author: Hamza Mahfooz Date: Tue Jan 17 15:12:49 2023 -0500 drm/amd/display: fix issues with driver unload Currently, we run into a number of WARN()s when attempting to unload the amdgpu driver (e.g. using "modprobe -r amdgpu"). These all stem from calling drm_encoder_cleanup() too early. So, to fix this we can stop calling drm_encoder_cleanup() from amdgpu_dm_fini() and instead have it be called from amdgpu_dm_encoder_destroy(). Also, we don't need to free in amdgpu_dm_encoder_destroy() since mst_encoders[] isn't explicitly allocated by the slab allocator. Fixes: f74367e492ba ("drm/amdgpu/display: create fake mst encoders ahead of time (v4)") Reviewed-by: Alex Deucher Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 74ea8e78ab349514c9f4df0be1189d91267d750d Author: Christian König Date: Thu Jan 12 14:46:00 2023 +0100 drm/amdgpu: fix amdgpu_job_free_resources v2 It can be that neither fence were initialized when we run out of UVD streams for example. v2: fix typo breaking compile Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2324 Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 Author: Joshua Ashton Date: Tue Jan 10 22:50:42 2023 +0000 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is missing the values for the fourth column of the matrix. The fourth column of the matrix is essentially just a value that is added given that the color is 3 components in size. These values are needed to bias the chroma from the [-1, 1] -> [0, 1] range. This fixes color being very green when using Gamescope HDR on HDMI output which prefers YCC 4:4:4. Fixes: 40df2f809e8f ("drm/amd/display: color space ycbcr709 support") Reviewed-by: Melissa Wen Signed-off-by: Joshua Ashton Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 Author: Joshua Ashton Date: Tue Jan 10 20:12:21 2023 +0000 drm/amd/display: Calculate output_color_space after pixel encoding adjustment Code in get_output_color_space depends on knowing the pixel encoding to determine whether to pick between eg. COLOR_SPACE_SRGB or COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver. v2: Fixed patch being accidentally based on a personal feature branch, oops! Fixes: ea117312ea9f ("drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded") Reviewed-by: Melissa Wen Signed-off-by: Joshua Ashton Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4463b1eea28ad733ca5cb53d89371132a57b1db3 Author: Christian König Date: Fri Jan 13 17:32:45 2023 +0100 drm/amdgpu: fix cleaning up reserved VMID on release We need to reset this or otherwise run into list corruption later on. Fixes: e44a0fe630c5 ("drm/amdgpu: rework reserved VMID handling") Signed-off-by: Christian König Reviewed-by: Alex Deucher Tested-by: Candice Li Signed-off-by: Alex Deucher commit edb5b63e5673add742a860814a4f43ff213178ea Merge: b9fb10d131b8c 80f8a66dede0a Author: Jakub Kicinski Date: Wed Jan 18 20:10:31 2023 -0800 Merge tag 'wireless-2023-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.2 Third set of fixes for v6.2. This time most of them are for drivers, only one revert for mac80211. For an important mt76 fix we had to cherry pick two commits from wireless-next. * tag 'wireless-2023-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" wifi: mt76: dma: fix a regression in adding rx buffers wifi: mt76: handle possible mt76_rx_token_consume failures wifi: mt76: dma: do not increment queue head if mt76_dma_add_buf fails wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device wifi: brcmfmac: avoid handling disabled channels for survey dump ==================== Link: https://lore.kernel.org/r/20230118073749.AF061C433EF@smtp.kernel.org Signed-off-by: Jakub Kicinski commit c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 Author: jie1zhan Date: Fri Jan 13 10:39:13 2023 +0800 drm/amdgpu: Correct the power calcultion for Renior/Cezanne. From smu firmware,the value of power is transferred in units of watts. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2321 Fixes: 137aac26a2ed ("drm/amdgpu/smu12: fix power reporting on renoir") Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Reviewed-by: Aaron Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 Author: hongao Date: Tue Nov 22 19:20:34 2022 +0800 drm/amd/display: Fix set scaling doesn's work [Why] Setting scaling does not correctly update CRTC state. As a result dc stream state's src (composition area) && dest (addressable area) was not calculated as expected. This causes set scaling doesn's work. [How] Correctly update CRTC state when setting scaling property. Reviewed-by: Harry Wentland Tested-by: Rodrigo Siqueira Signed-off-by: hongao Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit bdb7fdb0aca8b96cef9995d3a57e251c2289322f Author: Yonghong Song Date: Wed Jan 18 12:48:15 2023 -0800 bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers In current bpf_send_signal() and bpf_send_signal_thread() helper implementation, irq_work is used to handle nmi context. Hao Sun reported in [1] that the current task at the entry of the helper might be gone during irq_work callback processing. To fix the issue, a reference is acquired for the current task before enqueuing into the irq_work so that the queued task is still available during irq_work callback processing. [1] https://lore.kernel.org/bpf/20230109074425.12556-1-sunhao.th@gmail.com/ Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper") Tested-by: Hao Sun Reported-by: Hao Sun Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20230118204815.3331855-1-yhs@fb.com Signed-off-by: Alexei Starovoitov commit 36024d023d139a0c8b552dc3b7f4dc7b4c139e8f Author: Hou Tao Date: Wed Jan 18 16:46:30 2023 +0800 bpf: Fix off-by-one error in bpf_mem_cache_idx() According to the definition of sizes[NUM_CACHES], when the size passed to bpf_mem_cache_size() is 256, it should return 6 instead 7. Fixes: 7c8199e24fa0 ("bpf: Introduce any context BPF specific memory allocator.") Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20230118084630.3750680-1-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 0ca2c535f5a07f01118a6a70bfab78576e02fcae Author: Peter Xu Date: Mon Jan 16 11:33:07 2023 -0500 selftests/vm: remove __USE_GNU in hugetlb-madvise.c __USE_GNU should be an internal macro only used inside glibc. Either memfd_create() or fallocate() requires _GNU_SOURCE per man page, where __USE_GNU will further be defined by glibc headers include/features.h: #ifdef _GNU_SOURCE # define __USE_GNU 1 #endif This fixes: >> hugetlb-madvise.c:20: warning: "__USE_GNU" redefined 20 | #define __USE_GNU | In file included from /usr/include/x86_64-linux-gnu/bits/libc-header-start.h:33, from /usr/include/stdlib.h:26, from hugetlb-madvise.c:16: /usr/include/features.h:407: note: this is the location of the previous definition 407 | # define __USE_GNU 1 | Link: https://lkml.kernel.org/r/Y8V9z+z6Tk7NetI3@x1n Signed-off-by: Peter Xu Reported-by: kernel test robot Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 7e3ce3f8d2d235f916baad1582f6cf12e0319013 Author: Peter Xu Date: Wed Dec 14 15:04:53 2022 -0500 mm: fix a few rare cases of using swapin error pte marker This patch should harden commit 15520a3f0469 ("mm: use pte markers for swap errors") on using pte markers for swapin errors on a few corner cases. 1. Propagate swapin errors across fork()s: if there're swapin errors in the parent mm, after fork()s the child should sigbus too when an error page is accessed. 2. Fix a rare condition race in pte_marker_clear() where a uffd-wp pte marker can be quickly switched to a swapin error. 3. Explicitly ignore swapin error pte markers in change_protection(). I mostly don't worry on (2) or (3) at all, but we should still have them. Case (1) is special because it can potentially cause silent data corrupt on child when parent has swapin error triggered with swapoff, but since swapin error is rare itself already it's probably not easy to trigger either. Currently there is a priority difference between the uffd-wp bit and the swapin error entry, in which the swapin error always has higher priority (e.g. we don't need to wr-protect a swapin error pte marker). If there will be a 3rd bit introduced, we'll probably need to consider a more involved approach so we may need to start operate on the bits. Let's leave that for later. This patch is tested with case (1) explicitly where we'll get corrupted data before in the child if there's existing swapin error pte markers, and after patch applied the child can be rightfully killed. We don't need to copy stable for this one since 15520a3f0469 just landed as part of v6.2-rc1, only "Fixes" applied. Link: https://lkml.kernel.org/r/20221214200453.1772655-3-peterx@redhat.com Fixes: 15520a3f0469 ("mm: use pte markers for swap errors") Signed-off-by: Peter Xu Acked-by: David Hildenbrand Reviewed-by: Miaohe Lin Cc: Andrea Arcangeli Cc: "Huang, Ying" Cc: Nadav Amit Cc: Pengfei Xu Signed-off-by: Andrew Morton commit 49d6d7fb631345b0f2957a7c4be24ad63903150f Author: Peter Xu Date: Wed Dec 14 15:04:52 2022 -0500 mm/uffd: fix pte marker when fork() without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when used with the recent swapin error markers. The major case is we should persist a swapin error marker after fork(), so child shouldn't read a corrupted page. This patch (of 2): When fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may have it and has pte marker installed. The warning is improper along with the comment. The right thing is to inherit the pte marker when needed, or keep the dst pte empty. A vague guess is this happened by an accident when there's the prior patch to introduce src/dst vma into this helper during the uffd-wp feature got developed and I probably messed up in the rebase, since if we replace dst_vma with src_vma the warning & comment it all makes sense too. Hugetlb did exactly the right here (copy_hugetlb_page_range()). Fix the general path. Reproducer: https://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c Bugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808 Link: https://lkml.kernel.org/r/20221214200453.1772655-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20221214200453.1772655-2-peterx@redhat.com Fixes: c56d1b62cce8 ("mm/shmem: handle uffd-wp during fork()") Signed-off-by: Peter Xu Reported-by: Pengfei Xu Acked-by: David Hildenbrand Reviewed-by: Miaohe Lin Cc: Andrea Arcangeli Cc: "Huang, Ying" Cc: Nadav Amit Cc: # 5.19+ Signed-off-by: Andrew Morton commit bd86d2ea369be2e768b58cba590e70b8bdc6f86a Merge: 19fa92fb72f8b 5dc4c995db9eb Author: Andrew Morton Date: Wed Jan 18 16:52:20 2023 -0800 Sync with v6.2-rc4 Merge branch 'master' into mm-hotfixes-stable commit 0bfe63d075789456e9589457b29d6f9c279e3252 Author: Bart Van Assche Date: Wed Jan 18 10:05:57 2023 -0800 scsi: device_handler: alua: Remove a might_sleep() annotation The might_sleep() annotation in alua_rtpg_queue() is not correct since the command completion code may call this function from atomic context. Calling alua_rtpg_queue() from atomic context in the command completion path is fine since request submitters must hold an sdev reference until command execution has completed. This patch fixes the following kernel complaint: BUG: sleeping function called from invalid context at drivers/scsi/device_handler/scsi_dh_alua.c:992 Call Trace: dump_stack_lvl+0xac/0x100 __might_resched+0x284/0x2c8 alua_rtpg_queue+0x3c/0x98 [scsi_dh_alua] alua_check+0x122/0x250 [scsi_dh_alua] alua_check_sense+0x172/0x228 [scsi_dh_alua] scsi_check_sense+0x8a/0x2e0 scsi_decide_disposition+0x286/0x298 scsi_complete+0x6a/0x108 blk_complete_reqs+0x6e/0x88 __do_softirq+0x13e/0x6b8 __irq_exit_rcu+0x14a/0x170 irq_exit_rcu+0x22/0x50 do_ext_irq+0x10a/0x1d0 Link: https://lore.kernel.org/r/20230118180557.1212577-1-bvanassche@acm.org Reported-by: Steffen Maier Reviewed-by: Martin Wilck Tested-by: Steffen Maier Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 Author: Mike Christie Date: Tue Jan 17 13:39:37 2023 -0600 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail. Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com Signed-off-by: Mike Christie Reviewed-by: Lee Duncan Acked-by: Ding Hui Signed-off-by: Martin K. Petersen commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 Author: Mike Christie Date: Tue Jan 17 13:39:36 2023 -0600 scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 [ 276.960536] [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923] ___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470] __kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_sendmsg+0xe0/0x170 [ 276.974583] __sys_sendmsg+0xc8/0x170 [ 276.974891] do_syscall_64+0x38/0x90 [ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd We can easily reproduce by two tasks: 1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done 2. while :; do cat \ /sys/devices/platform/host*/iscsi_host/host*/ipaddress; done iscsid | cat --------------------------------+--------------------------------------- |- iscsi_sw_tcp_session_destroy | |- iscsi_session_teardown | |- device_release | |- iscsi_session_release ||- dev_attr_show |- kfree | |- show_host_param_ | ISCSI_HOST_PARAM_IPADDRESS | |- iscsi_sw_tcp_host_get_param | |- r/w tcp_sw_host->session (UAF) |- iscsi_host_remove | |- iscsi_host_free | Fix the above bug by splitting the session removal into 2 parts: 1. removal from iSCSI class which includes sysfs and removal from host tracking. 2. freeing of session. During iscsi_tcp host and session removal we can remove the session from sysfs then remove the host from sysfs. At this point we know userspace is not accessing the kernel via sysfs so we can free the session and host. Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com Signed-off-by: Mike Christie Reviewed-by: Lee Duncan Acked-by: Ding Hui Signed-off-by: Martin K. Petersen commit ba81043753fffbc2ad6e0c5ff2659f12ac2f46b4 Author: Johan Hovold Date: Mon Jan 16 17:12:01 2023 +0100 scsi: ufs: core: Fix devfreq deadlocks There is a lock inversion and rwsem read-lock recursion in the devfreq target callback which can lead to deadlocks. Specifically, ufshcd_devfreq_scale() already holds a clk_scaling_lock read lock when toggling the write booster, which involves taking the dev_cmd mutex before taking another clk_scaling_lock read lock. This can lead to a deadlock if another thread: 1) tries to acquire the dev_cmd and clk_scaling locks in the correct order, or 2) takes a clk_scaling write lock before the attempt to take the clk_scaling read lock a second time. Fix this by dropping the clk_scaling_lock before toggling the write booster as was done before commit 0e9d4ca43ba8 ("scsi: ufs: Protect some contexts from unexpected clock scaling"). While the devfreq callbacks are already serialised, add a second serialising mutex to handle the unlikely case where a callback triggered through the devfreq sysfs interface is racing with a request to disable clock scaling through the UFS controller 'clkscale_enable' sysfs attribute. This could otherwise lead to the write booster being left disabled after having disabled clock scaling. Also take the new mutex in ufshcd_clk_scaling_allow() to make sure that any pending write booster update has completed on return. Note that this currently only affects Qualcomm platforms since commit 87bd05016a64 ("scsi: ufs: core: Allow host driver to disable wb toggling during clock scaling"). The lock inversion (i.e. 1 above) was reported by lockdep as: ====================================================== WARNING: possible circular locking dependency detected 6.1.0-next-20221216 #211 Not tainted ------------------------------------------------------ kworker/u16:2/71 is trying to acquire lock: ffff076280ba98a0 (&hba->dev_cmd.lock){+.+.}-{3:3}, at: ufshcd_query_flag+0x50/0x1c0 but task is already holding lock: ffff076280ba9cf0 (&hba->clk_scaling_lock){++++}-{3:3}, at: ufshcd_devfreq_scale+0x2b8/0x380 which lock already depends on the new lock. [ +0.011606] the existing dependency chain (in reverse order) is: -> #1 (&hba->clk_scaling_lock){++++}-{3:3}: lock_acquire+0x68/0x90 down_read+0x58/0x80 ufshcd_exec_dev_cmd+0x70/0x2c0 ufshcd_verify_dev_init+0x68/0x170 ufshcd_probe_hba+0x398/0x1180 ufshcd_async_scan+0x30/0x320 async_run_entry_fn+0x34/0x150 process_one_work+0x288/0x6c0 worker_thread+0x74/0x450 kthread+0x118/0x120 ret_from_fork+0x10/0x20 -> #0 (&hba->dev_cmd.lock){+.+.}-{3:3}: __lock_acquire+0x12a0/0x2240 lock_acquire.part.0+0xcc/0x220 lock_acquire+0x68/0x90 __mutex_lock+0x98/0x430 mutex_lock_nested+0x2c/0x40 ufshcd_query_flag+0x50/0x1c0 ufshcd_query_flag_retry+0x64/0x100 ufshcd_wb_toggle+0x5c/0x120 ufshcd_devfreq_scale+0x2c4/0x380 ufshcd_devfreq_target+0xf4/0x230 devfreq_set_target+0x84/0x2f0 devfreq_update_target+0xc4/0xf0 devfreq_monitor+0x38/0x1f0 process_one_work+0x288/0x6c0 worker_thread+0x74/0x450 kthread+0x118/0x120 ret_from_fork+0x10/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&hba->clk_scaling_lock); lock(&hba->dev_cmd.lock); lock(&hba->clk_scaling_lock); lock(&hba->dev_cmd.lock); *** DEADLOCK *** Fixes: 0e9d4ca43ba8 ("scsi: ufs: Protect some contexts from unexpected clock scaling") Cc: stable@vger.kernel.org # 5.12 Cc: Can Guo Tested-by: Andrew Halaney Signed-off-by: Johan Hovold Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20230116161201.16923-1-johan+linaro@kernel.org Signed-off-by: Martin K. Petersen commit bbbd25499100c810ceaf5193c3cfcab9f7402a33 Author: Alexey V. Vissarionov Date: Wed Jan 18 06:12:55 2023 +0300 scsi: hpsa: Fix allocation size for scsi_host_alloc() The 'h' is a pointer to struct ctlr_info, so it's just 4 or 8 bytes, while the structure itself is much bigger. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: edd163687ea5 ("hpsa: add driver for HP Smart Array controllers.") Link: https://lore.kernel.org/r/20230118031255.GE15213@altlinux.org Signed-off-by: Alexey V. Vissarionov Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit 7287904c8771b77b9504f53623bb477065c19a58 Merge: 7026172bc3343 3782c0d6edf65 Author: Linus Torvalds Date: Wed Jan 18 14:44:32 2023 -0800 Merge tag 'for-linus-2023011801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fixes for potential empty list handling in HID core (Pietro Borrello) - fix for NULL pointer dereference in betop driver that could be triggered by malicious device (Pietro Borrello) - fixes for handling calibration data preventing division by zero in Playstation driver (Roderick Colenbrander) - fix for memory leak on error path in amd-sfh driver (Basavaraj Natikar) - other few assorted small fixes and device ID-specific handling * tag 'for-linus-2023011801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: betop: check shape of output reports HID: playstation: sanity check DualSense calibration data. HID: playstation: sanity check DualShock4 calibration data. HID: uclogic: Add support for XP-PEN Deco 01 V2 HID: revert CHERRY_MOUSE_000C quirk HID: check empty report_list in bigben_probe() HID: check empty report_list in hid_validate_values() HID: amd_sfh: Fix warning unwind goto HID: intel_ish-hid: Add check for ishtp_dma_tx_map commit a1b7c8457ecc062f612a1aca174c2e1c21f9ac10 Author: Paulo Alcantara Date: Wed Jan 18 13:55:01 2023 -0300 cifs: remove unused function Remove dfs_cache_update_tgthint() as it is not used anywhere. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 30b2b2196d6e4cc24cbec633535a2404f258ce69 Author: Enzo Matsumiya Date: Wed Jan 18 14:06:57 2023 -0300 cifs: do not include page data when checking signature On async reads, page data is allocated before sending. When the response is received but it has no data to fill (e.g. STATUS_END_OF_FILE), __calc_signature() will still include the pages in its computation, leading to an invalid signature check. This patch fixes this by not setting the async read smb_rqst page data (zeroed by default) if its got_bytes is 0. This can be reproduced/verified with xfstests generic/465. Cc: Signed-off-by: Enzo Matsumiya Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 182da6f2b81a78709c58021542fb694f8ed80774 Author: Ard Biesheuvel Date: Thu Jan 12 14:33:19 2023 +0100 ACPI: PRM: Check whether EFI runtime is available The ACPI PRM address space handler calls efi_call_virt_pointer() to execute PRM firmware code, but doing so is only permitted when the EFI runtime environment is available. Otherwise, such calls are guaranteed to result in a crash, and must therefore be avoided. Given that the EFI runtime services may become unavailable after a crash occurring in the firmware, we need to check this each time the PRM address space handler is invoked. If the EFI runtime services were not available at registration time to being with, don't install the address space handler at all. Fixes: cefc7ca46235 ("ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype") Signed-off-by: Ard Biesheuvel Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 2293a73ad4f3b6c37c06713ff1b67659d92ef43d Author: Nirmoy Das Date: Wed Jan 18 18:06:24 2023 +0100 drm/i915: Remove unused variable Removed unused i915 var. Fixes: a273e95721e9 ("drm/i915: Allow switching away via vga-switcheroo if uninitialized") Signed-off-by: Nirmoy Das Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20230118170624.9326-1-nirmoy.das@intel.com Signed-off-by: Rodrigo Vivi commit 7026172bc334300652cb36d59b392c1a6b20926a Merge: 5fbad44dddf56 eef034ac66901 Author: Linus Torvalds Date: Wed Jan 18 09:54:27 2023 -0800 Merge tag 'affs-for-6.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull affs fix from David Sterba: "One minor fix for a KCSAN report" * tag 'affs-for-6.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: affs: initialize fsdata in affs_truncate() commit 5fbad44dddf560ba03e247352e8040992c7e95e8 Merge: 84bd7e08a79a5 e02ac3e7329f7 Author: Linus Torvalds Date: Wed Jan 18 09:50:23 2023 -0800 Merge tag 'erofs-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Two patches fixes issues reported by syzbot, one fixes a missing `domain_id` mount option in documentation and a minor cleanup: - Fix wrong iomap->length calculation post EOF, which could cause a WARN_ON in iomap_iter_done() (Siddh) - Fix improper kvcalloc() use with __GFP_NOFAIL (me) - Add missing `domain_id` mount option in documentation (Jingbo) - Clean up fscache option parsing (Jingbo)" * tag 'erofs-for-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: clean up parsing of fscache related options erofs: add documentation for 'domain_id' mount option erofs: fix kvcalloc() misuse with __GFP_NOFAIL erofs/zmap.c: Fix incorrect offset calculation commit 84bd7e08a79a5d3153c3a5805a1347a8dc979f35 Merge: c1649ec55708a dc74a9e8a8c57 Author: Linus Torvalds Date: Wed Jan 18 09:32:54 2023 -0800 Merge tag 'loongarch-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix a missing elf_hwcap, fix some stack unwinder bugs and two trivial cleanups" * tag 'loongarch-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Add generic ex-handler unwind in prologue unwinder LoongArch: Strip guess unwinder out from prologue unwinder LoongArch: Use correct sp value to get graph addr in stack unwinders LoongArch: Get frame info in unwind_start() when regs is not available LoongArch: Adjust PC value when unwind next frame in unwinder LoongArch: Simplify larch_insn_gen_xxx implementation LoongArch: Use common function sign_extend64() LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap commit bc30c15f275484f9b9fe27c2fa0895f3022d9943 Author: Geert Uytterhoeven Date: Wed Jan 18 11:29:58 2023 +0100 phy: phy-can-transceiver: Skip warning if no "max-bitrate" According to the DT bindings, the "max-bitrate" property is optional. However, when it is not present, a warning is printed. Fix this by adding a missing check for -EINVAL. Fixes: a4a86d273ff1b6f7 ("phy: phy-can-transceiver: Add support for generic CAN transceiver driver") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/88e158f97dd52ebaa7126cd9631f34764b9c0795.1674037334.git.geert+renesas@glider.be Signed-off-by: Vinod Koul commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d Author: Heiner Kallweit Date: Mon Jan 16 21:17:39 2023 +0100 dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation The compatible strings in the driver don't have the meson prefix. Fix this in the documentation and rename the file accordingly. Fixes: da86d286cce8 ("dt-bindings: phy: meson-g12a-usb2-phy: convert to yaml") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Reviewed-by: Martin Blumenstingl Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/8d960029-e94d-224b-911f-03e5deb47ebc@gmail.com Signed-off-by: Vinod Koul commit e181119046a0ec16126b682163040e8e33f310c1 Author: Heiner Kallweit Date: Mon Jan 16 21:19:03 2023 +0100 dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation The compatible string in the driver doesn't have the meson prefix. Fix this in the documentation and rename the file accordingly. Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Reviewed-by: Martin Blumenstingl Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/0a82be92-ce85-da34-9d6f-4b33034473e5@gmail.com Signed-off-by: Vinod Koul commit d6a49e8c4ca4d399ed65ac219585187fc8c2e2b1 Author: Paulo Alcantara Date: Wed Jan 18 13:36:31 2023 -0300 cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() Fix this by initializing rc to 0 as cache_refresh_path() would not set it in case of success. Reported-by: kernel test robot Link: https://lore.kernel.org/all/202301190004.bEHvbKG6-lkp@intel.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit dfd5fe19db7dc7006642f8109ee8965e5d031897 Author: Takashi Iwai Date: Wed Jan 18 17:59:47 2023 +0100 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless JBL Quantum610 Wireless (0ecb:205c) requires the same workaround that was used for JBL Quantum810 for limiting the sample rate. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216798 Link: https://lore.kernel.org/r/20230118165947.22317-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit afdecb232740ae40b9384fa0ac8ed799d6546516 Author: Matt Atwood Date: Wed Nov 23 10:36:48 2022 -0800 drm/i915/dg2: Introduce Wa_18019271663 Wa_18019271663 applies to all DG2 steppings and skus. Bspec: 66622 Signed-off-by: Matt Atwood Reviewed-by: Gustavo Sousa Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20221123183648.407058-2-matthew.s.atwood@intel.com (cherry picked from commit 900a80c5836587d95db32742f66e1f34f7b40fcb) Signed-off-by: Rodrigo Vivi commit ce38cb84c3e8d953f4e9beaa6ba270938242c72f Author: Matt Atwood Date: Wed Nov 23 10:36:47 2022 -0800 drm/i915/dg2: Introduce Wa_18018764978 Wa_18018764978 applies to specific steppings of DG2 (G10 C0+, G11 and G12 A0+). Clean up style in function at the same time. Bspec: 66622 Signed-off-by: Matt Atwood Reviewed-by: Gustavo Sousa Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20221123183648.407058-1-matthew.s.atwood@intel.com (cherry picked from commit 468a4e630c7da8cf586f85cc498d6097aed1ab4b) Signed-off-by: Rodrigo Vivi commit 858c54152658ccd4e305c1e12d3cc6825bc90504 Author: Jeremy Szu Date: Wed Jan 18 19:54:45 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs, speaker don't work for a HP platform There is a HP platform needs ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED quirk to make mic-mute/audio-mute/speaker working. Signed-off-by: Jeremy Szu Cc: Link: https://lore.kernel.org/r/20230118115446.14902-1-jeremy.szu@canonical.com Signed-off-by: Takashi Iwai commit a7a7ee6f5a019ad72852c001abbce50d35e992f2 Author: Akhil R Date: Wed Jan 18 17:28:01 2023 +0530 dmaengine: tegra: Fix memory leak in terminate_all() Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the desc_terminated list The descriptor will be freed later in desc_free_list(). This fixes the memory leaks which can happen when terminating an ongoing transfer. Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") Signed-off-by: Akhil R Link: https://lore.kernel.org/r/20230118115801.15210-1-akhilrajeev@nvidia.com Signed-off-by: Vinod Koul commit 596b53ccc36a546ab28e8897315c5b4d1d5a0200 Author: Liu Shixin Date: Tue Nov 22 10:16:12 2022 +0800 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() Since for_each_child_of_node() will increase the refcount of node, we need to call of_node_put() manually when breaking out of the iteration. Fixes: 9cd4360de609 ("dma: Add Xilinx AXI Video Direct Memory Access Engine driver support") Signed-off-by: Liu Shixin Acked-by: Peter Korsgaard Link: https://lore.kernel.org/r/20221122021612.1908866-1-liushixin2@huawei.com Signed-off-by: Vinod Koul commit 3deddb77fdd932df92f3b6a27a9cffed82c4fe1a Author: Paulo Alcantara Date: Tue Jan 17 19:00:41 2023 -0300 cifs: handle cache lookup errors different than -ENOENT lookup_cache_entry() might return an error different than -ENOENT (e.g. from ->char2uni), so handle those as well in cache_refresh_path(). Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 8064f711c6a4614a848009b5a773e8d7f055a4c5 Author: Paulo Alcantara Date: Tue Jan 17 19:00:40 2023 -0300 cifs: remove duplicate code in __refresh_tcon() The logic for creating or updating a cache entry in __refresh_tcon() could be simply done with cache_refresh_path(), so use it instead. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 11c8b3f8493cb5253da42fcd178d9b4630063f96 Author: Paulo Alcantara Date: Tue Jan 17 19:00:39 2023 -0300 cifs: don't take exclusive lock for updating target hints Avoid contention while updating dfs target hints. This should be perfectly fine to update them under shared locks. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 48d240bf00af943db6f069a53f090e444e85f760 Author: Paulo Alcantara Date: Tue Jan 17 19:00:38 2023 -0300 cifs: avoid re-lookups in dfs_cache_find() Simply downgrade the write lock on cache updates from cache_refresh_path() and avoid unnecessary re-lookup in dfs_cache_find(). Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9fb0db40513e27537fde63287aea920b60557a69 Author: Paulo Alcantara Date: Tue Jan 17 19:00:37 2023 -0300 cifs: fix potential deadlock in cache_refresh_path() Avoid getting DFS referral from an exclusive lock in cache_refresh_path() because the tcon IPC used for getting the referral could be disconnected and thus causing a deadlock as shown below: task A task B ====== ====== cifs_demultiplex_thread() dfs_cache_find() cifs_handle_standard() cache_refresh_path() reconnect_dfs_server() down_write() dfs_cache_noreq_find() get_dfs_referral() down_read() <- deadlock smb2_get_dfs_refer() SMB2_ioctl() cifs_send_recv() compound_send_recv() wait_for_response() where task A cannot wake up task B because it is blocked on down_read() due to the exclusive lock held in cache_refresh_path() and therefore not being able to make progress. Fixes: c9f711039905 ("cifs: keep referral server sessions alive") Reviewed-by: Aurélien Aptel Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit d1d5101452ab04e5a3f010bdd200971d78956e5a Author: Thomas Zimmermann Date: Mon Jan 16 12:54:24 2023 +0100 drm/fb-helper: Set framebuffer for vga-switcheroo clients Set the framebuffer info for drivers that support VGA switcheroo. Only affects the amdgpu and nouveau drivers, which use VGA switcheroo and generic fbdev emulation. For other drivers, this does nothing. This fixes a potential regression in the console code. Both, amdgpu and nouveau, invoked vga_switcheroo_client_fb_set() from their internal fbdev code. But the call got lost when the drivers switched to the generic emulation. Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") Signed-off-by: Thomas Zimmermann Reviewed-by: Daniel Vetter Reviewed-by: Alex Deucher Cc: Ben Skeggs Cc: Karol Herbst Cc: Lyude Paul Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Laurent Pinchart Cc: Jani Nikula Cc: Dave Airlie Cc: Evan Quan Cc: Christian König Cc: Alex Deucher Cc: Hawking Zhang Cc: Likun Gao Cc: "Christian König" Cc: Stanley Yang Cc: "Tianci.Yin" Cc: Xiaojian Du Cc: Andrey Grodzovsky Cc: YiPeng Chai Cc: Somalapuram Amaranath Cc: Bokun Zhang Cc: Guchun Chen Cc: Hamza Mahfooz Cc: Aurabindo Pillai Cc: Mario Limonciello Cc: Solomon Chiu Cc: Kai-Heng Feng Cc: Felix Kuehling Cc: Daniel Vetter Cc: "Marek Olšák" Cc: Sam Ravnborg Cc: Hans de Goede Cc: "Ville Syrjälä" Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: # v5.17+ Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-3-tzimmermann@suse.de commit a273e95721e96885971a05f1b34cb6d093904d9d Author: Thomas Zimmermann Date: Mon Jan 16 12:54:23 2023 +0100 drm/i915: Allow switching away via vga-switcheroo if uninitialized Always allow switching away via vga-switcheroo if the display is uninitalized. Instead prevent switching to i915 if the device has not been initialized. This issue was introduced by commit 5df7bd130818 ("drm/i915: skip display initialization when there is no display") protected, which protects code paths from being executed on uninitialized devices. In the case of vga-switcheroo, we want to allow a switch away from i915's device. So run vga_switcheroo_process_delayed_switch() and test in the switcheroo callbacks if the i915 device is available. Fixes: 5df7bd130818 ("drm/i915: skip display initialization when there is no display") Signed-off-by: Thomas Zimmermann Reviewed-by: Alex Deucher Cc: Radhakrishna Sripada Cc: Lucas De Marchi Cc: José Roberto de Souza Cc: Jani Nikula Cc: Ville Syrjälä Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: "Ville Syrjälä" Cc: Manasi Navare Cc: Stanislav Lisovskiy Cc: Imre Deak Cc: "Jouni Högander" Cc: Uma Shankar Cc: Ankit Nautiyal Cc: "Jason A. Donenfeld" Cc: Matt Roper Cc: Ramalingam C Cc: Thomas Zimmermann Cc: Andi Shyti Cc: Andrzej Hajda Cc: "José Roberto de Souza" Cc: Julia Lawall Cc: intel-gfx@lists.freedesktop.org Cc: # v5.14+ Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-2-tzimmermann@suse.de commit 93eea624526fc7d070cdae463408665824075f54 Author: Chris Wilson Date: Tue Jan 17 13:32:34 2023 +0100 drm/i915/selftests: Unwind hugepages to drop wakeref on error Make sure that upon error after we have acquired the wakeref we do release it again. v2: add another missing "goto out_wf"(Andi). Fixes: 027c38b4121e ("drm/i915/selftests: Grab the runtime pm in shrink_thp") Cc: Andi Shyti Reviewed-by: Matthew Auld Reviewed-by: Andrzej Hajda Signed-off-by: Chris Wilson Signed-off-by: Nirmoy Das Reviewed-by: Andi Shyti Reviewed-by: Nirmoy Das Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230117123234.26487-1-nirmoy.das@intel.com (cherry picked from commit 14ec40a88210151296fff3e981c1a7196ad9bf55) Signed-off-by: Rodrigo Vivi commit 67b0b4ed259e425b7eed09da75b42c80682ca003 Author: Sasa Dragic Date: Mon Dec 19 18:29:27 2022 +0100 drm/i915: re-disable RC6p on Sandy Bridge RC6p on Sandy Bridge got re-enabled over time, causing visual glitches and GPU hangs. Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable RC6p on Sandy Bridge"). Signed-off-by: Sasa Dragic Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20221219172927.9603-2-sasa.dragic@gmail.com Fixes: fb6db0f5bf1d ("drm/i915: Remove unsafe i915.enable_rc6") Fixes: 13c5a577b342 ("drm/i915/gt: Select the deepest available parking mode for rc6") Cc: stable@vger.kernel.org Reviewed-by: Rodrigo Vivi (cherry picked from commit 0c8a6e9ea232c221976a0670256bd861408d9917) Signed-off-by: Rodrigo Vivi commit 3782c0d6edf658b71354a64d60aa7a296188fc90 Author: Pietro Borrello Date: Wed Jan 11 18:12:16 2023 +0000 HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play(). Fixes: 52cd7785f3cd ("HID: betop: add drivers/hid/hid-betopff.c") Signed-off-by: Pietro Borrello Signed-off-by: Jiri Kosina commit c1619ea22d9509cfbcf5c2c1cc65563179e9dc8e Merge: fcc4348adafe5 cc755b4377b05 Author: Mark Brown Date: Wed Jan 18 15:28:17 2023 +0000 ASoC: SOF: sof-audio: Fixes for widget prepare and Merge series from Peter Ujfalusi : This series contains one fix (first patch) followed by a nice to have safety belts in case we get a widget from topology which is not handled by SOF and will not have corresponding swidget associated with. commit b9fb10d131b8c84af9bb14e2078d5c63600c7dea Author: Eric Dumazet Date: Tue Jan 17 11:01:31 2023 +0000 l2tp: prevent lockdep issue in l2tp_tunnel_register() lockdep complains with the following lock/unlock sequence: lock_sock(sk); write_lock_bh(&sk->sk_callback_lock); [1] release_sock(sk); [2] write_unlock_bh(&sk->sk_callback_lock); We need to swap [1] and [2] to fix this issue. Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") Reported-by: syzbot+bbd35b345c7cab0d9a08@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@gmail.com/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3 Cc: Cong Wang Cc: Guillaume Nault Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller commit 4cb786180dfb5258ff3111181b5e4ecb1d4a297b Author: Mario Limonciello Date: Mon Jan 16 13:37:02 2023 -0600 gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU commit 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") changed the policy such that I2C touchpads may be able to wake up the system by default if the system is configured as such. However on Clevo NL5xRU there is a mistake in the ACPI tables that the TP_ATTN# signal connected to GPIO 9 is configured as ActiveLow and level triggered but connected to a pull up. As soon as the system suspends the touchpad loses power and then the system wakes up. To avoid this problem, introduce a quirk for this model that will prevent the wakeup capability for being set for GPIO 9. Fixes: 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") Reported-by: Werner Sembach Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1722#note_1720627 Co-developed-by: Werner Sembach Signed-off-by: Werner Sembach Signed-off-by: Mario Limonciello Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 0e3b175f079247f0d40d2ab695999c309d3a7498 Author: Mario Limonciello Date: Mon Jan 16 13:37:01 2023 -0600 gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI Using the `ignore_wake` quirk or module parameter doesn't work for any pin that has been specified in the _CRS instead of _AEI. Extend the `acpi_gpio_irq_is_wake` check to cover both places. Suggested-by: Raul Rangel Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1722#note_1722335 Signed-off-by: Mario Limonciello Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit d71ebe8114b4bf622804b810f5e274069060a174 Author: Jason Wang Date: Tue Jan 17 11:47:07 2023 +0800 virtio-net: correctly enable callback during start_xmit Commit a7766ef18b33("virtio_net: disable cb aggressively") enables virtqueue callback via the following statement: do { if (use_napi) virtqueue_disable_cb(sq->vq); free_old_xmit_skbs(sq, false); } while (use_napi && kick && unlikely(!virtqueue_enable_cb_delayed(sq->vq))); When NAPI is used and kick is false, the callback won't be enabled here. And when the virtqueue is about to be full, the tx will be disabled, but we still don't enable tx interrupt which will cause a TX hang. This could be observed when using pktgen with burst enabled. TO be consistent with the logic that tries to disable cb only for NAPI, fixing this by trying to enable delayed callback only when NAPI is enabled when the queue is about to be full. Fixes: a7766ef18b33 ("virtio_net: disable cb aggressively") Signed-off-by: Jason Wang Tested-by: Laurent Vivier Signed-off-by: David S. Miller commit 7b90f5a665acd46efbbfa677a3a3a18d01ad6487 Author: Robert Hancock Date: Mon Jan 16 15:41:33 2023 -0600 net: macb: fix PTP TX timestamp failure due to packet padding PTP TX timestamp handling was observed to be broken with this driver when using the raw Layer 2 PTP encapsulation. ptp4l was not receiving the expected TX timestamp after transmitting a packet, causing it to enter a failure state. The problem appears to be due to the way that the driver pads packets which are smaller than the Ethernet minimum of 60 bytes. If headroom space was available in the SKB, this caused the driver to move the data back to utilize it. However, this appears to cause other data references in the SKB to become inconsistent. In particular, this caused the ptp_one_step_sync function to later (in the TX completion path) falsely detect the packet as a one-step SYNC packet, even when it was not, which caused the TX timestamp to not be processed when it should be. Using the headroom for this purpose seems like an unnecessary complexity as this is not a hot path in the driver, and in most cases it appears that there is sufficient tailroom to not require using the headroom anyway. Remove this usage of headroom to prevent this inconsistency from occurring and causing other problems. Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") Signed-off-by: Robert Hancock Reviewed-by: Jacob Keller Tested-by: Claudiu Beznea # on SAMA7G5 Reviewed-by: Claudiu Beznea Signed-off-by: David S. Miller commit 3d9c07c4cfc06cf7927cd00c04dffd1165d03c53 Author: Athira Rajeev Date: Mon Jan 16 10:31:31 2023 +0530 perf test build-id: Fix test check for PE file Perf test "build id cache operations" fails for PE executable. Logs below from powerpc system. Same is observed on x86 as well. <<>> Adding 5a0fd882b53084224ba47b624c55a469 ./tests/shell/../pe-file.exe: Ok build id: 5a0fd882b53084224ba47b624c55a469 link: /tmp/perf.debug.w0V/.build-id/5a/0fd882b53084224ba47b624c55a469 file: /tmp/perf.debug.w0V/.build-id/5a/../../root//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf failed: file /tmp/perf.debug.w0V/.build-id/5a/../../root//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf does not exist test child finished with -1 ---- end ---- build id cache operations: FAILED! <<>> The test tries to do: <<>> mkdir /tmp/perf.debug.TeY1 perf --buildid-dir /tmp/perf.debug.TeY1 buildid-cache -v -a ./tests/shell/../pe-file.exe <<>> The option "--buildid-dir" sets the build id cache directory as /tmp/perf.debug.TeY1. The option given to buildid-cahe, ie "-a ./tests/shell/../pe-file.exe", is to add the pe-file.exe to the cache. The testcase, sets buildid-dir and adds the file: pe-file.exe to build id cache. To check if the command is run successfully, "check" function looks for presence of the file in buildid cache directory. But the check here expects the added file to be executable. Snippet below: <<>> if [ ! -x $file ]; then echo "failed: file ${file} does not exist" exit 1 fi <<>> The buildid test is done for sha1 binary, md5 binary and also for PE file. The first two binaries are created at runtime by compiling with "--build-id" option and hence the check for sha1/md5 test should use [ ! -x ]. But in case of PE file, the permission for this input file is rw-r--r-- Hence the file added to build id cache has same permissoin Original file: ls tests/pe-file.exe | xargs stat --printf "%n %A \n" tests/pe-file.exe -rw-r--r-- buildid cache file: ls /tmp/perf.debug.w0V/.build-id/5a/../../root//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf | xargs stat --printf "%n %A \n" /tmp/perf.debug.w0V/.build-id/5a/../../root//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf -rw-r--r-- Fix the test to match with the permission of original file in case of FE file. ie if the "tests/pe-file.exe" file is not having exec permission, just check for existence of the buildid file using [ ! -e ] Signed-off-by: Athira Jajeev Cc: Andi Kleen Cc: Disha Goel Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230116050131.17221-2-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3e134696215f45740ef0ccd0fd67f409cb5009cc Merge: 010a74f52203e c410cb974f2ba Author: David S. Miller Date: Wed Jan 18 13:45:06 2023 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Niera Ayuso says: ==================== The following patchset contains Netfilter fixes for net: 1) Fix syn-retransmits until initiator gives up when connection is re-used due to rst marked as invalid, from Florian Westphal. ==================== Signed-off-by: David S. Miller commit 4b21b3e7ef86aff7ff961bf28b2c17ee4204da16 Author: Athira Rajeev Date: Mon Jan 16 10:31:30 2023 +0530 perf buildid-cache: Fix the file mode with copyfile() while adding file to build-id cache The test "build id cache operations" fails on powerpc as below: Adding 5a0fd882b53084224ba47b624c55a469 ./tests/shell/../pe-file.exe: Ok build id: 5a0fd882b53084224ba47b624c55a469 link: /tmp/perf.debug.ZTu/.build-id/5a/0fd882b53084224ba47b624c55a469 file: /tmp/perf.debug.ZTu/.build-id/5a/../../root/linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf failed: file /tmp/perf.debug.ZTu/.build-id/5a/../../root/linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf does not exist test child finished with -1 ---- end ---- build id cache operations: FAILED! The failing test is when trying to add pe-file.exe to build id cache. 'perf buildid-cache' can be used to add/remove/manage files from the build-id cache. "-a" option is used to add a file to the build-id cache. Simple command to do so for a PE exe file: # ls -ltr tests/pe-file.exe -rw-r--r--. 1 root root 75595 Jan 10 23:35 tests/pe-file.exe The file is in home directory. # mkdir /tmp/perf.debug.TeY1 # perf --buildid-dir /tmp/perf.debug.TeY1 buildid-cache -v -a tests/pe-file.exe The above will create ".build-id" folder in build id directory, which is /tmp/perf.debug.TeY1. Also adds file to this folder under build id. Example: # ls -ltr /tmp/perf.debug.TeY1/.build-id/5a/0fd882b53084224ba47b624c55a469/ total 76 -rw-r--r--. 1 root root 0 Jan 11 00:38 probes -rwxr-xr-x. 1 root root 75595 Jan 11 00:38 elf We can see in the results that file mode for original file and file in build id directory is different. ie, build id file has executable permission whereas original file doesn’t have. The code path and function (build_id_cache__add to add a file to the cache is in "util/build-id.c". In build_id_cache__add() function, it first attempts to link the original file to destination cache folder. If linking the file fails (which can happen if the destination and source is on a different mount points), it will copy the file to destination. Here copyfile() routine explicitly uses mode as "755" and hence file in the destination will have executable permission. Code snippet: if (link(realname, filename) && errno != EEXIST && copyfile(name, filename)) strace logs: 172285 link("/home//linux/tools/perf/tests/pe-file.exe", "/tmp/perf.debug.TeY1/home//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/elf") = -1 EXDEV (Invalid cross-device link) 172285 newfstatat(AT_FDCWD, "tests/pe-file.exe", {st_mode=S_IFREG|0644, st_size=75595, ...}, 0) = 0 172285 openat(AT_FDCWD, "/tmp/perf.debug.TeY1/home//linux/tools/perf/tests/pe-file.exe/5a0fd882b53084224ba47b624c55a469/.elf.KbAnsl", O_RDWR|O_CREAT|O_EXCL, 0600) = 3 172285 fchmod(3, 0755) = 0 172285 openat(AT_FDCWD, "tests/pe-file.exe", O_RDONLY) = 4 172285 mmap(NULL, 75595, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7fffa5cd0000 172285 pwrite64(3, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 75595, 0) = 75595 Whereas if the link succeeds, it succeeds in the first attempt itself and the file in the build-id dir will have same permission as original file. Example, above uses /tmp. Instead if we use "--buildid-dir /home/build", linking will work here since mount points are same. Hence the destination file will not have executable permission. Since the testcase "tests/shell/buildid.sh" always looks for executable file, test fails in powerpc environment when test is run from /root. The patch adds a change in build_id_cache__add() to use copyfile_mode() which also passes the file’s original mode as argument. This way the destination file mode also will be same as original file. Signed-off-by: Athira Jajeev Cc: Andi Kleen Cc: Disha Goel Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230116050131.17221-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 85c44913969bd27f15229c39383da1291800d7e9 Author: Sohom Datta Date: Sun Dec 4 16:28:35 2022 +0530 perf expr: Prevent normalize() from reading into undefined memory in the expression lexer The current implementation does not account for a trailing backslash followed by a null-byte. If a null-byte is encountered following a backslash, normalize() will continue reading (and potentially writing) into garbage memory ignoring the EOS null-byte. Signed-off-by: Sohom Datta Acked-by: Ian Rogers Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221204105836.1012885-1-sohomdatta1+git@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit c905ecfbb8e5d54bbcdd2a1706b925baf1728cfe Author: Arnaldo Carvalho de Melo Date: Wed Jan 18 10:27:48 2023 -0300 tools headers: Syncronize linux/build_bug.h with the kernel sources To pick up the changes in: 07a368b3f55a79d3 ("bug: introduce ASSERT_STRUCT_OFFSET") This cset only introduces a build time assert macro, that may be useful at some point for tooling, for now it silences this perf build warning: Warning: Kernel ABI header at 'tools/include/linux/build_bug.h' differs from latest version at 'include/linux/build_bug.h' diff -u tools/include/linux/build_bug.h include/linux/build_bug.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Maxim Levitsky Cc: Namhyung Kim Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/Y8f0jqQFYDAOBkHx@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d352588bbc990ba51f925f124946c42e604c502e Author: Arnaldo Carvalho de Melo Date: Wed Jan 18 10:12:23 2023 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: b5f0de6df6dce8d6 ("net: dev: Convert sa_data to flexible array in struct sockaddr") That don't result in any changes in the tables generated from that header. This silences this perf build warning: Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h' diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Signed-off-by: Arnaldo Carvalho de Melo commit 8c51e8f4e9ec6b404a10c84055b8454eba9f42fb Author: Arnaldo Carvalho de Melo Date: Wed Jan 18 09:38:16 2023 -0300 tools headers arm64: Sync arm64's cputype.h with the kernel sources To get the changes in: decb17aeb8fa2148 ("KVM: arm64: vgic: Add Apple M2 cpus to the list of broken SEIS implementations") 07e39e60bbf0ccd5 ("arm64: Add Cortex-715 CPU part definition") 8ec8490a1950efec ("arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro") That addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/asm/cputype.h' differs from latest version at 'arch/arm64/include/asm/cputype.h' diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h Cc: Ali Saidi Cc: Anshuman Khandual Cc: Catalin Marinas Cc: D Scott Phillips Cc: German Gomez Cc: Leo Yan Cc: Marc Zyngier Cc: Will Deacon Link: http://lore.kernel.org/lkml/Y8fvEGCGn+227qW0@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7f2d4cdd2f32b66c452c958698fc287de4f68283 Author: Arnaldo Carvalho de Melo Date: Mon Jan 16 10:33:22 2023 -0300 tools kvm headers arm64: Update KVM header from the kernel sources To pick the changes from: 9cb1096f8590bc59 ("KVM: arm64: Enable ring-based dirty memory tracking") That doesn't result in any changes in tooling (built on a Libre Computer Firefly ROC-RK3399-PC-V1.1-A running Ubuntu 22.04), only addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Gavin Shan Cc: Ian Rogers Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/Y8fmIT5PIfGaZuwa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1417f59ac0b02130ee56c0c50794b9b257be3d17 Author: Hui Wang Date: Wed Nov 30 17:08:00 2022 +0800 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed. We already met the sdma_load_context() failure case and the log as below: [ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready ... In this case, the desc->bd will not be freed without this change. Signed-off-by: Hui Wang Reviewed-by: Sascha Hauer Link: https://lore.kernel.org/r/20221130090800.102035-1-hui.wang@canonical.com Signed-off-by: Vinod Koul commit cc755b4377b0520d594ae573497cf0824baea648 Author: Bard Liao Date: Wed Jan 18 12:12:55 2023 +0200 ASoC: SOF: keep prepare/unprepare widgets in sink path The existing code return when a widget doesn't need to prepare/unprepare. This will prevent widgets in the sink path from being prepared/unprepared. Cc: # 6.1 Link: https://github.com/thesofproject/linux/issues/4021 Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230118101255.29139-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 0ad84b11f2f8dd19d62d0b2ffd95ece897e6c3dc Author: Ranjani Sridharan Date: Wed Jan 18 12:12:54 2023 +0200 ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL Skip preparing/unpreparing widgets if the swidget pointer is NULL. This will be true in the case of virtual widgets in topology that were added for reusing the legacy HDA machine driver with SOF. Fixes: 9862dcf70245 ("ASoC: SOF: don't unprepare widget used other pipelines") Cc: # 6.1 Signed-off-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Reviewed-by: Rander Wang Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230118101255.29139-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 7d2a67e02549c4b1feaac4d8b4151bf46424a047 Author: Bard Liao Date: Wed Jan 18 12:12:53 2023 +0200 ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0 We should unprepare the widget if its use_count = 1. Fixes: 9862dcf70245 ("ASoC: SOF: don't unprepare widget used other pipelines") Cc: # 6.1 Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230118101255.29139-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit f3dc1b3b4750851a94212dba249703dd0e50bb20 Author: Koba Ko Date: Thu Dec 1 11:00:50 2022 +0800 dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko Reviewed-by: Jie Hai Test-by: Jie Hai Reviewed-by: Jerry Snitselaar Reviewed-by: Dave Jiang Tested-by: Joel Savitz Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 Author: Mohan Kumar Date: Mon Jan 2 12:18:44 2023 +0530 dmaengine: tegra210-adma: fix global intr clear The current global interrupt clear programming register offset was not correct. Fix the programming with right offset Fixes: ded1f3db4cd6 ("dmaengine: tegra210-adma: prepare for supporting newer Tegra chips") Cc: stable@vger.kernel.org Signed-off-by: Mohan Kumar Link: https://lore.kernel.org/r/20230102064844.31306-1-mkumard@nvidia.com Signed-off-by: Vinod Koul commit 57054fe516d59d03a7bcf1888e82479ccc244f87 Author: Shawn.Shao Date: Thu Jan 12 13:58:02 2023 +0800 Add exception protection processing for vd in axi_chan_handle_err function Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases. You can refer to the processing of axi_chan_block_xfer_complete function The triggered kernel panic is as follows: [ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.848449] ESR = 0x96000004 [ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits [ 67.848454] SET = 0, FnV = 0 [ 67.848456] EA = 0, S1PTW = 0 [ 67.848458] Data abort info: [ 67.848460] ISV = 0, ISS = 0x00000004 [ 67.848462] CM = 0, WnR = 0 [ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000 [ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000 [ 67.848472] Internal error: Oops: 96000004 [#1] SMP [ 67.848475] Modules linked in: dmatest [ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11 [ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--) [ 67.848487] pc : axi_chan_handle_err+0xc4/0x230 [ 67.848491] lr : axi_chan_handle_err+0x30/0x230 [ 67.848493] sp : ffff0803fe55ae50 [ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200 [ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080 [ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850 [ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000 [ 67.848512] x21: 0000000000000080 x20: 0000000000002000 [ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000 [ 67.848521] x17: 0000000000000000 x16: 0000000000000000 [ 67.848525] x15: 0000000000000000 x14: 0000000000000000 [ 67.848529] x13: 0000000000000000 x12: 0000000000000040 [ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a [ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270 [ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0 [ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480 [ 67.848550] x3 : dead000000000100 x2 : dead000000000122 [ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168 [ 67.848559] Call trace: [ 67.848562] axi_chan_handle_err+0xc4/0x230 [ 67.848566] dw_axi_dma_interrupt+0xf4/0x590 [ 67.848569] __handle_irq_event_percpu+0x60/0x220 [ 67.848573] handle_irq_event+0x64/0x120 [ 67.848576] handle_fasteoi_irq+0xc4/0x220 [ 67.848580] __handle_domain_irq+0x80/0xe0 [ 67.848583] gic_handle_irq+0xc0/0x138 [ 67.848585] el1_irq+0xc8/0x180 [ 67.848588] arch_cpu_idle+0x14/0x2c [ 67.848591] default_idle_call+0x40/0x16c [ 67.848594] do_idle+0x1f0/0x250 [ 67.848597] cpu_startup_entry+0x2c/0x60 [ 67.848600] rest_init+0xc0/0xcc [ 67.848603] arch_call_rest_init+0x14/0x1c [ 67.848606] start_kernel+0x4cc/0x500 [ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1) [ 67.848613] ---[ end trace 585a97036f88203a ]--- Signed-off-by: Shawn.Shao Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230112055802.1764-1-shawn.shao@jaguarmicro.com Signed-off-by: Vinod Koul commit 5a8a05f165fb18d37526062419774d9088c2a9b9 Author: Kan Liang Date: Fri Jan 6 08:04:47 2023 -0800 perf/x86/intel/cstate: Add Emerald Rapids From the perspective of Intel cstate residency counters, Emerald Rapids is the same as the Sapphire Rapids and Ice Lake. Add Emerald Rapids model. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230106160449.3566477-2-kan.liang@linux.intel.com commit 6795e558e9cc6123c24e2100a2ebe88e58a792bc Author: Kan Liang Date: Fri Jan 6 08:04:46 2023 -0800 perf/x86/intel: Add Emerald Rapids From core PMU's perspective, Emerald Rapids is the same as the Sapphire Rapids. The only difference is the event list, which will be supported in the perf tool later. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230106160449.3566477-1-kan.liang@linux.intel.com commit 6437a549ae178a3f5a5c03e983f291ebcdc2bbc7 Author: Arnd Bergmann Date: Tue Jan 17 17:44:43 2023 +0100 drm/panfrost: fix GENERIC_ATOMIC64 dependency On ARMv5 and earlier, a randconfig build can still run into WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE Depends on [n]: IOMMU_SUPPORT [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y]) && !GENERIC_ATOMIC64 [=y] Selected by [y]: - DRM_PANFROST [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y] && !GENERIC_ATOMIC64 [=y]) && MMU [=y] Rework the dependencies to always require a working cmpxchg64. Fixes: db594ba3fcf9 ("drm/panfrost: depend on !GENERIC_ATOMIC64 when using COMPILE_TEST") Signed-off-by: Arnd Bergmann Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20230117164456.1591901-1-arnd@kernel.org commit 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 Author: Peter Harliman Liem Date: Thu Jan 5 11:05:51 2023 +0800 dmaengine: lgm: Move DT parsing after initialization ldma_cfg_init() will parse DT to retrieve certain configs. However, that is called before ldma_dma_init_vXX(), which will make some initialization to channel configs. It will thus incorrectly overwrite certain configs that are declared in DT. To fix that, we move DT parsing after initialization. Function name is renamed to better represent what it does. Fixes: 32d31c79a1a4 ("dmaengine: Add Intel LGM SoC DMA support.") Signed-off-by: Peter Harliman Liem Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/afef6fc1ed20098b684e0d53737d69faf63c125f.1672887183.git.pliem@maxlinear.com Signed-off-by: Vinod Koul commit ccf1e1626d37745d0a697db67407beec9ae9d4b8 Author: Roderick Colenbrander Date: Thu Jan 5 17:59:08 2023 -0800 HID: playstation: sanity check DualSense calibration data. Make sure calibration values are defined to prevent potential kernel crashes. This fixes a hypothetical issue for virtual or clone devices inspired by a similar fix for DS4. Signed-off-by: Roderick Colenbrander Signed-off-by: Jiri Kosina commit 74cb485f68eb3dff6802ee446a602607b03f4fc9 Author: Roderick Colenbrander Date: Thu Jan 5 17:59:07 2023 -0800 HID: playstation: sanity check DualShock4 calibration data. Some DualShock4 devices report invalid calibration data resulting in kernel oopses due to division by zero during report handling. The devices affected generally appear to be clone devices, which don't implement all reports properly and don't populate proper calibration data. The issue may have been seen on an official device with erased calibration reports. This patch prevents the crashes by essentially disabling calibration when invalid values are detected. Signed-off-by: Roderick Colenbrander Tested-by: Alain Carlucci Signed-off-by: Jiri Kosina commit febb2c0d7c69c0396aa32d5ab425a4163473961a Author: José Expósito Date: Mon Dec 26 13:34:56 2022 +0100 HID: uclogic: Add support for XP-PEN Deco 01 V2 The XP-PEN Deco 01 V2 is a UGEE v2 device with a frame with 8 buttons. Its pen has 2 buttons, supports tilt and pressure. Add its ID in order to support the device. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/839 Tested-by: Mark Waddoups Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit e1fabbc83cb1dd4ba63932faa86c9cacb8bf791e Author: Ard Biesheuvel Date: Tue Jan 17 18:00:45 2023 +0100 efi: Remove Matthew Garrett as efivarfs maintainer Matthew Garrett is still listed as a efivarfs co-maintainer, but the email address bounces, and Matt is no longer involved in maintaining this code. So let's remove Matt as a efivarfs co-maintainer from MAINTAINERS. Thanks for all the hard work! Acked-by: Matthew Garrett Signed-off-by: Ard Biesheuvel commit 2c1e1b949024989e20907b84e11a731a50778416 Author: Randy Dunlap Date: Tue Aug 30 20:12:29 2022 -0700 net: mlx5: eliminate anonymous module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Randy Dunlap Cc: Eli Cohen Cc: Saeed Mahameed Cc: Leon Romanovsky Cc: linux-rdma@vger.kernel.org Reviewed-by: Ira Weiny Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 7c83d1f4c5adae9583e7fca1e3e830d6b061522d Author: Chris Mi Date: Wed Dec 21 11:14:37 2022 +0200 net/mlx5: E-switch, Fix switchdev mode after devlink reload The cited commit removes eswitch mode none. So after devlink reload in switchdev mode, eswitch mode is not changed. But actually eswitch is disabled during devlink reload. Fix it by setting eswitch mode to legacy when disabling eswitch which is called by reload_down. Fixes: f019679ea5f2 ("net/mlx5: E-switch, Remove dependency between sriov and eswitch mode") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit e4d38c454ae57e649f09a354d5a9dae063a26ee3 Author: Leon Romanovsky Date: Mon Jan 9 10:34:25 2023 +0200 net/mlx5e: Protect global IPsec ASO ASO operations are global to whole IPsec as they share one DMA address for all operations. As such all WQE operations need to be protected with lock. In this case, it must be spinlock to allow mlx5e_ipsec_aso_query() operate in atomic context. Fixes: 1ed78fc03307 ("net/mlx5e: Update IPsec soft and hard limits") Reviewed-by: Jianbo Liu Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 16bccbaa00b6127ed0ebfd77bd1f10341df8d498 Author: Leon Romanovsky Date: Mon Jan 9 10:43:13 2023 +0200 net/mlx5e: Remove optimization which prevented update of ESN state aso->use_cache variable introduced in commit 8c582ddfbb47 ("net/mlx5e: Handle hardware IPsec limits events") was an optimization to skip recurrent calls to mlx5e_ipsec_aso_query(). Such calls are possible when lifetime event is generated: -> mlx5e_ipsec_handle_event() -> mlx5e_ipsec_aso_query() - first call -> xfrm_state_check_expire() -> mlx5e_xfrm_update_curlft() -> mlx5e_ipsec_aso_query() - second call However, such optimization not really effective as mlx5e_ipsec_aso_query() is needed to be called for update ESN anyway, which was missed due to misplaced use_cache assignment. Fixes: cee137a63431 ("net/mlx5e: Handle ESN update events") Reviewed-by: Jianbo Liu Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit ffa99b534732f90077f346c62094cab3d1ccddce Author: Chris Mi Date: Thu Jan 12 04:30:27 2023 +0200 net/mlx5e: Set decap action based on attr for sample Currently decap action is set based on tunnel_id. That means it is set unconditionally. But for decap, ct and sample actions, decap is done before ct. No need to decap again in sample. And the actions are set correctly when parsing. So set decap action based on attr instead of tunnel_id. Fixes: 2741f2230905 ("net/mlx5e: TC, Support sample offload action for tunneled traffic") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 4ddf77f9bc76092d268bd3af447d60d9cc62b652 Author: Maor Dickman Date: Tue Dec 27 10:51:38 2022 +0200 net/mlx5e: QoS, Fix wrongfully setting parent_element_id on MODIFY_SCHEDULING_ELEMENT According to HW spec parent_element_id field should be reserved (0x0) when calling MODIFY_SCHEDULING_ELEMENT command. This patch remove the wrong initialization of reserved field, parent_element_id, on mlx5_qos_update_node. Fixes: 214baf22870c ("net/mlx5e: Support HTB offload") Signed-off-by: Maor Dickman Reviewed-by: Eli Cohen Signed-off-by: Saeed Mahameed commit f51471d1935ce1f504fce6c115ce3bfbc32032b0 Author: Maor Dickman Date: Tue Dec 27 10:22:41 2022 +0200 net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT According to HW spec element_type, element_attributes and parent_element_id fields should be reserved (0x0) when calling MODIFY_SCHEDULING_ELEMENT command. This patch remove initialization of these fields when calling the command. Fixes: bd77bf1cb595 ("net/mlx5: Add SRIOV VF max rate configuration support") Signed-off-by: Maor Dickman Reviewed-by: Eli Cohen Signed-off-by: Saeed Mahameed commit 6624bfeecf019de114f8100f1468d025d13b77a1 Author: Adham Faris Date: Thu Jan 12 11:15:00 2023 +0200 net/mlx5e: Remove redundant xsk pointer check in mlx5e_mpwrq_validate_xsk This validation function is relevant only for XSK cases, hence it assumes to be called only with xsk != NULL. Thus checking for invalid xsk pointer is redundant and misleads static code analyzers. This commit removes redundant xsk pointer check. This solves the following smatch warning: drivers/net/ethernet/mellanox/mlx5/core/en/params.c:481 mlx5e_mpwrq_validate_xsk() error: we previously assumed 'xsk' could be null (see line 478) Fixes: 6470d2e7e8ed ("net/mlx5e: xsk: Use KSM for unaligned XSK") Signed-off-by: Adham Faris Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 5aa56105930374928d567744595fd7ac525d0688 Author: Vlad Buslov Date: Thu Dec 15 16:44:33 2022 +0100 net/mlx5e: Avoid false lock dependency warning on tc_ht even more The cited commit changed class of tc_ht internal mutex in order to avoid false lock dependency with fs_core node and flow_table hash table structures. However, hash table implementation internally also includes a workqueue task with its own lockdep map which causes similar bogus lockdep splat[0]. Fix it by also adding dedicated class for hash table workqueue work structure of tc_ht. [0]: [ 1139.672465] ====================================================== [ 1139.673552] WARNING: possible circular locking dependency detected [ 1139.674635] 6.1.0_for_upstream_debug_2022_12_12_17_02 #1 Not tainted [ 1139.675734] ------------------------------------------------------ [ 1139.676801] modprobe/5998 is trying to acquire lock: [ 1139.677726] ffff88811e7b93b8 (&node->lock){++++}-{3:3}, at: down_write_ref_node+0x7c/0xe0 [mlx5_core] [ 1139.679662] but task is already holding lock: [ 1139.680703] ffff88813c1f96a0 (&tc_ht_lock_key){+.+.}-{3:3}, at: rhashtable_free_and_destroy+0x38/0x6f0 [ 1139.682223] which lock already depends on the new lock. [ 1139.683640] the existing dependency chain (in reverse order) is: [ 1139.684887] -> #2 (&tc_ht_lock_key){+.+.}-{3:3}: [ 1139.685975] __mutex_lock+0x12c/0x14b0 [ 1139.686659] rht_deferred_worker+0x35/0x1540 [ 1139.687405] process_one_work+0x7c2/0x1310 [ 1139.688134] worker_thread+0x59d/0xec0 [ 1139.688820] kthread+0x28f/0x330 [ 1139.689444] ret_from_fork+0x1f/0x30 [ 1139.690106] -> #1 ((work_completion)(&ht->run_work)){+.+.}-{0:0}: [ 1139.691250] __flush_work+0xe8/0x900 [ 1139.691915] __cancel_work_timer+0x2ca/0x3f0 [ 1139.692655] rhashtable_free_and_destroy+0x22/0x6f0 [ 1139.693472] del_sw_flow_table+0x22/0xb0 [mlx5_core] [ 1139.694592] tree_put_node+0x24c/0x450 [mlx5_core] [ 1139.695686] tree_remove_node+0x6e/0x100 [mlx5_core] [ 1139.696803] mlx5_destroy_flow_table+0x187/0x690 [mlx5_core] [ 1139.698017] mlx5e_tc_nic_cleanup+0x2f8/0x400 [mlx5_core] [ 1139.699217] mlx5e_cleanup_nic_rx+0x2b/0x210 [mlx5_core] [ 1139.700397] mlx5e_detach_netdev+0x19d/0x2b0 [mlx5_core] [ 1139.701571] mlx5e_suspend+0xdb/0x140 [mlx5_core] [ 1139.702665] mlx5e_remove+0x89/0x190 [mlx5_core] [ 1139.703756] auxiliary_bus_remove+0x52/0x70 [ 1139.704492] device_release_driver_internal+0x3c1/0x600 [ 1139.705360] bus_remove_device+0x2a5/0x560 [ 1139.706080] device_del+0x492/0xb80 [ 1139.706724] mlx5_rescan_drivers_locked+0x194/0x6a0 [mlx5_core] [ 1139.707961] mlx5_unregister_device+0x7a/0xa0 [mlx5_core] [ 1139.709138] mlx5_uninit_one+0x5f/0x160 [mlx5_core] [ 1139.710252] remove_one+0xd1/0x160 [mlx5_core] [ 1139.711297] pci_device_remove+0x96/0x1c0 [ 1139.722721] device_release_driver_internal+0x3c1/0x600 [ 1139.723590] unbind_store+0x1b1/0x200 [ 1139.724259] kernfs_fop_write_iter+0x348/0x520 [ 1139.725019] vfs_write+0x7b2/0xbf0 [ 1139.725658] ksys_write+0xf3/0x1d0 [ 1139.726292] do_syscall_64+0x3d/0x90 [ 1139.726942] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 1139.727769] -> #0 (&node->lock){++++}-{3:3}: [ 1139.728698] __lock_acquire+0x2cf5/0x62f0 [ 1139.729415] lock_acquire+0x1c1/0x540 [ 1139.730076] down_write+0x8e/0x1f0 [ 1139.730709] down_write_ref_node+0x7c/0xe0 [mlx5_core] [ 1139.731841] mlx5_del_flow_rules+0x6f/0x610 [mlx5_core] [ 1139.732982] __mlx5_eswitch_del_rule+0xdd/0x560 [mlx5_core] [ 1139.734207] mlx5_eswitch_del_offloaded_rule+0x14/0x20 [mlx5_core] [ 1139.735491] mlx5e_tc_rule_unoffload+0x104/0x2b0 [mlx5_core] [ 1139.736716] mlx5e_tc_unoffload_fdb_rules+0x10c/0x1f0 [mlx5_core] [ 1139.738007] mlx5e_tc_del_fdb_flow+0xc3c/0xfa0 [mlx5_core] [ 1139.739213] mlx5e_tc_del_flow+0x146/0xa20 [mlx5_core] [ 1139.740377] _mlx5e_tc_del_flow+0x38/0x60 [mlx5_core] [ 1139.741534] rhashtable_free_and_destroy+0x3be/0x6f0 [ 1139.742351] mlx5e_tc_ht_cleanup+0x1b/0x30 [mlx5_core] [ 1139.743512] mlx5e_cleanup_rep_tx+0x4a/0xe0 [mlx5_core] [ 1139.744683] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] [ 1139.745860] mlx5e_netdev_change_profile+0xd9/0x1c0 [mlx5_core] [ 1139.747098] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] [ 1139.748372] mlx5e_vport_rep_unload+0x16a/0x1b0 [mlx5_core] [ 1139.749590] __esw_offloads_unload_rep+0xb1/0xd0 [mlx5_core] [ 1139.750813] mlx5_eswitch_unregister_vport_reps+0x409/0x5f0 [mlx5_core] [ 1139.752147] mlx5e_rep_remove+0x62/0x80 [mlx5_core] [ 1139.753293] auxiliary_bus_remove+0x52/0x70 [ 1139.754028] device_release_driver_internal+0x3c1/0x600 [ 1139.754885] driver_detach+0xc1/0x180 [ 1139.755553] bus_remove_driver+0xef/0x2e0 [ 1139.756260] auxiliary_driver_unregister+0x16/0x50 [ 1139.757059] mlx5e_rep_cleanup+0x19/0x30 [mlx5_core] [ 1139.758207] mlx5e_cleanup+0x12/0x30 [mlx5_core] [ 1139.759295] mlx5_cleanup+0xc/0x49 [mlx5_core] [ 1139.760384] __x64_sys_delete_module+0x2b5/0x450 [ 1139.761166] do_syscall_64+0x3d/0x90 [ 1139.761827] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 1139.762663] other info that might help us debug this: [ 1139.763925] Chain exists of: &node->lock --> (work_completion)(&ht->run_work) --> &tc_ht_lock_key [ 1139.765743] Possible unsafe locking scenario: [ 1139.766688] CPU0 CPU1 [ 1139.767399] ---- ---- [ 1139.768111] lock(&tc_ht_lock_key); [ 1139.768704] lock((work_completion)(&ht->run_work)); [ 1139.769869] lock(&tc_ht_lock_key); [ 1139.770770] lock(&node->lock); [ 1139.771326] *** DEADLOCK *** [ 1139.772345] 2 locks held by modprobe/5998: [ 1139.772994] #0: ffff88813c1ff0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x8d/0x600 [ 1139.774399] #1: ffff88813c1f96a0 (&tc_ht_lock_key){+.+.}-{3:3}, at: rhashtable_free_and_destroy+0x38/0x6f0 [ 1139.775822] stack backtrace: [ 1139.776579] CPU: 3 PID: 5998 Comm: modprobe Not tainted 6.1.0_for_upstream_debug_2022_12_12_17_02 #1 [ 1139.777935] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 1139.779529] Call Trace: [ 1139.779992] [ 1139.780409] dump_stack_lvl+0x57/0x7d [ 1139.781015] check_noncircular+0x278/0x300 [ 1139.781687] ? print_circular_bug+0x460/0x460 [ 1139.782381] ? rcu_read_lock_sched_held+0x3f/0x70 [ 1139.783121] ? lock_release+0x487/0x7c0 [ 1139.783759] ? orc_find.part.0+0x1f1/0x330 [ 1139.784423] ? mark_lock.part.0+0xef/0x2fc0 [ 1139.785091] __lock_acquire+0x2cf5/0x62f0 [ 1139.785754] ? register_lock_class+0x18e0/0x18e0 [ 1139.786483] lock_acquire+0x1c1/0x540 [ 1139.787093] ? down_write_ref_node+0x7c/0xe0 [mlx5_core] [ 1139.788195] ? lockdep_hardirqs_on_prepare+0x3f0/0x3f0 [ 1139.788978] ? register_lock_class+0x18e0/0x18e0 [ 1139.789715] down_write+0x8e/0x1f0 [ 1139.790292] ? down_write_ref_node+0x7c/0xe0 [mlx5_core] [ 1139.791380] ? down_write_killable+0x220/0x220 [ 1139.792080] ? find_held_lock+0x2d/0x110 [ 1139.792713] down_write_ref_node+0x7c/0xe0 [mlx5_core] [ 1139.793795] mlx5_del_flow_rules+0x6f/0x610 [mlx5_core] [ 1139.794879] __mlx5_eswitch_del_rule+0xdd/0x560 [mlx5_core] [ 1139.796032] ? __esw_offloads_unload_rep+0xd0/0xd0 [mlx5_core] [ 1139.797227] ? xa_load+0x11a/0x200 [ 1139.797800] ? __xa_clear_mark+0xf0/0xf0 [ 1139.798438] mlx5_eswitch_del_offloaded_rule+0x14/0x20 [mlx5_core] [ 1139.799660] mlx5e_tc_rule_unoffload+0x104/0x2b0 [mlx5_core] [ 1139.800821] mlx5e_tc_unoffload_fdb_rules+0x10c/0x1f0 [mlx5_core] [ 1139.802049] ? mlx5_eswitch_get_uplink_priv+0x25/0x80 [mlx5_core] [ 1139.803260] mlx5e_tc_del_fdb_flow+0xc3c/0xfa0 [mlx5_core] [ 1139.804398] ? __cancel_work_timer+0x1c2/0x3f0 [ 1139.805099] ? mlx5e_tc_unoffload_from_slow_path+0x460/0x460 [mlx5_core] [ 1139.806387] mlx5e_tc_del_flow+0x146/0xa20 [mlx5_core] [ 1139.807481] _mlx5e_tc_del_flow+0x38/0x60 [mlx5_core] [ 1139.808564] rhashtable_free_and_destroy+0x3be/0x6f0 [ 1139.809336] ? mlx5e_tc_del_flow+0xa20/0xa20 [mlx5_core] [ 1139.809336] ? mlx5e_tc_del_flow+0xa20/0xa20 [mlx5_core] [ 1139.810455] mlx5e_tc_ht_cleanup+0x1b/0x30 [mlx5_core] [ 1139.811552] mlx5e_cleanup_rep_tx+0x4a/0xe0 [mlx5_core] [ 1139.812655] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] [ 1139.813768] mlx5e_netdev_change_profile+0xd9/0x1c0 [mlx5_core] [ 1139.814952] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] [ 1139.816166] mlx5e_vport_rep_unload+0x16a/0x1b0 [mlx5_core] [ 1139.817336] __esw_offloads_unload_rep+0xb1/0xd0 [mlx5_core] [ 1139.818507] mlx5_eswitch_unregister_vport_reps+0x409/0x5f0 [mlx5_core] [ 1139.819788] ? mlx5_eswitch_uplink_get_proto_dev+0x30/0x30 [mlx5_core] [ 1139.821051] ? kernfs_find_ns+0x137/0x310 [ 1139.821705] mlx5e_rep_remove+0x62/0x80 [mlx5_core] [ 1139.822778] auxiliary_bus_remove+0x52/0x70 [ 1139.823449] device_release_driver_internal+0x3c1/0x600 [ 1139.824240] driver_detach+0xc1/0x180 [ 1139.824842] bus_remove_driver+0xef/0x2e0 [ 1139.825504] auxiliary_driver_unregister+0x16/0x50 [ 1139.826245] mlx5e_rep_cleanup+0x19/0x30 [mlx5_core] [ 1139.827322] mlx5e_cleanup+0x12/0x30 [mlx5_core] [ 1139.828345] mlx5_cleanup+0xc/0x49 [mlx5_core] [ 1139.829382] __x64_sys_delete_module+0x2b5/0x450 [ 1139.830119] ? module_flags+0x300/0x300 [ 1139.830750] ? task_work_func_match+0x50/0x50 [ 1139.831440] ? task_work_cancel+0x20/0x20 [ 1139.832088] ? lockdep_hardirqs_on_prepare+0x273/0x3f0 [ 1139.832873] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1139.833661] ? trace_hardirqs_on+0x2d/0x100 [ 1139.834328] do_syscall_64+0x3d/0x90 [ 1139.834922] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 1139.835700] RIP: 0033:0x7f153e71288b [ 1139.836302] Code: 73 01 c3 48 8b 0d 9d 75 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6d 75 0e 00 f7 d8 64 89 01 48 [ 1139.838866] RSP: 002b:00007ffe0a3ed938 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 1139.840020] RAX: ffffffffffffffda RBX: 0000564c2cbf8220 RCX: 00007f153e71288b [ 1139.841043] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000564c2cbf8288 [ 1139.842072] RBP: 0000564c2cbf8220 R08: 0000000000000000 R09: 0000000000000000 [ 1139.843094] R10: 00007f153e7a3ac0 R11: 0000000000000206 R12: 0000564c2cbf8288 [ 1139.844118] R13: 0000000000000000 R14: 0000564c2cbf7ae8 R15: 00007ffe0a3efcb8 Fixes: 9ba33339c043 ("net/mlx5e: Avoid false lock depenency warning on tc_ht") Signed-off-by: Vlad Buslov Reviewed-by: Eli Cohen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 90e7cb78b81543998217b0eb446c067ce2191a79 Author: Yang Yingliang Date: Thu Jan 5 19:42:20 2023 +0800 net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() Add missing mutex_unlock() before returning from mlx5_fw_fatal_reporter_err_work(). Fixes: 9078e843efec ("net/mlx5: Avoid recovery in probe flows") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Yang Yingliang Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed commit 13e1df09284da53ae5abdd3364c36caf8f0f8916 Author: Thomas Weißschuh Date: Tue Jan 17 05:30:43 2023 +0000 kheaders: explicitly validate existence of cpio command If the cpio command is not available the error emitted by gen_kheaders.so is not clear as all output of the call to cpio is discarded: GNU make 4.4: GEN kernel/kheaders_data.tar.xz find: 'standard output': Broken pipe find: write error make[2]: *** [kernel/Makefile:157: kernel/kheaders_data.tar.xz] Error 127 make[1]: *** [scripts/Makefile.build:504: kernel] Error 2 GNU make < 4.4: GEN kernel/kheaders_data.tar.xz make[2]: *** [kernel/Makefile:157: kernel/kheaders_data.tar.xz] Error 127 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [scripts/Makefile.build:504: kernel] Error 2 Add an explicit check that will trigger a clear message about the issue: CHK kernel/kheaders_data.tar.xz ./kernel/gen_kheaders.sh: line 17: type: cpio: not found The other commands executed by gen_kheaders.sh are part of a standard installation, so they are not checked. Reported-by: Amy Parker Link: https://lore.kernel.org/lkml/CAPOgqxFva=tOuh1UitCSN38+28q3BNXKq19rEsVNPRzRqKqZ+g@mail.gmail.com/ Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 010a74f52203eae037dd6aa111ba371f6a2dedc5 Merge: 423c1d363c465 1d80d57ffcb55 Author: Jakub Kicinski Date: Tue Jan 17 19:19:00 2023 -0800 Merge tag 'for-net-2023-01-17' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix a buffer overflow in mgmt_mesh_add - Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 - Fix hci_qca shutdown on closed serdev - Fix possible circular locking dependencies on ISO code - Fix possible deadlock in rfcomm_sk_state_change * tag 'for-net-2023-01-17' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change Bluetooth: ISO: Fix possible circular locking dependency Bluetooth: hci_event: Fix Invalid wait context Bluetooth: ISO: Fix possible circular locking dependency Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() Bluetooth: hci_qca: Fix driver shutdown on closed serdev Bluetooth: hci_conn: Fix memory leaks Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 Bluetooth: Fix a buffer overflow in mgmt_mesh_add() ==================== Link: https://lore.kernel.org/r/20230118002944.1679845-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 423c1d363c4659fcaca321bcb5217c8f1e7efeba Merge: 441717b6fdf2f e4f4db47794c9 Author: Jakub Kicinski Date: Tue Jan 17 19:13:02 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== bpf 2023-01-16 We've added 6 non-merge commits during the last 8 day(s) which contain a total of 6 files changed, 22 insertions(+), 24 deletions(-). The main changes are: 1) Mitigate a Spectre v4 leak in unprivileged BPF from speculative pointer-as-scalar type confusion, from Luis Gerhorst. 2) Fix a splat when pid 1 attaches a BPF program that attempts to send killing signal to itself, from Hao Sun. 3) Fix BPF program ID information in BPF_AUDIT_UNLOAD as well as PERF_BPF_EVENT_PROG_UNLOAD events, from Paul Moore. 4) Fix BPF verifier warning triggered from invalid kfunc call in backtrack_insn, also from Hao Sun. 5) Fix potential deadlock in htab_lock_bucket from same bucket index but different map_locked index, from Tonghao Zhang. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation bpf: hash map, avoid deadlock with suitable hash mask bpf: remove the do_idr_lock parameter from bpf_prog_free_id() bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD bpf: Skip task with pid=1 in send_signal_common() bpf: Skip invalid kfunc call in backtrack_insn ==================== Link: https://lore.kernel.org/r/20230116230745.21742-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 441717b6fdf2f620475b5e410f73d55154bb6f30 Author: Shyam Sundar S K Date: Mon Jan 16 14:20:15 2023 +0530 MAINTAINERS: Update AMD XGBE driver maintainers Due to other additional responsibilities Tom would no longer be able to support AMD XGBE driver. Cc: Tom Lendacky Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230116085015.443127-1-Shyam-sundar.S-k@amd.com Signed-off-by: Jakub Kicinski commit 9ec9b2a30853ba843b70ea16f196e5fe3327be5f Author: Caleb Connolly Date: Sun Jan 15 17:59:24 2023 +0000 net: ipa: disable ipa interrupt during suspend The IPA interrupt can fire when pm_runtime is disabled due to it racing with the PM suspend/resume code. This causes a splat in the interrupt handler when it tries to call pm_runtime_get(). Explicitly disable the interrupt in our ->suspend callback, and re-enable it in ->resume to avoid this. If there is an interrupt pending it will be handled after resuming. The interrupt is a wake_irq, as a result even when disabled if it fires it will cause the system to wake from suspend as well as cancel any suspend transition that may be in progress. If there is an interrupt pending, the ipa_isr_thread handler will be called after resuming. Fixes: 1aac309d3207 ("net: ipa: use autosuspend") Signed-off-by: Caleb Connolly Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/20230115175925.465918-1-caleb.connolly@linaro.org Signed-off-by: Jakub Kicinski commit 1d80d57ffcb55488f0ec0b77928d4f82d16b6a90 Author: Ying Hsu Date: Wed Jan 11 03:16:14 2023 +0000 Bluetooth: Fix possible deadlock in rfcomm_sk_state_change syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lock and waits for the rfcomm lock, rfcomm_sock_release could have the rfcomm lock and hit a deadlock for acquiring the sk lock. Here's a simplified flow: rfcomm_sock_connect: lock_sock(sk) rfcomm_dlc_open: rfcomm_lock() rfcomm_sock_release: rfcomm_sock_shutdown: rfcomm_lock() __rfcomm_dlc_close: rfcomm_k_state_change: lock_sock(sk) This patch drops the sk lock before calling rfcomm_dlc_open to avoid the possible deadlock and holds sk's reference count to prevent use-after-free after rfcomm_dlc_open completes. Reported-by: syzbot+d7ce59...@syzkaller.appspotmail.com Fixes: 1804fdf6e494 ("Bluetooth: btintel: Combine setting up MSFT extension") Link: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218 [1] Signed-off-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz commit 506d9b4099a0ce8249bba16b4d0b828fdcf69d9a Author: Luiz Augusto von Dentz Date: Tue Jan 10 17:18:13 2023 -0800 Bluetooth: ISO: Fix possible circular locking dependency This attempts to fix the following trace: iso-tester/52 is trying to acquire lock: ffff8880024e0070 (&hdev->lock){+.+.}-{3:3}, at: iso_sock_listen+0x29e/0x440 but task is already holding lock: ffff888001978130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: iso_sock_listen+0x8b/0x440 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: lock_acquire+0x176/0x3d0 lock_sock_nested+0x32/0x80 iso_connect_cfm+0x1a3/0x630 hci_cc_le_setup_iso_path+0x195/0x340 hci_cmd_complete_evt+0x1ae/0x500 hci_event_packet+0x38e/0x7c0 hci_rx_work+0x34c/0x980 process_one_work+0x5a5/0x9a0 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x22/0x30 -> #1 (hci_cb_list_lock){+.+.}-{3:3}: lock_acquire+0x176/0x3d0 __mutex_lock+0x13b/0xf50 hci_le_remote_feat_complete_evt+0x17e/0x320 hci_event_packet+0x38e/0x7c0 hci_rx_work+0x34c/0x980 process_one_work+0x5a5/0x9a0 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x22/0x30 -> #0 (&hdev->lock){+.+.}-{3:3}: check_prev_add+0xfc/0x1190 __lock_acquire+0x1e27/0x2750 lock_acquire+0x176/0x3d0 __mutex_lock+0x13b/0xf50 iso_sock_listen+0x29e/0x440 __sys_listen+0xe6/0x160 __x64_sys_listen+0x25/0x30 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x62/0xcc other info that might help us debug this: Chain exists of: &hdev->lock --> hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_ISO Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); lock(&hdev->lock); *** DEADLOCK *** 1 lock held by iso-tester/52: #0: ffff888001978130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: iso_sock_listen+0x8b/0x440 Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Luiz Augusto von Dentz commit e9d50f76fe1f7f6f251114919247445fb5cb3734 Author: Luiz Augusto von Dentz Date: Tue Jan 10 17:04:46 2023 -0800 Bluetooth: hci_event: Fix Invalid wait context This fixes the following trace caused by attempting to lock cmd_sync_work_lock while holding the rcu_read_lock: kworker/u3:2/212 is trying to lock: ffff888002600910 (&hdev->cmd_sync_work_lock){+.+.}-{3:3}, at: hci_cmd_sync_queue+0xad/0x140 other info that might help us debug this: context-{4:4} 4 locks held by kworker/u3:2/212: #0: ffff8880028c6530 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x4dc/0x9a0 #1: ffff888001aafde0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x4dc/0x9a0 #2: ffff888002600070 (&hdev->lock){+.+.}-{3:3}, at: hci_cc_le_set_cig_params+0x64/0x4f0 #3: ffffffffa5994b00 (rcu_read_lock){....}-{1:2}, at: hci_cc_le_set_cig_params+0x2f9/0x4f0 Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Luiz Augusto von Dentz commit 6a5ad251b7cdb990a3705428aef408433f05614a Author: Luiz Augusto von Dentz Date: Tue Jan 10 13:24:51 2023 -0800 Bluetooth: ISO: Fix possible circular locking dependency This attempts to fix the following trace: kworker/u3:1/184 is trying to acquire lock: ffff888001888130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: iso_connect_cfm+0x2de/0x690 but task is already holding lock: ffff8880028d1c20 (&conn->lock){+.+.}-{2:2}, at: iso_connect_cfm+0x265/0x690 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&conn->lock){+.+.}-{2:2}: lock_acquire+0x176/0x3d0 _raw_spin_lock+0x2a/0x40 __iso_sock_close+0x1dd/0x4f0 iso_sock_release+0xa0/0x1b0 sock_close+0x5e/0x120 __fput+0x102/0x410 task_work_run+0xf1/0x160 exit_to_user_mode_prepare+0x170/0x180 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x4e/0x90 entry_SYSCALL_64_after_hwframe+0x62/0xcc -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: check_prev_add+0xfc/0x1190 __lock_acquire+0x1e27/0x2750 lock_acquire+0x176/0x3d0 lock_sock_nested+0x32/0x80 iso_connect_cfm+0x2de/0x690 hci_cc_le_setup_iso_path+0x195/0x340 hci_cmd_complete_evt+0x1ae/0x500 hci_event_packet+0x38e/0x7c0 hci_rx_work+0x34c/0x980 process_one_work+0x5a5/0x9a0 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x22/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&conn->lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); lock(&conn->lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); *** DEADLOCK *** Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Luiz Augusto von Dentz commit 1ed8b37cbaf14574c779064ef1372af62e8ba6aa Author: Zhengchao Shao Date: Mon Jan 9 09:26:51 2023 +0800 Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR to pass the instance to callback so no memory needs to be allocated. Fixes: 651cd3d65b0f ("Bluetooth: convert hci_update_adv_data to hci_sync") Signed-off-by: Zhengchao Shao Signed-off-by: Luiz Augusto von Dentz commit 272970be3dabd24cbe50e393ffee8f04aec3b9a8 Author: Krzysztof Kozlowski Date: Thu Dec 29 11:28:29 2022 +0100 Bluetooth: hci_qca: Fix driver shutdown on closed serdev The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also skip this step if device is powered off (qca_power_shutdown()). The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth: Unable to handle kernel paging request at virtual address 0072662f67726fd7 ... CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: tty_driver_flush_buffer+0x4/0x30 serdev_device_write_flush+0x24/0x34 qca_serdev_shutdown+0x80/0x130 [hci_uart] device_shutdown+0x15c/0x260 kernel_restart+0x48/0xac KASAN report: BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50 Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1 CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xdc/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x68/0x84 print_report+0x188/0x488 kasan_report+0xa4/0xf0 __asan_load8+0x80/0xac tty_driver_flush_buffer+0x1c/0x50 ttyport_write_flush+0x34/0x44 serdev_device_write_flush+0x48/0x60 qca_serdev_shutdown+0x124/0x274 device_shutdown+0x1e8/0x350 kernel_restart+0x48/0xb0 __do_sys_reboot+0x244/0x2d0 __arm64_sys_reboot+0x54/0x70 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x44/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xbc/0x140 el0t_64_sync+0x190/0x194 Fixes: 7e7bbddd029b ("Bluetooth: hci_qca: Fix qca6390 enable failure after warm reboot") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 3aa21311f36d8a2730c7ccef37235e951f23927b Author: Zhengchao Shao Date: Wed Jan 4 14:46:23 2023 +0800 Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failed in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Zhengchao Shao Signed-off-by: Luiz Augusto von Dentz commit 3a4d29b6d631bb00236a98887e1039bbfc1b6ab5 Author: Luiz Augusto von Dentz Date: Mon Dec 19 13:32:51 2022 -0800 Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 Don't try to use HCI_OP_LE_READ_BUFFER_SIZE_V2 if controller don't support ISO channels, but in order to check if ISO channels are supported HCI_OP_LE_READ_LOCAL_FEATURES needs to be done earlier so the features bits can be checked on hci_le_read_buffer_size_sync. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216817 Fixes: c1631dbc00c1 ("Bluetooth: hci_sync: Fix hci_read_buffer_size_sync") Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Luiz Augusto von Dentz commit 2185e0fdbb2137f22a9dd9fcbf6481400d56299b Author: Harshit Mogalapalli Date: Mon Dec 12 05:08:28 2022 -0800 Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50) Analysis: 'mesh_tx->param' is array of size 48. This is the destination. u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48. But in the caller 'mesh_send' we reject only when len > 50. len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50. Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Signed-off-by: Harshit Mogalapalli Signed-off-by: Brian Gix Signed-off-by: Luiz Augusto von Dentz commit c410cb974f2ba562920ecb8492ee66945dcf88af Author: Florian Westphal Date: Wed Jan 11 14:42:32 2023 +0100 netfilter: conntrack: handle tcp challenge acks during connection reuse When a connection is re-used, following can happen: [ connection starts to close, fin sent in either direction ] > syn # initator quickly reuses connection < ack # peer sends a challenge ack > rst # rst, sequence number == ack_seq of previous challenge ack > syn # this syn is expected to pass Problem is that the rst will fail window validation, so it gets tagged as invalid. If ruleset drops such packets, we get repeated syn-retransmits until initator gives up or peer starts responding with syn/ack. Before the commit indicated in the "Fixes" tag below this used to work: The challenge-ack made conntrack re-init state based on the challenge ack itself, so the following rst would pass window validation. Add challenge-ack support: If we get ack for syn, record the ack_seq, and then check if the rst sequence number matches the last ack number seen in reverse direction. Fixes: c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets only") Reported-by: Michal Tesar Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ac8f29aef2f1695956ff6773b33f975290437f29 Author: Jason Gunthorpe Date: Tue Jan 17 15:16:17 2023 -0400 genirq/msi: Free the fwnode created by msi_create_device_irq_domain() msi_create_device_irq_domain() creates a firmware node for the new domain, which is never freed. kmemleak reports: unreferenced object 0xffff888120ba9a00 (size 96): comm "systemd-modules", pid 221, jiffies 4294893411 (age 635.732s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 e0 19 8b 83 ff ff ff ff ................ 00 00 00 00 00 00 00 00 18 9a ba 20 81 88 ff ff ........... .... backtrace: [<000000008cdbc98d>] __irq_domain_alloc_fwnode+0x51/0x2b0 [<00000000c57acf9d>] msi_create_device_irq_domain+0x283/0x670 [<000000009b567982>] __pci_enable_msix_range+0x49e/0xdb0 [<0000000077cc1445>] pci_alloc_irq_vectors_affinity+0x11f/0x1c0 [<00000000532e9ef5>] mlx5_irq_table_create+0x24c/0x940 [mlx5_core] [<00000000fabd2b80>] mlx5_load+0x1fa/0x680 [mlx5_core] [<000000006bb22ae4>] mlx5_init_one+0x485/0x670 [mlx5_core] [<00000000eaa5e1ad>] probe_one+0x4c2/0x720 [mlx5_core] [<00000000df8efb43>] local_pci_probe+0xd6/0x170 [<0000000085cb9924>] pci_device_probe+0x231/0x6e0 Use the proper free operation for the firmware wnode so the name is freed during error unwind of msi_create_device_irq_domain() and also free the node in msi_remove_device_irq_domain() if it was automatically allocated. To avoid extra NULL pointer checks make irq_domain_free_fwnode() tolerant of NULL. Fixes: 27a6dea3ebaa ("genirq/msi: Provide msi_create/free_device_irq_domain()") Reported-by: Omri Barazi Signed-off-by: Jason Gunthorpe Signed-off-by: Thomas Gleixner Tested-by: Kalle Valo Tested-by: Leon Romanovsky Link: https://lore.kernel.org/r/0-v2-24af6665e2da+c9-msi_leak_jgg@nvidia.com commit effa76856f2d7111f8c44de49f15ebdfccea8ccc Author: Arnaldo Carvalho de Melo Date: Mon Jan 16 10:22:13 2023 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: 8aff460f216753d8 ("KVM: x86: Add a VALID_MASK for the flags in kvm_msr_filter_range") c1340fe3590ebbe7 ("KVM: x86: Add a VALID_MASK for the flag in kvm_msr_filter") be83794210e7020f ("KVM: x86: Disallow the use of KVM_MSR_FILTER_DEFAULT_ALLOW in the kernel") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Cc: Aaron Lewis Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/Y8VR5wSAkd2A0HxS@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8026a31df6d59265553e7874cf3c2b560138a407 Author: Arnaldo Carvalho de Melo Date: Mon Jan 2 11:16:22 2023 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: b0305c1e0e27ad91 ("KVM: x86/xen: Add KVM_XEN_INVALID_GPA and KVM_XEN_INVALID_GFN to uapi") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: David Woodhouse Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/Y7Loj5slB908QSXf@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7d83299351fe7c812c529f5e39fe63b5312e4233 Author: Arnd Bergmann Date: Tue Jan 17 17:39:32 2023 +0100 staging: vchiq_arm: fix enum vchiq_status return types gcc-13 notices a type mismatch between function declaration and definition for a few functions that have been converted from returning vchiq specific status values to regular error codes: drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:662:5: error: conflicting types for 'vchiq_initialise' due to enum/integer mismatch; have 'int(struct vchiq_instance **)' [-Werror=enum-int-mismatch] drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:1: error: conflicting types for 'vchiq_use_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *, enum USE_TYPE_E)' [-Werror=enum-int-mismatch] drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1468:1: error: conflicting types for 'vchiq_release_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *)' [-Werror=enum-int-mismatch] Change the declarations to match the actual function definition. Fixes: a9fbd828be7f ("staging: vchiq_arm: drop enum vchiq_status from vchiq_*_internal") Cc: stable Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230117163957.1109872-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 41e1992665a2701fa025a8b76970c43b4148446f Author: Heiko Carstens Date: Tue Jan 17 19:00:59 2023 +0100 s390: workaround invalid gcc-11 out of bounds read warning GCC 11.1.0 and 11.2.0 generate a wrong warning when compiling the kernel e.g. with allmodconfig: arch/s390/kernel/setup.c: In function ‘setup_lowcore_dat_on’: ./include/linux/fortify-string.h:57:33: error: ‘__builtin_memcpy’ reading 128 bytes from a region of size 0 [-Werror=stringop-overread] ... arch/s390/kernel/setup.c:526:9: note: in expansion of macro ‘memcpy’ 526 | memcpy(abs_lc->cregs_save_area, S390_lowcore.cregs_save_area, | ^~~~~~ This could be addressed by using absolute_pointer() with the S390_lowcore macro, but this is not a good idea since this generates worse code for performance critical paths. Therefore simply use a for loop to copy the array in question and get rid of the warning. Reported-by: Geert Uytterhoeven Signed-off-by: Heiko Carstens commit c1649ec55708ae42091a2f1bca1ab49ecd722d55 Merge: 2bbb0674c93f9 7c24fa225081f Author: Linus Torvalds Date: Tue Jan 17 09:29:17 2023 -0800 Merge tag 'nfsd-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix recently introduced use-after-free bugs * tag 'nfsd-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: replace delayed_work with work_struct for nfsd_client_shrinker NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time NFSD: fix use-after-free in nfsd4_ssc_setup_dul() commit 2bbb0674c93f9373f12048786b4638b055243112 Merge: 6e50979a9c873 fa17087e24426 Author: Linus Torvalds Date: Tue Jan 17 09:20:50 2023 -0800 Merge tag 'tomoyo-pr-20230117' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 Pull tomoyo fixes from Tetsuo Handa: "Makefile and Kconfig updates for TOMOYO" * tag 'tomoyo-pr-20230117' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1: tomoyo: Update website link tomoyo: Remove "select SRCU" tomoyo: Omit use of bin2c tomoyo: avoid unneeded creation of builtin-policy.h tomoyo: fix broken dependency on *.conf.default commit 531390a243ef47448f8bad01c186c2787666bf4d Author: Takashi Sakamoto Date: Tue Jan 17 18:06:10 2023 +0900 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region This patch is fix for Linux kernel v2.6.33 or later. For request subaction to IEC 61883-1 FCP region, Linux FireWire subsystem have had an issue of use-after-free. The subsystem allows multiple user space listeners to the region, while data of the payload was likely released before the listeners execute read(2) to access to it for copying to user space. The issue was fixed by a commit 281e20323ab7 ("firewire: core: fix use-after-free regression in FCP handler"). The object of payload is duplicated in kernel space for each listener. When the listener executes ioctl(2) with FW_CDEV_IOC_SEND_RESPONSE request, the object is going to be released. However, it causes memory leak since the commit relies on call of release_request() in drivers/firewire/core-cdev.c. Against the expectation, the function is never called due to the design of release_client_resource(). The function delegates release task to caller when called with non-NULL fourth argument. The implementation of ioctl_send_response() is the case. It should release the object explicitly. This commit fixes the bug. Cc: Fixes: 281e20323ab7 ("firewire: core: fix use-after-free regression in FCP handler") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20230117090610.93792-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 7746564793978fe2f43b18a302b22dca0ad3a0e8 Author: Pavel Begunkov Date: Tue Jan 17 11:42:15 2023 +0000 block: fix hctx checks for batch allocation When there are no read queues read requests will be assigned a default queue on allocation. However, blk_mq_get_cached_request() is not prepared for that and will fail all attempts to grab read requests from the cache. Worst case it doubles the number of requests allocated, roughly half of which will be returned by blk_mq_free_plug_rqs(). It only affects batched allocations and so is io_uring specific. For reference, QD8 t/io_uring benchmark improves by 20-35%. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/80d4511011d7d4751b4cf6375c4e38f237d935e3.1673955390.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 7171b0e261b17de96490adf053b8bb4b00061bcf Author: Flavio Suligoi Date: Mon Dec 19 13:47:59 2022 +0100 usb: core: hub: disable autosuspend for TI TUSB8041 The Texas Instruments TUSB8041 has an autosuspend problem at high temperature. If there is not USB traffic, after a couple of ms, the device enters in autosuspend mode. In this condition the external clock stops working, to save energy. When the USB activity turns on, ther hub exits the autosuspend state, the clock starts running again and all works fine. At ambient temperature all works correctly, but at high temperature, when the USB activity turns on, the external clock doesn't restart and the hub disappears from the USB bus. Disabling the autosuspend mode for this hub solves the issue. Signed-off-by: Flavio Suligoi Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/20221219124759.3207032-1-f.suligoi@asem.it Signed-off-by: Greg Kroah-Hartman commit 11cefeb2058f9f2322713b2683be9301556705e2 Author: Johan Hovold Date: Mon Dec 12 16:20:35 2022 +0100 USB: fix misleading usb_set_intfdata() kernel doc The struct device driver-data pointer is used for any data that a driver may need in various callbacks while bound to the device. For convenience, subsystems typically provide wrappers such as usb_set_intfdata() of the generic accessor functions for use in bus callbacks. There is generally no longer any need for a driver to clear the pointer, but since commit 0998d0631001 ("device-core: Ensure drvdata = NULL when no driver is bound") the driver-data pointer is set to NULL by driver core post unbind anyway. For historical reasons, USB core also clears this pointer when an explicitly claimed interface is released. Due to a misunderstanding, a misleading kernel doc comment for usb_set_intfdata() was recently added which claimed that the driver data pointer must not be cleared during disconnect before "all actions [are] completed", which is both imprecise and incorrect. Specifically, drivers like cdc-acm which claim additional interfaces use the driver-data pointer as a flag which is cleared when the first interface is unbound. As long as a driver does not do something odd like dereference the pointer in, for example, completion callbacks, this can be done at any time during disconnect. And in any case this is no different than for any other resource, like the driver data itself, which may be freed by the disconnect callback. Note that the comment actually also claimed that the interface itself was somehow being set to NULL by driver core. Fix the kernel doc by removing incorrect, overly specific and misleading details and adding a comment about why some drivers do clear the driver-data pointer. Fixes: 27ef17849779 ("usb: add usb_set_intfdata() documentation") Signed-off-by: Johan Hovold Acked-by: Alan Stern Acked-by: Vincent Mailhol Link: https://lore.kernel.org/r/20221212152035.31806-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit c6ec929595c7443250b2a4faea988c62019d5cd2 Author: Maciej Żenczykowski Date: Tue Jan 17 05:18:39 2023 -0800 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() In Google internal bug 265639009 we've received an (as yet) unreproducible crash report from an aarch64 GKI 5.10.149-android13 running device. AFAICT the source code is at: https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 The call stack is: ncm_close() -> ncm_notify() -> ncm_do_notify() with the crash at: ncm_do_notify+0x98/0x270 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) 0B 0D 00 79 strh w11, [x8, #6] // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) 6C 0A 00 B9 str w12, [x19, #8] // x10 (NULL) was read here from offset 0 of valid pointer x9 // IMHO we're reading 'cdev->gadget' and getting NULL // gadget is indeed at offset 0 of struct usb_composite_dev 2A 01 40 F9 ldr x10, [x9] // loading req->buf pointer, which is at offset 0 of struct usb_request 69 02 40 F9 ldr x9, [x19] // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed 4B 5D 40 B9 ldr w11, [x10, #0x5c] which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: event->wLength = cpu_to_le16(8); req->length = NCM_STATUS_BYTECOUNT; /* SPEED_CHANGE data is up/down speeds in bits/sec */ data = req->buf + sizeof *event; data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); My analysis of registers and NULL ptr deref crash offset (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); which calls: ncm_bitrate(NULL) which then calls: gadget_is_superspeed(NULL) which reads ((struct usb_gadget *)NULL)->max_speed and hits a panic. AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. (remember there's a GKI KABI reservation of 16 bytes in struct work_struct) It's not at all clear to me how this is all supposed to work... but returning 0 seems much better than panic-ing... Cc: Felipe Balbi Cc: Lorenzo Colitti Cc: Carlos Llamas Cc: stable@vger.kernel.org Signed-off-by: Maciej Żenczykowski Cc: stable Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com Signed-off-by: Greg Kroah-Hartman commit 7c07553807c5125c89de242d35c10c206fd8e6bb Author: Chanh Nguyen Date: Wed Jan 11 13:51:05 2023 +0700 USB: gadget: Add ID numbers to configfs-gadget driver names It is unable to use configfs to attach more than one gadget. When attaching the second gadget, it always fails and the kernel message prints out: Error: Driver 'configfs-gadget' is already registered, aborting... UDC core: g1: driver registration failed: -16 This commit fixes the problem by using the gadget name as a suffix to each configfs_gadget's driver name, thus making the names distinct. Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") Cc: stable Signed-off-by: Chanh Nguyen Reviewed-by: Andrzej Pietrasiewicz Tested-by: Heikki Krogerus Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20230111065105.29205-1-chanh@os.amperecomputing.com Signed-off-by: Greg Kroah-Hartman commit 36f78477ac2c89e9a2eed4a31404a291a3450b5d Author: ChiYuan Huang Date: Mon Jan 9 15:19:50 2023 +0800 usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail There's the altmode re-registeration issue after data role swap (DR_SWAP). Comparing to USBPD 2.0, in USBPD 3.0, it loose the limit that only DFP can initiate the VDM command to get partner identity information. For a USBPD 3.0 UFP device, it may already get the identity information from its port partner before DR_SWAP. If DR_SWAP send or receive at the mean time, 'send_discover' flag will be raised again. It causes discover identify action restart while entering ready state. And after all discover actions are done, the 'tcpm_register_altmodes' will be called. If old altmode is not unregistered, this sysfs create fail can be found. In 'DR_SWAP_CHANGE_DR' state case, only DFP will unregister altmodes. For UFP, the original altmodes keep registered. This patch fix the logic that after DR_SWAP, 'tcpm_unregister_altmodes' must be called whatever the current data role is. Reviewed-by: Macpaul Lin Fixes: ae8a2ca8a221 ("usb: typec: Group all TCPCI/TCPM code together") Reported-by: TommyYl Chen Cc: stable@vger.kernel.org Signed-off-by: ChiYuan Huang Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/1673248790-15794-1-git-send-email-cy_huang@richtek.com Signed-off-by: Greg Kroah-Hartman commit e95765e97d9cb93258a4840440d410fa6ff7e819 Author: Daniel Scally Date: Fri Dec 16 16:05:28 2022 +0000 usb: gadget: g_webcam: Send color matching descriptor per frame Currently the color matching descriptor is only sent across the wire a single time, following the descriptors for each format and frame. According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching Descriptors"): "Only one instance is allowed for a given format and if present, the Color Matching descriptor shall be placed following the Video and Still Image Frame descriptors for that format". Add another reference to the color matching descriptor after the yuyv frames so that it's correctly transmitted for that format too. Fixes: a9914127e834 ("USB gadget: Webcam device") Cc: stable Signed-off-by: Daniel Scally Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Link: https://lore.kernel.org/r/20221216160528.479094-1-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit 85af23df903ee14bfcba60c53e4f3b640f2310f8 Author: Prashant Malani Date: Wed Jan 11 02:05:43 2023 +0000 usb: typec: altmodes/displayport: Use proper macro for pin assignment check While looking at the DP configuration VDO to determine the peripheral configuration, the spec (Table 8-5: DisplayPort Configurations, VESA DisplayPort Alt Mode Standard v2.0) lists the options as "UFP_U as a DP Source/Sink Device". So, use the correct macro while performing this check. Effectively it's the same as the existing code, but the proposed macro describes the state a little better. No functional changes introduced. Cc: Heikki Krogerus Signed-off-by: Prashant Malani Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230111020546.3384569-3-pmalani@chromium.org Signed-off-by: Greg Kroah-Hartman commit 9682b41e52cc9f42f5c33caf410464392adaef04 Author: Prashant Malani Date: Wed Jan 11 02:05:42 2023 +0000 usb: typec: altmodes/displayport: Fix pin assignment calculation Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") fixed the pin assignment calculation to take into account whether the peripheral was a plug or a receptacle. But the "pin_assignments" sysfs logic was not updated. Address this by using the macros introduced in the aforementioned commit in the sysfs logic too. Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") Cc: stable@vger.kernel.org Cc: Heikki Krogerus Signed-off-by: Prashant Malani Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230111020546.3384569-2-pmalani@chromium.org Signed-off-by: Greg Kroah-Hartman commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 Author: Prashant Malani Date: Wed Jan 11 02:05:41 2023 +0000 usb: typec: altmodes/displayport: Add pin assignment helper The code to extract a peripheral's currently supported Pin Assignments is repeated in a couple of locations. Factor it out into a separate function. This will also make it easier to add fixes (we only need to update 1 location instead of 2). Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") Cc: stable@vger.kernel.org Cc: Heikki Krogerus Signed-off-by: Prashant Malani Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230111020546.3384569-1-pmalani@chromium.org Signed-off-by: Greg Kroah-Hartman commit ce405d561b020e5a46340eb5146805a625dcacee Author: Udipto Goswami Date: Thu Dec 15 10:59:06 2022 +0530 usb: gadget: f_fs: Ensure ep0req is dequeued before free_request As per the documentation, function usb_ep_free_request guarantees the request will not be queued or no longer be re-queued (or otherwise used). However, with the current implementation it doesn't make sure that the request in ep0 isn't reused. Fix this by dequeuing the ep0req on functionfs_unbind before freeing the request to align with the definition. Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") Signed-off-by: Udipto Goswami Tested-by: Krishna Kurapati Link: https://lore.kernel.org/r/20221215052906.8993-3-quic_ugoswami@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 6a19da111057f69214b97c62fb0ac59023970850 Author: Udipto Goswami Date: Thu Dec 15 10:59:05 2022 +0530 usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind. Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex). Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") Signed-off-by: Udipto Goswami Tested-by: Krishna Kurapati Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@quicinc.com Signed-off-by: Greg Kroah-Hartman commit cde37881e2e14590675d0acdfbad408300d9ca95 Author: Matthias Kaehlcke Date: Tue Jan 10 17:32:53 2023 +0000 usb: misc: onboard_hub: Move 'attach' work to the driver Currently each onboard_hub platform device owns an 'attach' work, which is scheduled when the device probes. With this deadlocks have been reported on a Raspberry Pi 3 B+ [1], which has nested onboard hubs. The flow of the deadlock is something like this (with the onboard_hub driver built as a module) [2]: - USB root hub is instantiated - core hub driver calls onboard_hub_create_pdevs(), which creates the 'raw' platform device for the 1st level hub - 1st level hub is probed by the core hub driver - core hub driver calls onboard_hub_create_pdevs(), which creates the 'raw' platform device for the 2nd level hub - onboard_hub platform driver is registered - platform device for 1st level hub is probed - schedules 'attach' work - platform device for 2nd level hub is probed - schedules 'attach' work - onboard_hub USB driver is registered - device (and parent) lock of hub is held while the device is re-probed with the onboard_hub driver - 'attach' work (running in another thread) calls driver_attach(), which blocks on one of the hub device locks - onboard_hub_destroy_pdevs() is called by the core hub driver when one of the hubs is detached - destroying the pdevs invokes onboard_hub_remove(), which waits for the 'attach' work to complete - waits forever, since the 'attach' work can't acquire the device lock Use a single work struct for the driver instead of having a work struct per onboard hub platform driver instance. With that it isn't necessary to cancel the work in onboard_hub_remove(), which fixes the deadlock. The work is only cancelled when the driver is unloaded. [1] https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/ [2] https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/ Cc: stable@vger.kernel.org Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver") Link: https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/ Link: https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/ Reported-by: Stefan Wahren Signed-off-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20230110172954.v2.2.I16b51f32db0c32f8a8532900bfe1c70c8572881a@changeid Signed-off-by: Greg Kroah-Hartman commit e5854355d76b8d768cea8e4fc3ce6dfdba25518a Author: Matthias Kaehlcke Date: Tue Jan 10 17:32:52 2023 +0000 usb: misc: onboard_hub: Invert driver registration order The onboard_hub 'driver' consists of two drivers, a platform driver and a USB driver. Currently when the onboard hub driver is initialized it first registers the platform driver, then the USB driver. This results in a race condition when the 'attach' work is executed, which is scheduled when the platform device is probed. The purpose of fhe 'attach' work is to bind elegible USB hub devices to the onboard_hub USB driver. This fails if the work runs before the USB driver has been registered. Register the USB driver first, then the platform driver. This increases the chances that the onboard_hub USB devices are probed before their corresponding platform device, which the USB driver tries to locate in _probe(). The driver already handles this situation and defers probing if the onboard hub platform device doesn't exist yet. Cc: stable@vger.kernel.org Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver") Link: https://lore.kernel.org/lkml/Y6W00vQm3jfLflUJ@hovoldconsulting.com/T/#m0d64295f017942fd988f7c53425db302d61952b4 Reported-by: Alexander Stein Signed-off-by: Matthias Kaehlcke Tested-by: Stefan Wahren Link: https://lore.kernel.org/r/20230110172954.v2.1.I75494ebee7027a50235ce4b1e930fa73a578fbe2@changeid Signed-off-by: Greg Kroah-Hartman commit fac4b8633fd682ecc8e9cff61cb3e33374a1c7e5 Author: Jack Pham Date: Mon Jan 9 23:12:18 2023 -0800 usb: ucsi: Ensure connector delayed work items are flushed During ucsi_unregister() when destroying a connector's workqueue, there may still be pending delayed work items that haven't been scheduled yet. Because queue_delayed_work() uses a separate timer to schedule a work item, the destroy_workqueue() call is not aware of any pending items. Hence when a pending item's timer expires it would then try to queue on a dangling workqueue pointer. Fix this by keeping track of all work items in a list, so that prior to destroying the workqueue any pending items can be flushed. Do this by calling mod_delayed_work() as that will cause pending items to get queued immediately, which then allows the ensuing destroy_workqueue() to implicitly drain all currently queued items to completion and free themselves. Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking") Suggested-by: Heikki Krogerus Co-developed-by: Linyu Yuan Signed-off-by: Linyu Yuan Signed-off-by: Jack Pham Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230110071218.26261-1-quic_jackp@quicinc.com Signed-off-by: Greg Kroah-Hartman commit bd449ad8cee9d4b523abbdfa73e1a2a08333f331 Author: Yang Yingliang Date: Fri Dec 30 16:17:30 2022 +0800 usb: musb: fix error return code in omap2430_probe() Before calling platform_get_resource() in omap2430_probe(), the 'ret' is re-assgined to 0, it can't return an error code, if platform_get_resource fails. Set the error code to -EINVAL to fix this. Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources") Cc: stable Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221230081730.1655616-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit f96c0384047257365371a8ac217107c0371586f1 Author: Xu Yang Date: Thu Dec 15 13:54:09 2022 +0800 usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch) After successfully probed, ci->role_switch would only be NULL or a valid pointer. IS_ERR(ci->role_switch) will always return 0. So no need to wrap it with IS_ERR, otherwise the logic is wrong. Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") cc: Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20221215055409.3760523-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 74622f0a81d0c2bcfc39f9192b788124e8c7f0af Author: Mathias Nyman Date: Mon Jan 16 16:22:16 2023 +0200 xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables USB3 ports on xHC hosts may have retimers that cause too long exit latency to work with native USB3 U1/U2 link power management states. For now only use usb_acpi_port_lpm_incapable() to evaluate if port lpm should be disabled while setting up the USB3 roothub. Other ways to identify lpm incapable ports can be added here later if ACPI _DSM does not exist. Limit this to Intel hosts for now, this is to my knowledge only an Intel issue. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cd702d18c882d5a4ea44bbdb38edd5d5577ef640 Author: Mathias Nyman Date: Mon Jan 16 16:22:15 2023 +0200 usb: acpi: add helper to check port lpm capability using acpi _DSM Add a helper to evaluate ACPI usb device specific method (_DSM) provided in case the USB3 port shouldn't enter U1 and U2 link states. This _DSM was added as port specific retimer configuration may lead to exit latencies growing beyond U1/U2 exit limits, and OS needs a way to find which ports can't support U1/U2 link power management states. This _DSM is also used by windows: Link: https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/usb-device-specific-method---dsm- Some patch issues found in testing resolved by Ron Lee Cc: stable@vger.kernel.org Tested-by: Ron Lee Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0522b9a1653048440da5f21747f21e498b9220d1 Author: Mathias Nyman Date: Mon Jan 16 16:22:14 2023 +0200 xhci: Add a flag to disable USB3 lpm on a xhci root port level. One USB3 roothub port may support link power management, while another root port on the same xHC can't due to different retimers used for the ports. This is the case with Intel Alder Lake, and possible future platforms where retimers used for USB4 ports cause too long exit latecy to enable native USB3 lpm U1 and U2 states. Add a flag in the xhci port structure to indicate if the port is lpm_incapable, and check it while calculating exit latency. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 23a3b8d5a2365653fd9bc5a9454d1e7f4facbf85 Author: Mathias Nyman Date: Mon Jan 16 16:22:13 2023 +0200 xhci: Add update_hub_device override for PCI xHCI hosts Allow PCI hosts to check and tune roothub and port settings before the hub is up and running. This override is needed to turn off U1 and U2 LPM for some ports based on per port ACPI _DSM, _UPC, or possibly vendor specific mmio values for Intel xHC hosts. Usb core calls the host update_hub_device once it creates a hub. Entering U1 or U2 link power save state on ports with this limitation will cause link to fail, turning the usb device unusable in that setup. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a2bc47c43e70cf904b1af49f76d572326c08bca7 Author: Mathias Nyman Date: Mon Jan 16 16:22:12 2023 +0200 xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies. Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back. hold the xhci spinlock while freeing the virt device Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e8fb5bc76eb86437ab87002d4a36d6da02165654 Author: Jimmy Hu Date: Mon Jan 16 16:22:11 2023 +0200 usb: xhci: Check endpoint is valid before dereferencing it When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint. Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it. [233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 [233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x198 Fixes: 50e8725e7c42 ("xhci: Refactor command watchdog and fix split string.") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Hu Signed-off-by: Mathias Nyman Message-ID: <0fe978ed-8269-9774-1c40-f8a98c17e838@linux.intel.com> Link: https://lore.kernel.org/r/20230116142216.1141605-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 93915a4170e9defd56a767a18e6c4076f3d18609 Author: Ricardo Ribalda Date: Mon Jan 16 16:22:10 2023 +0200 xhci-pci: set the dma max_seg_size Allow devices to have dma operations beyond 64K, and avoid warnings such as: xhci_hcd 0000:00:14.0: mapping sg segment longer than device claims to support [len=98304] [max=65536] Cc: stable@vger.kernel.org Cc: Takashi Iwai Signed-off-by: Ricardo Ribalda Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230116142216.1141605-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8565c502e7c156d190d8e6d36e443f51b257f165 Author: Drew Davenport Date: Mon Dec 26 22:53:24 2022 -0700 drm/i915/display: Check source height is > 0 The error message suggests that the height of the src rect must be at least 1. Reject source with height of 0. Cc: stable@vger.kernel.org Signed-off-by: Drew Davenport Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid (cherry picked from commit 0fe76b198d482b41771a8d17b45fb726d13083cf) Signed-off-by: Rodrigo Vivi commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 Author: Juhyung Park Date: Tue Jan 17 17:51:54 2023 +0900 usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") blacklists UAS for all of RTL9210 enclosures. The RTL9210 controller was advertised with UAS since its release back in 2019 and was shipped with a lot of enclosure products with different firmware combinations. Blacklist UAS only for HIKSEMI MD202. This should hopefully be replaced with more robust method than just comparing strings. But with limited information [1] provided thus far (dmesg when the device is plugged in, which includes manufacturer and product, but no lsusb -v to compare against), this is the best we can do for now. [1] https://lore.kernel.org/all/20230109115550.71688-1-qkrwngud825@gmail.com Fixes: e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") Cc: Alan Stern Cc: Hongling Zeng Cc: stable@vger.kernel.org Signed-off-by: Juhyung Park Acked-by: Oliver Neukum Link: https://lore.kernel.org/r/20230117085154.123301-1-qkrwngud825@gmail.com Signed-off-by: Greg Kroah-Hartman commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 Author: Alan Stern Date: Fri Dec 23 09:59:09 2022 -0500 USB: gadgetfs: Fix race between mounting and unmounting The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part: BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline] The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex. Signed-off-by: Alan Stern Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com Reported-and-tested-by: Gerald Lee Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/ Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API") CC: Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 1301c7b9f7efad2f11ef924e317c18ebd714fc9a Author: Pawel Laszczak Date: Tue Nov 15 05:00:39 2022 -0500 usb: cdns3: remove fetched trb from cache before dequeuing After doorbell DMA fetches the TRB. If during dequeuing request driver changes NORMAL TRB to LINK TRB but doesn't delete it from controller cache then controller will handle cached TRB and packet can be lost. The example scenario for this issue looks like: 1. queue request - set doorbell 2. dequeue request 3. send OUT data packet from host 4. Device will accept this packet which is unexpected 5. queue new request - set doorbell 6. Device lost the expected packet. By setting DFLUSH controller clears DRDY bit and stop DMA transfer. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: Signed-off-by: Pawel Laszczak Acked-by: Peter Chen Link: https://lore.kernel.org/r/20221115100039.441295-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit 9d6033e350694a67885605674244d43c9559dc36 Author: Guoqing Jiang Date: Fri Dec 30 09:09:26 2022 +0800 block/rnbd-clt: fix wrong max ID in ida_alloc_max We need to pass 'end - 1' to ida_alloc_max after switch from ida_simple_get to ida_alloc_max. Otherwise smatch warns. drivers/block/rnbd/rnbd-clt.c:1460 init_dev() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing? Fixes: 24afc15dbe21 ("block/rnbd: Remove a useless mutex") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guoqing Jiang Acked-by: Jack Wang Link: https://lore.kernel.org/r/20221230010926.32243-1-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit fcc4348adafe53928fda46d104c1798e5a4de4ff Author: Bard Liao Date: Tue Jan 17 14:35:34 2023 +0200 ASoC: SOF: sof-audio: start with the right widget type If there is a connection between a playback stream and a capture stream, all widgets that are connected to the playback stream and the capture stream will be in the list. So, we have to start with the exactly right widget type. snd_soc_dapm_aif_out is for capture stream and a playback stream should start with a snd_soc_dapm_aif_in widget. Contrarily, snd_soc_dapm_dai_in is for playback stream, and a capture stream should start with a snd_soc_dapm_dai_out widget. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230117123534.2075-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b1f02c6a26bc2cec3d2c4f9b7cc007d69a78aed6 Merge: b7bfaa761d760 84ee211c83212 Author: Greg Kroah-Hartman Date: Tue Jan 17 16:10:15 2023 +0100 Merge tag 'thunderbolt-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: "thunderbolt: Fixes for v6.2-rc5 This includes fixes for: - on-board retimer scan return value - runtime PM during tb_retimer_scan() - USB3 link rate calculation - XDomain lane bonding. All these have been in linux-next with no reported issues." * tag 'thunderbolt-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Disable XDomain lane 1 only in software connection manager thunderbolt: Use correct function to calculate maximum USB3 link rate thunderbolt: Do not call PM runtime functions in tb_retimer_scan() thunderbolt: Do not report errors if on-board retimers are found commit cbf44580ce6b310272a73e3e794233fd064330bd Author: Jiri Kosina Date: Tue Jan 17 15:41:40 2023 +0100 HID: revert CHERRY_MOUSE_000C quirk This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice"), as it turns out to break reboot on some platforms for reason yet to be understood. Fixes: f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice") Reported-by: Christian Zigotzky Signed-off-by: Jiri Kosina commit 175281f80695569c7f9cf062e5d0ddc4addc109f Author: Patrice Chotard Date: Mon Dec 12 09:51:42 2022 +0100 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l Chip select pinctrl phandle was missing in several stm32mp15x based boards. Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") Signed-off-by: Patrice Chotard Cc: Oleksij Rempel Cc: Alexandre Torgue Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Alexandre Torgue commit 732dbcf52f74b254a7ddd4226e0b9638e1e7aeff Author: Patrice Chotard Date: Mon Dec 12 09:51:41 2022 +0100 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon Chip select pinctrl phandle was missing in several stm32mp15x based boards. Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") Signed-off-by: Patrice Chotard Cc: Reinhold Mueller Cc: Alexandre Torgue Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Alexandre Torgue commit 21d83512bf2bd25ebed467151fd2bcd0cca7dc9a Author: Patrice Chotard Date: Mon Dec 12 09:51:40 2022 +0100 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som Chip select pinctrl phandle was missing in several stm32mp15x based boards. Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") Signed-off-by: Patrice Chotard Cc: Marek Vasut Cc: Alexandre Torgue Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org Reviewed-by: Marek Vasut Signed-off-by: Alexandre Torgue commit 7ffd2266bd32d9f31a4e918443c733906cff0d19 Author: Patrice Chotard Date: Mon Dec 12 09:51:39 2022 +0100 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som Chip select pinctrl phandle was missing in several stm32mp15x based boards. Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") Signed-off-by: Patrice Chotard Cc: Marek Vasut Cc: Alexandre Torgue Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org Reviewed-by: Marek Vasut Signed-off-by: Alexandre Torgue commit 431d1531466033909d2e8c754a7dc3704b70843f Author: Jonas Karlman Date: Tue Jan 10 08:46:53 2023 +0000 pinctrl: rockchip: fix mux route data for rk3568 IO mux selection is configured in PMU_GRF_SOC_CON4 and GRF_IOFUNC_SEL0-5 regs on RK3568. pwm0-2 is configured in PMU_GRF reg and the rest is configured in GRF_IOFUNC regs according to TRM [1]. Update mux route data to reflect this and use proper detection pin for UART1 IO mux M1. This fixes HDMITX IO mux M1 selection and makes it possible to enable HDMI CEC on my Radxa ROCK 3 Model A v1.31 board. [1] http://opensource.rock-chips.com/images/2/26/Rockchip_RK3568_TRM_Part1_V1.3-20220930P.PDF Fixes: c0dadc0e47a8 ("pinctrl: rockchip: add support for rk3568") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20230110084636.1141740-1-jonas@kwiboo.se Signed-off-by: Linus Walleij commit 1f3bd64ad921f051254591fbed04fd30b306cde6 Author: Heiner Kallweit Date: Sun Jan 15 18:24:08 2023 +0100 net: stmmac: fix invalid call to mdiobus_get_phy() In a number of cases the driver assigns a default value of -1 to priv->plat->phy_addr. This may result in calling mdiobus_get_phy() with addr parameter being -1. Therefore check for this scenario and bail out before calling mdiobus_get_phy(). Fixes: 42e87024f727 ("net: stmmac: Fix case when PHY handle is not present") Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/669f9671-ecd1-a41b-2727-7b73e3003985@gmail.com Signed-off-by: Paolo Abeni commit 8ba5fc4c154aeb3b4620f05543cce426c62ed2de Author: Hans de Goede Date: Fri Jan 13 12:41:26 2023 +0100 ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T The Acer Aspire 4810T predates Windows 8, so it defaults to using acpi_video# for backlight control, but this is non functional on this model. Add a DMI quirk to use the native backlight interface which does work properly. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 81aae5cbd36da836eb65025c798d15e5e28a019b Author: Rafael J. Wysocki Date: Thu Jan 12 20:53:39 2023 +0100 MAINTAINERS: Update the ACPICA development list address The previous ACPICA development list address, devel@acpica.org, started to bounce some time ago and it is not likely to be restored, so replace it with a new one, acpica-devel@lists.linuxfoundation.org. Signed-off-by: Rafael J. Wysocki commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d Author: Pietro Borrello Date: Mon Jan 16 11:11:25 2023 +0000 HID: check empty report_list in bigben_probe() Add a check for empty report_list in bigben_probe(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption. Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello Signed-off-by: Jiri Kosina commit b12fece4c64857e5fab4290bf01b2e0317a88456 Author: Pietro Borrello Date: Mon Jan 16 11:11:24 2023 +0000 HID: check empty report_list in hid_validate_values() Add a check for empty report_list in hid_validate_values(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption. Fixes: 1b15d2e5b807 ("HID: core: fix validation of report id 0") Signed-off-by: Pietro Borrello Signed-off-by: Jiri Kosina commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 Author: Heiner Kallweit Date: Sun Jan 15 11:54:06 2023 +0100 net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it. Fixes: 7f854420fbfe ("phy: Add API for {un}registering an mdio device to a bus.") Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/cdf664ea-3312-e915-73f8-021678d08887@gmail.com Signed-off-by: Paolo Abeni commit ecf7cf8efb59789e2b21d2f9ab926142579092b2 Author: Szymon Heidrich Date: Sat Jan 14 19:23:26 2023 +0100 net: usb: sr9700: Handle negative len Packet len computed as difference of length word extracted from skb data and four may result in a negative value. In such case processing of the buffer should be interrupted rather than setting sr_skb->len to an unexpectedly large value (due to cast from signed to unsigned integer) and passing sr_skb to usbnet_skb_return. Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length") Signed-off-by: Szymon Heidrich Link: https://lore.kernel.org/r/20230114182326.30479-1-szymon.heidrich@gmail.com Signed-off-by: Paolo Abeni commit dc74a9e8a8c57966a563ab078ba91c8b2c0d0a72 Author: Jinyang He Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Add generic ex-handler unwind in prologue unwinder When exception is triggered, code flow go handle_\exception in some cases. One of stackframe in this case as follows, high -> +-------+ | REGS | <- a pt_regs | | | | <- ex trigger | REGS | <- ex pt_regs <-+ | | | | | | low -> +-------+ ->unwind-+ When unwinder unwinds to handler_\exception it cannot go on prologue analysis. Because it is an asynchronous code flow, we should get the next frame PC from regs->csr_era rather than regs->regs[1]. At init time we copy the handlers to eentry and also copy them to NUMA-affine memory named pcpu_handlers if NUMA is enabled. Thus, unwinder cannot unwind normally. To solve this, we try to give some hints in handler_\exception and fixup unwinders in unwind_next_frame(). Reported-by: Qing Zhang Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit c5ac25e0d78a6f63446b8fef4d8630ccd7a2663d Author: Jinyang He Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Strip guess unwinder out from prologue unwinder The prolugue unwinder rely on symbol info. When PC is not in kernel text address, it cannot find relative symbol info and it will be broken. The guess unwinder will be used in this case. And the guess unwinder code in prolugue unwinder is redundant. Strip it out and set the unwinder type in unwind_state. Make guess_unwinder::unwind_next_frame() as default way when other unwinders cannot unwind in some extreme case. Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit 5bb8d34449c4a2eb94d657b992170afafac274f9 Author: Jinyang He Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Use correct sp value to get graph addr in stack unwinders The stack frame when function_graph enable like follows, --------- <- function sp_on_entry | | | FAKE_RA <- sp_on_entry - sizeof(pt_regs) + PT_R1 | --------- <- sp_on_entry - sizeof(pt_regs) So if we want to get the &FAKE_RA we should get sp_on_entry first. In the unwinder_prologue case, we can get the sp_on_entry as state->sp, because we try to calculate each CFA and the ra saved address. But in the unwinder_guess case, we cannot get it because we do not try to calculate the CFA. Although LoongArch have not fixed frame, the $ra is saved at CFA - 8 in most cases, we can try guess, too. As we store the pc in state, we not need to dereference state->sp, too. Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit 429a9671f235c94fc4b5d6687308714b74adc820 Author: Jinyang He Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Get frame info in unwind_start() when regs is not available At unwind_start(), it is better to get its frame info here rather than get them outside, even we don't have 'regs'. In this way we can simply use unwind_{start, next_frame, done} outside. Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit e2f27392275c7ffceb4afac1567eb325722b9ae1 Author: Jinyang He Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Adjust PC value when unwind next frame in unwinder When state->first is not set, the PC is a return address in the previous frame. We need to adjust its value in case overflow to the next symbol. Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit 3200983fa8e2c8aa17ed911b617b4a248bcb1267 Author: Youling Tang Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Simplify larch_insn_gen_xxx implementation Simplify larch_insn_gen_xxx implementation by reusing emit_xxx. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 2959fce7fdb73fc784aefd58cc34b1ba700826aa Author: Tiezhu Yang Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Use common function sign_extend64() There exists a common function sign_extend64() to sign extend a 64-bit value using specified bit as sign-bit in include/linux/bitops.h, it is more efficient, let us use it and remove the arch-specific sign_extend() under arch/loongarch. Suggested-by: Jinyang He Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit d52fec86a465355b379e839fa372ead0334d62e6 Author: Huacai Chen Date: Tue Jan 17 11:42:16 2023 +0800 LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap HWCAP_LOONGARCH_CPUCFG is missing in elf_hwcap, so add it for glibc's later use. Cc: stable@vger.kernel.org Reported-by: Yinyu Cai Signed-off-by: Huacai Chen commit e3ff8887e7db757360f97634e0d6f4b8e27a8c46 Author: Yu Kuai Date: Tue Jan 3 19:28:33 2023 +0800 blk-cgroup: fix missing pd_online_fn() while activating policy If the policy defines pd_online_fn(), it should be called after pd_init_fn(), like blkg_create(). Signed-off-by: Yu Kuai Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230103112833.2013432-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 6e50979a9c87371fdb85d16058f9b5cb40751501 Merge: d532dd102151c 19fa92fb72f8b Author: Linus Torvalds Date: Mon Jan 16 16:36:39 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-01-16-15-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc hotfixes from Andrew Morton: "21 hotfixes. Thirteen of these address pre-6.1 issues and hence have the cc:stable tag" * tag 'mm-hotfixes-stable-2023-01-16-15-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (21 commits) init/Kconfig: fix typo (usafe -> unsafe) nommu: fix split_vma() map_count error nommu: fix do_munmap() error path nommu: fix memory leak in do_mmap() error path MAINTAINERS: update Robert Foss' email address proc: fix PIE proc-empty-vm, proc-pid-vm tests mm: update mmap_sem comments to refer to mmap_lock include/linux/mm: fix release_pages_arg kernel doc comment lib/win_minmax: use /* notation for regular comments kasan: mark kasan_kunit_executing as static nilfs2: fix general protection fault in nilfs_btree_insert() Docs/admin-guide/mm/zswap: remove zsmalloc's lack of writeback warning mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects hugetlb: unshare some PMDs when splitting VMAs mm: fix vma->anon_name memory leak for anonymous shmem VMAs mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection() ... commit 31e1be62abdebc28bd51d0999a25f0eea535b5af Author: Eric Biggers Date: Mon Jan 16 15:34:24 2023 -0800 MAINTAINERS: update fscrypt git repo fscrypt.git is being renamed to linux.git, so update MAINTAINERS accordingly. (The reasons for the rename are to match what I'm doing for the new fsverity repo, which also involves the branch names changing to be clearer; and to avoid ambiguity with userspace tools.) As long as I'm updating the fscrypt MAINTAINERS entry anyway, also: - Move my name to the top, so that people bother me first if they just choose the first person. (In practice I'm the primary maintainer, and Ted and Jaegeuk are backups.) - Remove an unnecessary wildcard. Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20230116233424.65657-1-ebiggers@kernel.org commit ef7592e466ef7b2595fdfdfd23559a779f4b211a Author: Eric Biggers Date: Mon Jan 16 15:22:57 2023 -0800 MAINTAINERS: update fsverity git repo, list, and patchwork We're moving fsverity development to use its own git repo, mailing list, and patchwork project, instead of reusing the fscrypt ones. Update the MAINTAINERS file accordingly. Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20230116232257.64377-1-ebiggers@kernel.org commit 6c796996ee7033bcbbc3cd733513eb43f8160f5e Author: Thomas Gleixner Date: Mon Jan 16 19:11:32 2023 +0100 x86/pci/xen: Fixup fallout from the PCI/MSI overhaul David reported that the recent PCI/MSI rework results in MSI descriptor leakage under XEN. This is caused by: 1) The missing MSI_FLAG_FREE_MSI_DESCS flag in the XEN MSI domain info, which is required now that PCI/MSI delegates descriptor freeing to the core MSI code. 2) Not disassociating the interrupts on teardown, by setting the msi_desc::irq to 0. This was not required before because the teardown was unconditional and did not check whether a MSI descriptor was still connected to a Linux interrupt. On further inspection it came to light that the MSI_FLAG_DEV_SYSFS is missing in the XEN MSI domain info as well to restore the pre 6.2 status quo. Add the missing MSI flags and disassociate the MSI descriptor from the Linux interrupt in the XEN specific teardown function. Fixes: b2bdda205c0c ("PCI/MSI: Let the MSI core free descriptors") Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()") Fixes: ffd84485e6be ("PCI/MSI: Let the irq code handle sysfs groups") Reported-by: David Woodhouse Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Link: https://lore.kernel.org/r/871qnunycr.ffs@tglx commit 0a3a58de319552525507a3497da86df039a5e4e0 Author: David Woodhouse Date: Sun Jan 15 22:14:19 2023 +0000 x86/pci/xen: Set MSI_FLAG_PCI_MSIX support in Xen MSI domain The Xen MSI → PIRQ magic does support MSI-X, so advertise it. (In fact it's better off with MSI-X than MSI, because it's actually broken by design for 32-bit MSI, since it puts the high bits of the PIRQ# into the high 32 bits of the MSI message address, instead of the Extended Destination ID field which is in bits 4-11. Strictly speaking, this really fixes a much older commit 2e4386eba0c0 ("x86/xen: Wrap XEN MSI management into irqdomain") which failed to set the flag. But that never really mattered until __pci_enable_msix_range() started to check and bail out early. So in 6.2-rc we see failures e.g. to bring up networking on an Amazon EC2 m4.16xlarge instance: [ 41.498694] ena 0000:00:03.0 (unnamed net_device) (uninitialized): Failed to enable MSI-X. irq_cnt -524 [ 41.498705] ena 0000:00:03.0: Can not reserve msix vectors [ 41.498712] ena 0000:00:03.0: Failed to enable and set the admin interrupts Side note: This is the first bug found, and first patch tested, by running Xen guests under QEMU/KVM instead of running under actual Xen. Fixes: 99f3d2797657 ("PCI/MSI: Reject MSI-X early") Signed-off-by: David Woodhouse Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/4bffa69a949bfdc92c4a18e5a1c3cbb3b94a0d32.camel@infradead.org commit b7adbf9ada3513d2092362c8eac5cddc5b651f5c Author: Filipe Manana Date: Thu Jan 12 16:31:08 2023 +0000 btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have one task trying to start the quota rescan worker while another one is trying to disable quotas, we can end up hitting a race that results in the quota rescan worker doing a NULL pointer dereference. The steps for this are the following: 1) Quotas are enabled; 2) Task A calls the quota rescan ioctl and enters btrfs_qgroup_rescan(). It calls qgroup_rescan_init() which returns 0 (success) and then joins a transaction and commits it; 3) Task B calls the quota disable ioctl and enters btrfs_quota_disable(). It clears the bit BTRFS_FS_QUOTA_ENABLED from fs_info->flags and calls btrfs_qgroup_wait_for_completion(), which returns immediately since the rescan worker is not yet running. Then it starts a transaction and locks fs_info->qgroup_ioctl_lock; 4) Task A queues the rescan worker, by calling btrfs_queue_work(); 5) The rescan worker starts, and calls rescan_should_stop() at the start of its while loop, which results in 0 iterations of the loop, since the flag BTRFS_FS_QUOTA_ENABLED was cleared from fs_info->flags by task B at step 3); 6) Task B sets fs_info->quota_root to NULL; 7) The rescan worker tries to start a transaction and uses fs_info->quota_root as the root argument for btrfs_start_transaction(). This results in a NULL pointer dereference down the call chain of btrfs_start_transaction(). The stack trace is something like the one reported in Link tag below: general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 1 PID: 34 Comm: kworker/u4:2 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: btrfs-qgroup-rescan btrfs_work_helper RIP: 0010:start_transaction+0x48/0x10f0 fs/btrfs/transaction.c:564 Code: 48 89 fb 48 (...) RSP: 0018:ffffc90000ab7ab0 EFLAGS: 00010206 RAX: 0000000000000041 RBX: 0000000000000208 RCX: ffff88801779ba80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000001 R09: fffff52000156f5d R10: fffff52000156f5d R11: 1ffff92000156f5c R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2bea75b718 CR3: 000000001d0cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: btrfs_qgroup_rescan_worker+0x3bb/0x6a0 fs/btrfs/qgroup.c:3402 btrfs_work_helper+0x312/0x850 fs/btrfs/async-thread.c:280 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Modules linked in: So fix this by having the rescan worker function not attempt to start a transaction if it didn't do any rescan work. Reported-by: syzbot+96977faa68092ad382c4@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000e5454b05f065a803@google.com/ Fixes: e804861bd4e6 ("btrfs: fix deadlock between quota disable and qgroup rescan worker") CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 1f55ee6d0901d915801618bda0af4e5b937e3db7 Author: Filipe Manana Date: Thu Jan 12 14:17:20 2023 +0000 btrfs: fix invalid leaf access due to inline extent during lseek During lseek, for SEEK_DATA and SEEK_HOLE modes, we access the disk_bytenr of an extent without checking its type. However inline extents have their data starting the offset of the disk_bytenr field, so accessing that field when we have an inline extent can result in either of the following: 1) Interpret the inline extent's data as a disk_bytenr value; 2) In case the inline data is less than 8 bytes, we access part of some other item in the leaf, or unused space in the leaf; 3) In case the inline data is less than 8 bytes and the extent item is the first item in the leaf, we can access beyond the leaf's limit. So fix this by not accessing the disk_bytenr field if we have an inline extent. Fixes: b6e833567ea1 ("btrfs: make hole and data seeking a lot more efficient") Reported-by: Matthias Schoepfer Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216908 Link: https://lore.kernel.org/linux-btrfs/7f25442f-b121-2a3a-5a3d-22bcaae83cd4@leemhuis.info/ CC: stable@vger.kernel.org # 6.1 Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 26ecf243e407be54807ad67210f7e83b9fad71ea Author: Christoph Hellwig Date: Mon Nov 21 18:47:49 2022 +0100 btrfs: stop using write_one_page in btrfs_scratch_superblock write_one_page is an awkward interface that expects the page locked and ->writepage to be implemented. Replace that by zeroing the signature bytes and synchronize the block device page using the proper bdev helpers. Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 0e0078f72be81bbb2a02b229fd2cec8ad63e4fb1 Author: Christoph Hellwig Date: Mon Nov 21 18:47:48 2022 +0100 btrfs: factor out scratching of one regular super block btrfs_scratch_superblocks open codes scratching super block of a non-zoned super block. Split the code to read, zero and write the superblock for regular devices into a separate helper. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit d532dd102151cc69fcd00b13e5a9689b23c0c8d9 Merge: 5dc4c995db9eb 09e44868f1e03 Author: Linus Torvalds Date: Mon Jan 16 10:03:33 2023 -0800 Merge tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Another batch of fixes, dealing with fallouts from 6.1 reported by users: - tree-log fixes: - fix directory logging due to race with concurrent index key deletion - fix missing error handling when logging directory items - handle case of conflicting inodes being added to the log - remove transaction aborts for not so serious errors - fix qgroup accounting warning when rescan can be started at time with temporarily disable accounting - print more specific errors to system log when device scan ioctl fails - disable space overcommit for ZNS devices, causing heavy performance drop" * tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: do not abort transaction on failure to update log root btrfs: do not abort transaction on failure to write log tree when syncing log btrfs: add missing setup of log for full commit at add_conflicting_inode() btrfs: fix directory logging due to race with concurrent index key deletion btrfs: fix missing error handling when logging directory items btrfs: zoned: enable metadata over-commit for non-ZNS setup btrfs: qgroup: do not warn on record without old_roots populated btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list() commit 5fa55950729d0762a787451dc52862c3f850f859 Author: Thomas Gleixner Date: Mon Jan 9 22:57:13 2023 +0100 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointer dereference in the periodic tick code. This happens because the legacy timer interrupt (IRQ0) is resent in software which happens in soft interrupt (tasklet) context. In this context get_irq_regs() returns NULL which leads to the NULL pointer dereference. The reason for the resend is a spurious APIC interrupt on the IRQ0 vector which is captured and leads to a resend when the legacy timer interrupt is enabled. This is wrong because the legacy PIC interrupts are level triggered and therefore should never be resent in software, but nothing ever sets the IRQ_LEVEL flag on those interrupts, so the core code does not know about their trigger type. Ensure that IRQ_LEVEL is set when the legacy PCI interrupts are set up. Fixes: a4633adcdbc1 ("[PATCH] genirq: add genirq sw IRQ-retrigger") Reported-by: Baoquan He Signed-off-by: Thomas Gleixner Tested-by: Baoquan He Link: https://lore.kernel.org/r/87mt6rjrra.ffs@tglx commit 0f097f08c9b3c1fdb6cc9f2dd423abc17d13f1a2 Author: Yishai Hadas Date: Wed Jan 11 12:10:54 2023 +0200 lib/scatterlist: Fix to calculate the last_pg properly The last_pg is wrong, it is actually the first page of the last scatterlist element. To get the last page of the last scatterlist element we have to add prv->length. So it is checking mergability against the wrong page, Further, a SG element is not guaranteed to end on a page boundary, so we have to check the sub page location also for merge eligibility. Fix the above by checking physical contiguity based on PFNs, compute the actual last page and then call pages_are_mergable(). Fixes: 1567b49d1a40 ("lib/scatterlist: add check when merging zone device pages") Link: https://lore.kernel.org/r/20230111101054.188136-1-yishaih@nvidia.com Reported-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jason Gunthorpe commit 4fe59a130c112460626a6a8b9232aa580d9b8efc Author: Anuradha Weeraman Date: Mon Jan 16 18:26:34 2023 +0530 kernel/printk/printk.c: Fix W=1 kernel-doc warning Fix W=1 kernel-doc warning: kernel/printk/printk.c: - Include function parameter in console_lock_spinning_disable_and_check() Signed-off-by: Anuradha Weeraman Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20230116125635.374567-1-anuradha@debian.org commit 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 Author: Jens Axboe Date: Mon Jan 16 08:51:05 2023 -0700 pktcdvd: check for NULL returna fter calling bio_split_to_limits() The revert of the removal of this driver happened after we fixed up the split limits for NOWAIT issue, hence it got missed. Ensure that we check for a NULL bio after splitting, in case it should be retried. Marking this as fixing both commits, so that stable backport will do this correctly. Cc: stable@vger.kernel.org Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio") Fixes: 4b83e99ee709 ("Revert "pktcdvd: remove driver."") Signed-off-by: Jens Axboe commit 3ef5abd9b5c738bc6fa9a65e40331ef2cb03ad9c Author: John Ogness Date: Thu Jan 12 17:18:13 2023 +0106 tty: serial: kgdboc: fix mutex locking order for configure_kgdboc() Several mutexes are taken while setting up console serial ports. In particular, the tty_port->mutex and @console_mutex are taken: serial_pnp_probe serial8250_register_8250_port uart_add_one_port (locks tty_port->mutex) uart_configure_port register_console (locks @console_mutex) In order to synchronize kgdb's tty_find_polling_driver() with register_console(), commit 6193bc90849a ("tty: serial: kgdboc: synchronize tty_find_polling_driver() and register_console()") takes the @console_mutex. However, this leads to the following call chain (with locking): platform_probe kgdboc_probe configure_kgdboc (locks @console_mutex) tty_find_polling_driver uart_poll_init (locks tty_port->mutex) uart_set_options This is clearly deadlock potential due to the reverse lock ordering. Since uart_set_options() requires holding @console_mutex in order to serialize early initialization of the serial-console lock, take the @console_mutex in uart_poll_init() instead of configure_kgdboc(). Since configure_kgdboc() was using @console_mutex for safe traversal of the console list, change it to use the SRCU iterator instead. Add comments to uart_set_options() kerneldoc mentioning that it requires holding @console_mutex (aka the console_list_lock). Fixes: 6193bc90849a ("tty: serial: kgdboc: synchronize tty_find_polling_driver() and register_console()") Signed-off-by: John Ogness Reviewed-by: Sergey Senozhatsky Reviewed-by: Petr Mladek [pmladek@suse.com: Export console_srcu_read_lock_is_held() to fix build kgdboc as a module.] Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20230112161213.1434854-1-john.ogness@linutronix.de commit 80f8a66dede0a4b4e9e846765a97809c6fe49ce5 Author: Eric Dumazet Date: Fri Jan 13 12:43:26 2023 +0000 Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" This reverts commit 13e5afd3d773c6fc6ca2b89027befaaaa1ea7293. ieee80211_if_free() is already called from free_netdev(ndev) because ndev->priv_destructor == ieee80211_if_free syzbot reported: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 PID: 10041 Comm: syz-executor.0 Not tainted 6.2.0-rc2-syzkaller-00388-g55b98837e37d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:pcpu_get_page_chunk mm/percpu.c:262 [inline] RIP: 0010:pcpu_chunk_addr_search mm/percpu.c:1619 [inline] RIP: 0010:free_percpu mm/percpu.c:2271 [inline] RIP: 0010:free_percpu+0x186/0x10f0 mm/percpu.c:2254 Code: 80 3c 02 00 0f 85 f5 0e 00 00 48 8b 3b 48 01 ef e8 cf b3 0b 00 48 ba 00 00 00 00 00 fc ff df 48 8d 78 20 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 3b 0e 00 00 48 8b 58 20 48 b8 00 00 00 00 00 fc RSP: 0018:ffffc90004ba7068 EFLAGS: 00010002 RAX: 0000000000000000 RBX: ffff88823ffe2b80 RCX: 0000000000000004 RDX: dffffc0000000000 RSI: ffffffff81c1f4e7 RDI: 0000000000000020 RBP: ffffe8fffe8fc220 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 1ffffffff2179ab2 R12: ffff8880b983d000 R13: 0000000000000003 R14: 0000607f450fc220 R15: ffff88823ffe2988 FS: 00007fcb349de700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32220000 CR3: 000000004914f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10352 ieee80211_register_hw+0x2663/0x4040 net/mac80211/main.c:1411 mac80211_hwsim_new_radio+0x2537/0x4d80 drivers/net/wireless/mac80211_hwsim.c:4583 hwsim_new_radio_nl+0xa09/0x10f0 drivers/net/wireless/mac80211_hwsim.c:5176 genl_family_rcv_msg_doit.isra.0+0x1e6/0x2d0 net/netlink/genetlink.c:968 genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x4ff/0x7e0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Reported-by: syzbot Fixes: 13e5afd3d773 ("wifi: mac80211: fix memory leak in ieee80211_if_add()") Signed-off-by: Eric Dumazet Cc: Zhengchao Shao Cc: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230113124326.3533978-1-edumazet@google.com commit 953519b35227d5dbbb5c5724f1f539735fbf7781 Author: Felix Fietkau Date: Fri Jan 13 11:58:48 2023 +0100 wifi: mt76: dma: fix a regression in adding rx buffers When adding WED support, mt76_dma_add_buf was accidentally changed to set the skip_buf0 flag for tx buffers on the wrong queue descriptor entry. Additionally, there is a rxwi leak when rx buffer allocation fails. Fix this and make the code more readable by adding a separate function for adding rx buffers. Reported-by: Mikhail Gavrilov Tested-by: Mikhail Gavrilov Link: https://lore.kernel.org/r/CABXGCsMEnQd=gYKTd1knRsWuxCb=Etv5nAre%2BXJS_s5FgVteYA@mail.gmail.com/ Reported-by: Mike Lothian Link: https://bugzilla.kernel.org/show_bug.cgi?id=216829 Reported-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/lkml/20230112171706.294550-1-angelogioacchino.delregno@collabora.com/ Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230113105848.34642-3-nbd@nbd.name commit e5c3ac895750b39ef53b84ff4814617ecd69d556 Author: Lorenzo Bianconi Date: Fri Jan 13 11:58:47 2023 +0100 wifi: mt76: handle possible mt76_rx_token_consume failures Take into account possible error conditions of mt76_rx_token_consume routine in mt7915_mmio_wed_init_rx_buf() and mt76_dma_add_buf() Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau (cherry picked from commit 96f134dc19645be4994e89a2f68fa89309becbee) Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230113105848.34642-2-nbd@nbd.name commit 1132d1c834d6185c89aef07c860fc143a6f2db93 Author: Lorenzo Bianconi Date: Fri Jan 13 11:58:46 2023 +0100 wifi: mt76: dma: do not increment queue head if mt76_dma_add_buf fails Do not increment queue head if mt76_dma_add_buf fails for Wireless Ethernet Dispatcher rx queues. Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau (cherry picked from commit fe13dad8992be0b26c1be390bcd111acf9892c17) Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230113105848.34642-1-nbd@nbd.name commit e02ac3e7329f76c5de40cba2746cbe165f571dff Author: Jingbo Xu Date: Thu Jan 12 14:54:31 2023 +0800 erofs: clean up parsing of fscache related options ... to avoid the mess of conditional preprocessing as we are continually adding fscache related mount options. Reviewd-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Jingbo Xu Link: https://lore.kernel.org/r/20230112065431.124926-3-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit b22c7b97189d461d7143052da83b36390c623b54 Author: Jingbo Xu Date: Thu Jan 12 14:54:30 2023 +0800 erofs: add documentation for 'domain_id' mount option Since the EROFS share domain feature for fscache mode has been available since Linux v6.1, let's add documentation for 'domain_id' mount option. Cc: linux-doc@vger.kernel.org Reviewed-by: Jia Zhu Signed-off-by: Jingbo Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230112065431.124926-2-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 7ea55715c421d22c1b63f7129cae6a654091b695 Author: Ard Biesheuvel Date: Fri Dec 9 12:10:13 2022 +0100 arm64: efi: Account for the EFI runtime stack in stack unwinder The EFI runtime services run from a dedicated stack now, and so the stack unwinder needs to be informed about this. Acked-by: Mark Rutland Signed-off-by: Ard Biesheuvel commit 8a9a1a18731eb123e35f48176380a18b9782845e Author: Ard Biesheuvel Date: Fri Oct 28 16:39:14 2022 +0200 arm64: efi: Avoid workqueue to check whether EFI runtime is live Comparing current_work() against efi_rts_work.work is sufficient to decide whether current is currently running EFI runtime services code at any level in its call stack. However, there are other potential users of the EFI runtime stack, such as the ACPI subsystem, which may invoke efi_call_virt_pointer() directly, and so any sync exceptions occurring in firmware during those calls are currently misidentified. So instead, let's check whether the stashed value of the thread stack pointer points into current's thread stack. This can only be the case if current was interrupted while running EFI runtime code. Note that this implies that we should clear the stashed value after switching back, to avoid false positives. Reviewed-by: Mark Rutland Signed-off-by: Ard Biesheuvel commit 87b93b678e95c7d93fe6a55b0e0fbda26d8c7760 Author: Geetha sowjanya Date: Fri Jan 13 11:49:02 2023 +0530 octeontx2-pf: Avoid use of GFP_KERNEL in atomic context Using GFP_KERNEL in preemption disable context, causing below warning when CONFIG_DEBUG_ATOMIC_SLEEP is enabled. [ 32.542271] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 [ 32.550883] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 [ 32.558707] preempt_count: 1, expected: 0 [ 32.562710] RCU nest depth: 0, expected: 0 [ 32.566800] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc2-00269-gae9dcb91c606 #7 [ 32.576188] Hardware name: Marvell CN106XX board (DT) [ 32.581232] Call trace: [ 32.583670] dump_backtrace.part.0+0xe0/0xf0 [ 32.587937] show_stack+0x18/0x30 [ 32.591245] dump_stack_lvl+0x68/0x84 [ 32.594900] dump_stack+0x18/0x34 [ 32.598206] __might_resched+0x12c/0x160 [ 32.602122] __might_sleep+0x48/0xa0 [ 32.605689] __kmem_cache_alloc_node+0x2b8/0x2e0 [ 32.610301] __kmalloc+0x58/0x190 [ 32.613610] otx2_sq_aura_pool_init+0x1a8/0x314 [ 32.618134] otx2_open+0x1d4/0x9d0 To avoid use of GFP_ATOMIC for memory allocation, disable preemption after all memory allocation is done. Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free") Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Kovvuri Goutham Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 4101971aaf0989b9ad04ea4c37c72645a6cc3ce4 Merge: 3a415d59c1dbe 0b2c59720e658 Author: David S. Miller Date: Mon Jan 16 13:40:55 2023 +0000 Merge branch 'l2tp-races' Cong Wang says: ==================== l2tp: fix race conditions in l2tp_tunnel_register() This patchset contains two patches, the first one is a preparation for the second one which is the actual fix. Please find more details in each patch description. I have ran the l2tp test (https://github.com/katalix/l2tp-ktest), all test cases are passed. v3: preserve EEXIST errno for user-space v2: move IDR allocation to l2tp_tunnel_register() ==================== Signed-off-by: David S. Miller commit 0b2c59720e65885a394a017d0cf9cab118914682 Author: Cong Wang Date: Fri Jan 13 19:01:37 2023 -0800 l2tp: close all race conditions in l2tp_tunnel_register() The code in l2tp_tunnel_register() is racy in several ways: 1. It modifies the tunnel socket _after_ publishing it. 2. It calls setup_udp_tunnel_sock() on an existing socket without locking. 3. It changes sock lock class on fly, which triggers many syzbot reports. This patch amends all of them by moving socket initialization code before publishing and under sock lock. As suggested by Jakub, the l2tp lockdep class is not necessary as we can just switch to bh_lock_sock_nested(). Fixes: 37159ef2c1ae ("l2tp: fix a lockdep splat") Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation") Reported-by: syzbot+52866e24647f9a23403f@syzkaller.appspotmail.com Reported-by: syzbot+94cc2a66fc228b23f360@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Cc: Guillaume Nault Cc: Jakub Sitnicki Cc: Eric Dumazet Cc: Tom Parkin Signed-off-by: Cong Wang Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller commit c4d48a58f32c5972174a1d01c33b296fe378cce0 Author: Cong Wang Date: Fri Jan 13 19:01:36 2023 -0800 l2tp: convert l2tp_tunnel_list to idr l2tp uses l2tp_tunnel_list to track all registered tunnels and to allocate tunnel ID's. IDR can do the same job. More importantly, with IDR we can hold the ID before a successful registration so that we don't need to worry about late error handling, it is not easy to rollback socket changes. This is a preparation for the following fix. Cc: Tetsuo Handa Cc: Guillaume Nault Cc: Jakub Sitnicki Cc: Eric Dumazet Cc: Tom Parkin Signed-off-by: Cong Wang Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller commit 3a415d59c1dbec9d772dbfab2d2520d98360caae Author: Eric Dumazet Date: Fri Jan 13 16:48:49 2023 +0000 net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has to destroy the just initialized taprio qdisc, and taprio_destroy() is called. However, the hrtimer used by taprio had already fired, therefore advance_sched() called __netif_schedule(). Then net_tx_action was trying to use a destroyed qdisc. We can not undo the __netif_schedule(), so we must wait until one cpu serviced the qdisc before we can proceed. Many thanks to Alexander Potapenko for his help. [1] BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline] __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Uninit was created at: slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline] __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Alexander Potapenko Cc: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 21705c771934f24cab8beb554e3b7f40e3511ad7 Merge: c296c77efb669 696e1a48b1a1b Author: David S. Miller Date: Mon Jan 16 13:10:16 2023 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pable Neira Ayuso says: ==================== The following patchset contains Netfilter fixes for net: 1) Increase timeout to 120 seconds for netfilter selftests to fix nftables transaction tests, from Florian Westphal. 2) Fix overflow in bitmap_ip_create() due to integer arithmetics in a 64-bit bitmask, from Gavrilov Ilia. 3) Fix incorrect arithmetics in nft_payload with double-tagged vlan matching. ==================== Signed-off-by: David S. Miller commit c296c77efb66994d94d9f706446a115581226550 Author: Kurt Kanzenbach Date: Sat Jan 14 13:04:37 2023 +0100 net: stmmac: Fix queue statistics reading Correct queue statistics reading. All queue statistics are stored as unsigned long values. The retrieval for ethtool fetches these values as u64. However, on some systems the size of the counters are 32 bit. That yields wrong queue statistic counters e.g., on arm32 systems such as the stm32mp157. Fix it by using the correct data type. Tested on Olimex STMP157-OLinuXino-LIME2 by simple running linuxptp for a short period of time: Non-patched kernel: |root@st1:~# ethtool -S eth0 | grep q0 | q0_tx_pkt_n: 3775276254951 # ??? | q0_tx_irq_n: 879 | q0_rx_pkt_n: 1194000908909 # ??? | q0_rx_irq_n: 278 Patched kernel: |root@st1:~# ethtool -S eth0 | grep q0 | q0_tx_pkt_n: 2434 | q0_tx_irq_n: 1274 | q0_rx_pkt_n: 1604 | q0_rx_irq_n: 846 Fixes: 68e9c5dee1cf ("net: stmmac: add ethtool per-queue statistic framework") Signed-off-by: Kurt Kanzenbach Cc: Vijayakannan Ayyathurai Cc: Wong Vee Khee Signed-off-by: David S. Miller commit 31b62a98de42cf65d76e4dcfb571af067d27d83a Author: Jonas Karlman Date: Tue Jan 10 17:29:58 2023 +0000 pinctrl: rockchip: fix reading pull type on rk3568 When reading pinconf-pins from debugfs it fails to get the configured pull type on RK3568, "unsupported pinctrl type" error messages is also reported. Fix this by adding support for RK3568 in rockchip_get_pull, including a reverse of the pull-up value swap applied in rockchip_set_pull so that pull-up is correctly reported in pinconf-pins. Also update the workaround comment to reflect affected pins, GPIO0_D3-D6. Fixes: c0dadc0e47a8 ("pinctrl: rockchip: add support for rk3568") Signed-off-by: Jonas Karlman Reviewed-by: Heiko Stuebner Reviewed-by: Jianqun Xu Link: https://lore.kernel.org/r/20230110172955.1258840-1-jonas@kwiboo.se Signed-off-by: Linus Walleij commit b870e73a56c4cccbec33224233eaf295839f228c Author: Szymon Heidrich Date: Wed Jan 11 18:50:31 2023 +0100 wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich Reviewed-by: Alexander Duyck Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230111175031.7049-1-szymon.heidrich@gmail.com commit ed05cb177ae5cd7f02f1d6e7706ba627d30f1696 Author: Arend van Spriel Date: Wed Jan 11 12:24:19 2023 +0100 wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices A sanity check was introduced considering maximum flowrings above 256 as insane and effectively aborting the device probe. This resulted in regression for number of users as the value turns out to be sane after all. Fixes: 2aca4f3734bd ("brcmfmac: return error when getting invalid max_flowrings from dongle") Reported-by: chainofflowers Link: https://lore.kernel.org/all/4781984.GXAFRqVoOG@luna/ Reported-by: Christian Marillat Link: https://bugzilla.kernel.org/show_bug.cgi?id=216894 Cc: stable@vger.kernel.org Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230111112419.24185-1-arend.vanspriel@broadcom.com commit aadb50d1571211c73248605bcc1f4b9f8e3d1364 Author: Arend van Spriel Date: Tue Jan 3 13:41:16 2023 +0100 wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device When dealing with a device for 2GHz band only the wiphy->bands for 5GHz will be NULL. This would result in a NULL-deref in the brcmf_cfg80211_dump_survey() function. Rework the code with a for-loop to make it easier to add another band. Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd AutoChannelSelection") Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230103124117.271988-3-arend.vanspriel@broadcom.com commit e5d1ab1a73ad275c0205cbc09a0a9f9f42bbb87f Author: Arend van Spriel Date: Tue Jan 3 13:41:15 2023 +0100 wifi: brcmfmac: avoid handling disabled channels for survey dump An issue was reported in which periodically error messages are printed in the kernel log: [ 26.303445] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6 [ 26.303554] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.bin failed with error -2 [ 26.516752] brcmfmac_wcc: brcmf_wcc_attach: executing [ 26.528264] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Jan 4 2021 19:56:29 version 7.45.229 (617f1f5 CY) FWID 01-2dbd9d2e [ 27.076829] Bluetooth: hci0: BCM: features 0x2f [ 27.078592] Bluetooth: hci0: BCM43455 37.4MHz Raspberry Pi 3+ [ 27.078601] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0342 [ 30.142104] Adding 102396k swap on /var/swap. Priority:-2 extents:1 across:102396k SS [ 30.590017] Bluetooth: MGMT ver 1.22 [ 104.897615] brcmfmac: cfg80211_set_channel: set chanspec 0x100e fail, reason -52 [ 104.897992] brcmfmac: cfg80211_set_channel: set chanspec 0xd022 fail, reason -52 [ 105.007672] brcmfmac: cfg80211_set_channel: set chanspec 0xd026 fail, reason -52 [ 105.117654] brcmfmac: cfg80211_set_channel: set chanspec 0xd02a fail, reason -52 [ 105.227636] brcmfmac: cfg80211_set_channel: set chanspec 0xd02e fail, reason -52 [ 106.987552] brcmfmac: cfg80211_set_channel: set chanspec 0xd090 fail, reason -52 [ 106.987911] brcmfmac: cfg80211_set_channel: set chanspec 0xd095 fail, reason -52 [ 106.988233] brcmfmac: cfg80211_set_channel: set chanspec 0xd099 fail, reason -52 [ 106.988565] brcmfmac: cfg80211_set_channel: set chanspec 0xd09d fail, reason -52 [ 106.988909] brcmfmac: cfg80211_set_channel: set chanspec 0xd0a1 fail, reason -52 This happens in brcmf_cfg80211_dump_survey() because we try a disabled channel. When channel is marked as disabled we do not need to fill any other info so bail out. Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd AutoChannelSelection") Reported-by: Stefan Wahren Signed-off-by: Arend van Spriel Tested-by: Stefan Wahren Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230103124117.271988-2-arend.vanspriel@broadcom.com commit 8c0089882a62da2d75fb655e781cc33cc1351f6a Author: Martin Liska Date: Mon Jan 16 11:45:33 2023 +0100 scripts: support GNU make 4.4 in jobserver-exec Starting with GNU make 4.4, --jobserver-auth newly uses named pipe (fifo) instead of part of opened file descriptors: https://www.gnu.org/software/make/manual/html_node/POSIX-Jobserver.html Support also the new format. Signed-off-by: Martin Liska Signed-off-by: Masahiro Yamada commit e2f7096f1e76845cfa6e19b54f6f3674925fc28b Merge: 88bcc6fa5eaea 43d5f5d636997 Author: Arnd Bergmann Date: Mon Jan 16 11:05:13 2023 +0100 Merge tag 'riscv-dt-fixes-for-v6.2-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V DeviceTrees for v6.2 SiFive: A solitary fix for the PCI memory regions on the unmatched, triggered by an SM768. No-one must have tried one until just recently! Signed-off-by: Conor Dooley * tag 'riscv-dt-fixes-for-v6.2-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: sifive: fu740: fix size of pcie 32bit memory Link: https://lore.kernel.org/r/Y78rn+0fVNOxHLKt@spud Signed-off-by: Arnd Bergmann commit 88bcc6fa5eaea9b4b520c429f806eb87c639909b Merge: 45c734817847e 80502ffab2fa9 Author: Arnd Bergmann Date: Mon Jan 16 11:04:28 2023 +0100 Merge tag 'mvebu-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into arm/fixes mvebu fixes for 6.2 (part 1) Fix regression for gpio support on Armada 38x and Armada 38x Fix address for UART1 on AC5/AC5X * tag 'mvebu-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: AC5/AC5X: Fix address for UART1 Revert "ARM: dts: armada-39x: Fix compatible string for gpios" Revert "ARM: dts: armada-38x: Fix compatible string for gpios" Link: https://lore.kernel.org/r/87mt6mg08k.fsf@BL-laptop Signed-off-by: Arnd Bergmann commit 8e88a0feebb241cab0253698b2f7358b6ebec802 Author: Marek Vasut Date: Mon Jan 16 10:49:57 2023 +0100 gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode Always configure GPIO pins which are used as interrupt source as INPUTs. In case the default pin configuration is OUTPUT, or the prior stage does configure the pins as OUTPUT, then Linux will not reconfigure the pin as INPUT and no interrupts are received. Always configure the interrupt source GPIO pin as input to fix the above case. Reviewed-by: Linus Walleij Fixes: 07bd1a6cc7cbb ("MXC arch: Add gpio support for the whole platform") Signed-off-by: Marek Vasut Signed-off-by: Bartosz Golaszewski commit e5464277625c1aca5c002e0f470377cdd6816dcf Author: Marek Vasut Date: Mon Jan 16 10:49:56 2023 +0100 gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock The driver currently performs register read-modify-write without locking in its irqchip part, this could lead to a race condition when configuring interrupt mode setting. Add the missing bgpio spinlock lock/unlock around the register read-modify-write. Reviewed-by: Linus Walleij Reviewed-by: Marc Zyngier Fixes: 07bd1a6cc7cbb ("MXC arch: Add gpio support for the whole platform") Signed-off-by: Marek Vasut Signed-off-by: Bartosz Golaszewski commit 5f5cc9ed992cbab6361f198966f0edba5fc52688 Author: Yair Podemsky Date: Tue Jan 10 18:02:06 2023 +0200 x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings Once disable_freq_invariance_work is called the scale_freq_tick function will not compute or update the arch_freq_scale values. However the scheduler will still read these values and use them. The result is that the scheduler might perform unfair decisions based on stale values. This patch adds the step of setting the arch_freq_scale values for all cpus to the default (max) value SCHED_CAPACITY_SCALE, Once all cpus have the same arch_freq_scale value the scaling is meaningless. Signed-off-by: Yair Podemsky Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Link: https://lore.kernel.org/r/20230110160206.75912-1-ypodemsk@redhat.com commit 5657c116783545fb49cd7004994c187128552b12 Author: Waiman Long Date: Sun Jan 15 14:31:22 2023 -0500 sched/core: Fix NULL pointer access fault in sched_setaffinity() with non-SMP configs The kernel commit 9a5418bc48ba ("sched/core: Use kfree_rcu() in do_set_cpus_allowed()") introduces a bug for kernels built with non-SMP configs. Calling sched_setaffinity() on such a uniprocessor kernel will cause cpumask_copy() to be called with a NULL pointer leading to general protection fault. This is not really a problem in real use cases as there aren't that many uniprocessor kernel configs in use and calling sched_setaffinity() on such a uniprocessor system doesn't make sense. Fix this problem by making sure cpumask_copy() will not be called in such a case. Fixes: 9a5418bc48ba ("sched/core: Use kfree_rcu() in do_set_cpus_allowed()") Reported-by: kernel test robot Signed-off-by: Waiman Long Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Link: https://lore.kernel.org/r/20230115193122.563036-1-longman@redhat.com commit ee9fffdc3887a46eab3209bc46b228b543c75fa6 Author: Christophe JAILLET Date: Sat Jan 14 09:54:04 2023 +0100 fbdev: omapfb: Use kstrtobool() instead of strtobool() strtobool() is the same as kstrtobool(). However, the latter is more used within the kernel. In order to remove strtobool() and slightly simplify kstrtox.h, switch to the other function name. While at it, include the corresponding header file () Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit 67a90bccad3d20829bea35cb38ad744d9b6e30f4 Author: Randy Dunlap Date: Thu Jan 12 22:36:39 2023 -0800 fbdev: fbmon: fix function name in kernel-doc Fix a kernel-doc warning by correcting the function name in the kernel-doc comment: drivers/video/fbdev/core/fbmon.c:1073: warning: expecting prototype for fb_get_hblank_by_freq(). Prototype was for fb_get_hblank_by_hfreq() instead Signed-off-by: Randy Dunlap Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 71dfd381a7c051f16a61f82fbd38a4cca563bdca Author: Duke Xin(辛安文) Date: Sun Jan 15 18:33:28 2023 -0800 USB: serial: option: add Quectel EM05CN modem The EM05CN modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "MBIM" : AT + MBIM + DIAG + NMEA + MODEM "RMNET" : AT + DIAG + NMEA + Modem + QMI The detailed description of the USB configuration for each mode as follows: MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0312 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0312 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Duke Xin(辛安文) Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 1541dd0097c0f8f470e76eddf5120fc55a7e3101 Author: Duke Xin(辛安文) Date: Sun Jan 15 18:07:27 2023 -0800 USB: serial: option: add Quectel EM05CN (SG) modem The EM05CN (SG) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "MBIM" : AT + MBIM + DIAG + NMEA + MODEM "RMNET" : AT + DIAG + NMEA + Modem + QMI The detailed description of the USB configuration for each mode as follows: MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0310 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0310 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Duke Xin(辛安文) Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 3f9e76e31704a325170e5aec2243c8d084d74854 Author: Michael Adler Date: Tue Jan 3 14:48:50 2023 +0100 USB: serial: cp210x: add SCALANCE LPE-9000 device id Add the USB serial console device ID for Siemens SCALANCE LPE-9000 which have a USB port for their serial console. Signed-off-by: Michael Adler Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit d9bbb15881046bd76f8710c76e26a740eee997ef Author: Ali Mirghasemi Date: Wed Dec 28 15:08:47 2022 +0330 USB: serial: option: add Quectel EC200U modem Add support for EC200U modem 0x0901: EC200U - AT + AP + CP + NMEA + DIAG + MOS usb-device output: T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0901 Rev= 3.18 S: Manufacturer=Android S: Product=Android C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Ali Mirghasemi Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit b72d13977689f0c717444010e108c4f20658dfee Author: Duke Xin(辛安文) Date: Tue Dec 27 01:51:27 2022 -0800 USB: serial: option: add Quectel EM05-G (RS) modem The EM05-G (RS) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "RMNET" : AT + DIAG + NMEA + Modem + QMI "MBIM" : MBIM + AT + DIAG + NMEA + Modem The detailed description of the USB configuration for each mode as follows: RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0314 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0314 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Duke Xin(辛安文) Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 216f764716f34fe68cedc7296ae2043a7727e640 Author: Yu Kuai Date: Tue Jan 3 16:47:55 2023 +0800 block, bfq: switch 'bfqg->ref' to use atomic refcount apis The updating of 'bfqg->ref' should be protected by 'bfqd->lock', however, during code review, we found that bfq_pd_free() update 'bfqg->ref' without holding the lock, which is problematic: 1) bfq_pd_free() triggered by removing cgroup is called asynchronously; 2) bfqq will grab bfqg reference, and exit bfqq will drop the reference, which can concurrent with 1). Unfortunately, 'bfqd->lock' can't be held here because 'bfqd' might already be freed in bfq_pd_free(). Fix the problem by using atomic refcount apis. Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230103084755.1256479-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 6618d69aa129a8fc613e64775d5019524c6f231b Author: Miguel Ojeda Date: Tue Dec 13 19:03:55 2022 +0100 rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks At the moment it is possible to perform unsafe operations in the arguments of `pr_*` macros since they are evaluated inside an `unsafe` block: let x = &10u32 as *const u32; pr_info!("{}", *x); In other words, this is a soundness issue. Fix it so that it requires an explicit `unsafe` block. Reported-by: Wedson Almeida Filho Reported-by: Domen Puncer Kugler Link: https://github.com/Rust-for-Linux/linux/issues/479 Signed-off-by: Miguel Ojeda Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Reviewed-by: Björn Roy Baron Reviewed-by: Vincenzo Palazzo commit a608da3bd730d718f2d3ebec1c26f9865f8f17ce Author: Damien Le Moal Date: Fri Jan 6 17:43:06 2023 +0900 zonefs: Detect append writes at invalid locations Using REQ_OP_ZONE_APPEND operations for synchronous writes to sequential files succeeds regardless of the zone write pointer position, as long as the target zone is not full. This means that if an external (buggy) application writes to the zone of a sequential file underneath the file system, subsequent file write() operation will succeed but the file size will not be correct and the file will contain invalid data written by another application. Modify zonefs_file_dio_append() to check the written sector of an append write (returned in bio->bi_iter.bi_sector) and return -EIO if there is a mismatch with the file zone wp offset field. This change triggers a call to zonefs_io_error() and a zone check. Modify zonefs_io_error_cb() to not expose the unexpected data after the current inode size when the errors=remount-ro mode is used. Other error modes are correctly handled already. Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn commit 5dc4c995db9eb45f6373a956eb1f69460e69e6d4 Author: Linus Torvalds Date: Sun Jan 15 09:22:43 2023 -0600 Linux 6.2-rc4 commit a323e6b5737bb6e3d3946369b97099abb7dde695 Author: Jensen Huang Date: Fri Jan 13 14:44:57 2023 +0800 arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1 This fixes the following issue: pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22 Signed-off-by: Jensen Huang Link: https://lore.kernel.org/r/20230113064457.7105-1-jensenhuang@friendlyarm.com Signed-off-by: Heiko Stuebner commit f0f70ddb8f3bdbe670b1fab07271dd772e54c341 Merge: 8aa9761223af6 26ce6ec364f18 Author: Linus Torvalds Date: Sun Jan 15 07:17:44 2023 -0600 Merge tag 'x86_urgent_for_v6.2_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Make sure the poking PGD is pinned for Xen PV as it requires it this way - Fixes for two resctrl races when moving a task or creating a new monitoring group - Fix SEV-SNP guests running under HyperV where MTRRs are disabled to not return a UC- type mapping type on memremap() and thus cause a serious slowdown - Fix insn mnemonics in bioscall.S now that binutils is starting to fix confusing insn suffixes * tag 'x86_urgent_for_v6.2_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: fix poking_init() for Xen PV guests x86/resctrl: Fix event counts regression in reused RMIDs x86/resctrl: Fix task CLOSID/RMID update race x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case x86/boot: Avoid using Intel mnemonics in AT&T syntax asm commit 8aa9761223af6a075f9904d035b57cef9b26aaab Merge: b1d63f0c777b6 e7a293658c20a Author: Linus Torvalds Date: Sun Jan 15 07:12:58 2023 -0600 Merge tag 'edac_urgent_for_v6.2_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - Fix the EDAC device's confusion in the polling setting units - Fix a memory leak in highbank's probing function * tag 'edac_urgent_for_v6.2_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/highbank: Fix memory leak in highbank_mc_probe() EDAC/device: Fix period calculation in edac_device_reset_delay_period() commit b1d63f0c777b6df1ab53c5597d5fc25753f52f07 Merge: 7c69844052411 f12cd06109f47 Author: Linus Torvalds Date: Sun Jan 15 07:09:41 2023 -0600 Merge tag 'powerpc-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a build failure with some versions of ld that have an odd version string - Fix incorrect use of mutex in the IMC PMU driver Thanks to Kajol Jain, Michael Petlan, Ojaswin Mujoo, Peter Zijlstra, and Yang Yingliang. * tag 'powerpc-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s/hash: Make stress_hpt_timer_fn() static powerpc/imc-pmu: Fix use of mutex in IRQs disabled section powerpc/boot: Fix incorrect version calculation issue in ld_version commit 7c698440524117dca7534592db0e7f465ae4d0bb Merge: 4f43ade45dc57 142e821f68cf5 Author: Linus Torvalds Date: Sat Jan 14 10:48:15 2023 -0600 Merge tag 'iommu-fixes-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Core: Fix an iommu-group refcount leak - Fix overflow issue in IOVA alloc path - ARM-SMMU fixes from Will: - Fix VFIO regression on NXP SoCs by reporting IOMMU_CAP_CACHE_COHERENCY - Fix SMMU shutdown paths to avoid device unregistration race - Error handling fix for Mediatek IOMMU driver * tag 'iommu-fixes-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() iommu/iova: Fix alloc iova overflows issue iommu: Fix refcount leak in iommu_device_claim_dma_owner iommu/arm-smmu-v3: Don't unregister on shutdown iommu/arm-smmu: Don't unregister on shutdown iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY even betterer commit eb50cd5bfdac61627a5026566cf3b90ced7b141c Author: Dmitry Perchanov Date: Wed Jan 11 14:24:25 2023 +0200 iio: hid: fix the retval in gyro_3d_capture_sample Return value should be zero for success. This was forgotten for timestamp feature. Verified on RealSense cameras. Fixes: 4648cbd8fb92 ("iio: hid-sensor-gyro-3d: Add timestamp channel") Signed-off-by: Dmitry Perchanov Link: https://lore.kernel.org/r/7c1809dc74eb2f58a20595f4d02e76934f8e9219.camel@intel.com Cc: Signed-off-by: Jonathan Cameron commit f7b23d1c35d8b8de1425bdfccaefd01f3b7c9d1c Author: Dmitry Perchanov Date: Wed Jan 11 14:22:10 2023 +0200 iio: hid: fix the retval in accel_3d_capture_sample Return value should be zero for success. This was forgotten for timestamp feature. Verified on RealSense cameras. Fixes: a96cd0f901ee ("iio: accel: hid-sensor-accel-3d: Add timestamp") Signed-off-by: Dmitry Perchanov Link: https://lore.kernel.org/r/a6dc426498221c81fa71045b41adf782ebd42136.camel@intel.com Cc: Signed-off-by: Jonathan Cameron commit 4f43ade45dc57fc3b4a5cb598a6f4916dcc418ba Merge: 880ca43e5c334 115d9d77bb0f9 Author: Linus Torvalds Date: Sat Jan 14 10:08:08 2023 -0600 Merge tag 'fixes-2023-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "memblock: always release pages to the buddy allocator in memblock_free_late() If CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, memblock_free_pages() only releases pages to the buddy allocator if they are not in the deferred range. This is correct for free pages (as defined by for_each_free_mem_pfn_range_in_zone()) because free pages in the deferred range will be initialized and released as part of the deferred init process. memblock_free_pages() is called by memblock_free_late(), which is used to free reserved ranges after memblock_free_all() has run. All pages in reserved ranges have been initialized at that point, and accordingly, those pages are not touched by the deferred init process. This means that currently, if the pages that memblock_free_late() intends to release are in the deferred range, they will never be released to the buddy allocator. They will forever be reserved. In addition, memblock_free_pages() calls kmsan_memblock_free_pages(), which is also correct for free pages but is not correct for reserved pages. KMSAN metadata for reserved pages is initialized by kmsan_init_shadow(), which runs shortly before memblock_free_all(). For both of these reasons, memblock_free_pages() should only be called for free pages, and memblock_free_late() should call __free_pages_core() directly instead. One case where this issue can occur in the wild is EFI boot on x86_64. The x86 EFI code reserves all EFI boot services memory ranges via memblock_reserve() and frees them later via memblock_free_late() (efi_reserve_boot_services() and efi_free_boot_services(), respectively). If any of those ranges happens to fall within the deferred init range, the pages will not be released and that memory will be unavailable. For example, on an Amazon EC2 t3.micro VM (1 GB) booting via EFI: v6.2-rc2: Node 0, zone DMA spanned 4095 present 3999 managed 3840 Node 0, zone DMA32 spanned 246652 present 245868 managed 178867 v6.2-rc2 + patch: Node 0, zone DMA spanned 4095 present 3999 managed 3840 Node 0, zone DMA32 spanned 246652 present 245868 managed 222816 # +43,949 pages" * tag 'fixes-2023-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm: Always release pages to the buddy allocator in memblock_free_late(). commit 880ca43e5c334c32a8af125e456d1a23314aa416 Merge: 8b7be52f3f0d0 42633ed852dea Author: Linus Torvalds Date: Sat Jan 14 10:04:00 2023 -0600 Merge tag 'hardening-v6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening fixes from Kees Cook: - Fix CFI hash randomization with KASAN (Sami Tolvanen) - Check size of coreboot table entry and use flex-array * tag 'hardening-v6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kbuild: Fix CFI hash randomization with KASAN firmware: coreboot: Check size of table entry and use flex-array commit 8b7be52f3f0d0c24ee147ba7cab6c7fa4f9bcfbb Merge: b35ad63eeccad da35048f26006 Author: Linus Torvalds Date: Sat Jan 14 08:17:27 2023 -0600 Merge tag 'modules-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module fix from Luis Chamberlain: "Just one fix for modules by Nick" * tag 'modules-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: kallsyms: Fix scheduling with interrupts disabled in self-test commit b35ad63eeccadbcc83f295a64a029f7e7188444f Merge: 8e768130857d0 a152d05ae4a71 Author: Linus Torvalds Date: Sat Jan 14 08:08:25 2023 -0600 Merge tag '6.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: - memory leak and double free fix - two symlink fixes - minor cleanup fix - two smb1 fixes * tag '6.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix uninitialized memory read for smb311 posix symlink create cifs: fix potential memory leaks in session setup cifs: do not query ifaces on smb1 mounts cifs: fix double free on failed kerberos auth cifs: remove redundant assignment to the variable match cifs: fix file info setting in cifs_open_file() cifs: fix file info setting in cifs_query_path_info() commit 8e768130857d08a6765f3287ad3f89c1b7d50e53 Merge: 34cbf89afc866 f58c89700630d Author: Linus Torvalds Date: Sat Jan 14 07:57:25 2023 -0600 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two minor fixes in the hisi_sas driver which only impact enterprise style multi-expander and shared disk situations and no core changes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id scsi: hisi_sas: Use abort task set to reset SAS disks when discovered commit 34cbf89afc866df36d6b9177e4f99160a4823382 Merge: 97ec4d559d939 22eebaa631c40 Author: Linus Torvalds Date: Sat Jan 14 07:52:11 2023 -0600 Merge tag 'ata-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fix from Damien Le Moal: "A single fix to prevent building the pata_cs5535 driver with user mode linux as it uses msr operations that are not defined with UML" * tag 'ata-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_cs5535: Don't build on UML commit a22b7388d658ecfcd226600c8c34ce4481e88655 Author: Rahul Rameshbabu Date: Thu Jan 12 16:55:29 2023 -0800 sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb Peek at old qdisc and graft only when deleting a leaf class in the htb, rather than when deleting the htb itself. Do not peek at the qdisc of the netdev queue when destroying the htb. The caller may already have grafted a new qdisc that is not part of the htb structure being destroyed. This fix resolves two use cases. 1. Using tc to destroy the htb. - Netdev was being prematurely activated before the htb was fully destroyed. 2. Using tc to replace the htb with another qdisc (which also leads to the htb being destroyed). - Premature netdev activation like previous case. Newly grafted qdisc was also getting accidentally overwritten when destroying the htb. Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload") Signed-off-by: Rahul Rameshbabu Reviewed-by: Saeed Mahameed Reviewed-by: Maxim Mikityanskiy Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20230113005528.302625-1-rrameshbabu@nvidia.com Signed-off-by: Jakub Kicinski commit da263fcb86ae1ca40b5329e64ad7d7f69d260477 Merge: 925f3deb45df7 4656d72c1efa4 Author: Jakub Kicinski Date: Fri Jan 13 21:55:49 2023 -0800 Merge branch 'mptcp-userspace-pm-create-sockets-for-the-right-family' Matthieu Baerts says: ==================== mptcp: userspace pm: create sockets for the right family Before these patches, the Userspace Path Manager would allow the creation of subflows with wrong families: taking the one of the MPTCP socket instead of the provided ones and resulting in the creation of subflows with likely not the right source and/or destination IPs. It would also allow the creation of subflows between different families or not respecting v4/v6-only socket attributes. Patch 1 lets the userspace PM select the proper family to avoid creating subflows with the wrong source and/or destination addresses because the family is not the expected one. Patch 2 makes sure the userspace PM doesn't allow the userspace to create subflows for a family that is not allowed. Patch 3 validates scenarios with a mix of v4 and v6 subflows for the same MPTCP connection. These patches fix issues introduced in v5.19 when the userspace path manager has been introduced. ==================== Link: https://lore.kernel.org/r/20230112-upstream-net-20230112-netlink-v4-v6-v1-0-6a8363a221d2@tessares.net Signed-off-by: Jakub Kicinski commit 4656d72c1efa495a58ad6d8b073a60907073e4e6 Author: Matthieu Baerts Date: Thu Jan 12 18:42:53 2023 +0100 selftests: mptcp: userspace: validate v4-v6 subflows mix MPTCP protocol supports having subflows in both IPv4 and IPv6. In Linux, it is possible to have that if the MPTCP socket has been created with AF_INET6 family without the IPV6_V6ONLY option. Here, a new IPv4 subflow is being added to the initial IPv6 connection, then being removed using Netlink commands. Cc: stable@vger.kernel.org # v5.19+ Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc Author: Matthieu Baerts Date: Thu Jan 12 18:42:52 2023 +0100 mptcp: netlink: respect v4/v6-only sockets If an MPTCP socket has been created with AF_INET6 and the IPV6_V6ONLY option has been set, the userspace PM would allow creating subflows using IPv4 addresses, e.g. mapped in v6. The kernel side of userspace PM will also accept creating subflows with local and remote addresses having different families. Depending on the subflow socket's family, different behaviours are expected: - If AF_INET is forced with a v6 address, the kernel will take the last byte of the IP and try to connect to that: a new subflow is created but to a non expected address. - If AF_INET6 is forced with a v4 address, the kernel will try to connect to a v4 address (v4-mapped-v6). A -EBADF error from the connect() part is then expected. It is then required to check the given families can be accepted. This is done by using a new helper for addresses family matching, taking care of IPv4 vs IPv4-mapped-IPv6 addresses. This helper will be re-used later by the in-kernel path-manager to use mixed IPv4 and IPv6 addresses. While at it, a clear error message is now reported if there are some conflicts with the families that have been passed by the userspace. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 6bc1fe7dd748ba5e76e7917d110837cafe7b931c Author: Paolo Abeni Date: Thu Jan 12 18:42:51 2023 +0100 mptcp: explicitly specify sock family at subflow creation time Let the caller specify the to-be-created subflow family. For a given MPTCP socket created with the AF_INET6 family, the current userspace PM can already ask the kernel to create subflows in v4 and v6. If "plain" IPv4 addresses are passed to the kernel, they are automatically mapped in v6 addresses "by accident". This can be problematic because the userspace will need to pass different addresses, now the v4-mapped-v6 addresses to destroy this new subflow. On the other hand, if the MPTCP socket has been created with the AF_INET family, the command to create a subflow in v6 will be accepted but the result will not be the one as expected as new subflow will be created in IPv4 using part of the v6 addresses passed to the kernel: not creating the expected subflow then. No functional change intended for the in-kernel PM where an explicit enforcement is currently in place. This arbitrary enforcement will be leveraged by other patches in a future version. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Cc: stable@vger.kernel.org Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 925f3deb45df73173a33e1e81db77575f4ffde39 Author: Clément Léger Date: Thu Jan 12 17:13:11 2023 +0100 net: lan966x: add missing fwnode_handle_put() for ports node Since the "ethernet-ports" node is retrieved using device_get_named_child_node(), it should be release after using it. Add missing fwnode_handle_put() and move the code that retrieved the node from device-tree to avoid complicated handling in case of error. Fixes: db8bcaad5393 ("net: lan966x: add the basic lan966x driver") Signed-off-by: Clément Léger Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230112161311.495124-1-clement.leger@bootlin.com Signed-off-by: Jakub Kicinski commit 3c463721a73bdb57a913e0d3124677a3758886fc Author: Vladimir Oltean Date: Thu Jan 12 12:54:40 2023 +0200 net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() This lockdep splat says it better than I could: ================================ WARNING: inconsistent lock state 6.2.0-rc2-07010-ga9b9500ffaac-dirty #967 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. kworker/1:3/179 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff3ec4036ce098 (_xmit_ETHER#2){+.?.}-{3:3}, at: netif_freeze_queues+0x5c/0xc0 {IN-SOFTIRQ-W} state was registered at: _raw_spin_lock+0x5c/0xc0 sch_direct_xmit+0x148/0x37c __dev_queue_xmit+0x528/0x111c ip6_finish_output2+0x5ec/0xb7c ip6_finish_output+0x240/0x3f0 ip6_output+0x78/0x360 ndisc_send_skb+0x33c/0x85c ndisc_send_rs+0x54/0x12c addrconf_rs_timer+0x154/0x260 call_timer_fn+0xb8/0x3a0 __run_timers.part.0+0x214/0x26c run_timer_softirq+0x3c/0x74 __do_softirq+0x14c/0x5d8 ____do_softirq+0x10/0x20 call_on_irq_stack+0x2c/0x5c do_softirq_own_stack+0x1c/0x30 __irq_exit_rcu+0x168/0x1a0 irq_exit_rcu+0x10/0x40 el1_interrupt+0x38/0x64 irq event stamp: 7825 hardirqs last enabled at (7825): [] exit_to_kernel_mode+0x34/0x130 hardirqs last disabled at (7823): [] __do_softirq+0x550/0x5d8 softirqs last enabled at (7824): [] __do_softirq+0x46c/0x5d8 softirqs last disabled at (7811): [] ____do_softirq+0x10/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_ETHER#2); lock(_xmit_ETHER#2); *** DEADLOCK *** 3 locks held by kworker/1:3/179: #0: ffff3ec400004748 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1f4/0x6c0 #1: ffff80000a0bbdc8 ((work_completion)(&priv->tx_onestep_tstamp)){+.+.}-{0:0}, at: process_one_work+0x1f4/0x6c0 #2: ffff3ec4036cd438 (&dev->tx_global_lock){+.+.}-{3:3}, at: netif_tx_lock+0x1c/0x34 Workqueue: events enetc_tx_onestep_tstamp Call trace: print_usage_bug.part.0+0x208/0x22c mark_lock+0x7f0/0x8b0 __lock_acquire+0x7c4/0x1ce0 lock_acquire.part.0+0xe0/0x220 lock_acquire+0x68/0x84 _raw_spin_lock+0x5c/0xc0 netif_freeze_queues+0x5c/0xc0 netif_tx_lock+0x24/0x34 enetc_tx_onestep_tstamp+0x20/0x100 process_one_work+0x28c/0x6c0 worker_thread+0x74/0x450 kthread+0x118/0x11c but I'll say it anyway: the enetc_tx_onestep_tstamp() work item runs in process context, therefore with softirqs enabled (i.o.w., it can be interrupted by a softirq). If we hold the netif_tx_lock() when there is an interrupt, and the NET_TX softirq then gets scheduled, this will take the netif_tx_lock() a second time and deadlock the kernel. To solve this, use netif_tx_lock_bh(), which blocks softirqs from running. Fixes: 7294380c5211 ("enetc: support PTP Sync packet one-step timestamping") Signed-off-by: Vladimir Oltean Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230112105440.1786799-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 488e0bf7f34af3d42d1d5e56f7a5a7beaff188a3 Author: Esina Ekaterina Date: Thu Jan 12 10:47:03 2023 +0300 net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs If uhdlc_priv_tsa != 1 then utdm is not initialized. And if ret != NULL then goto undo_uhdlc_init, where utdm is dereferenced. Same if dev == NULL. Found by Astra Linux on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8d68100ab4ad ("soc/fsl/qe: fix err handling of ucc_of_parse_tdm") Signed-off-by: Esina Ekaterina Link: https://lore.kernel.org/r/20230112074703.13558-1-eesina@astralinux.ru Signed-off-by: Jakub Kicinski commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 Author: Jisoo Jang Date: Wed Jan 11 22:19:14 2023 +0900 net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is called twice. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in kfree_skb() Call Trace: dump_stack_lvl (lib/dump_stack.c:106) print_address_description.constprop.0.cold (mm/kasan/report.c:306) kasan_check_range (mm/kasan/generic.c:189) kfree_skb (net/core/skbuff.c:955) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) nfc_llcp_local_put (net/nfc/llcp_core.c:181) llcp_sock_destruct (net/nfc/llcp_sock.c:959) __sk_destruct (net/core/sock.c:2133) sk_destruct (net/core/sock.c:2181) __sk_free (net/core/sock.c:2192) sk_free (net/core/sock.c:2203) llcp_sock_release (net/nfc/llcp_sock.c:646) __sock_release (net/socket.c:650) sock_close (net/socket.c:1365) __fput (fs/file_table.c:306) task_work_run (kernel/task_work.c:179) ptrace_notify (kernel/signal.c:2354) syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) syscall_exit_to_user_mode (kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:86) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) Allocated by task 4719: kasan_save_stack (mm/kasan/common.c:45) __kasan_slab_alloc (mm/kasan/common.c:325) slab_post_alloc_hook (mm/slab.h:766) kmem_cache_alloc_node (mm/slub.c:3497) __alloc_skb (net/core/skbuff.c:552) pn533_recv_response (drivers/nfc/pn533/usb.c:65) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704) tasklet_action_common.isra.0 (kernel/softirq.c:797) __do_softirq (kernel/softirq.c:571) Freed by task 1901: kasan_save_stack (mm/kasan/common.c:45) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/genericdd.c:518) __kasan_slab_free (mm/kasan/common.c:236) kmem_cache_free (mm/slub.c:3809) kfree_skbmem (net/core/skbuff.c:874) kfree_skb (net/core/skbuff.c:931) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617) nfc_unregister_device (net/nfc/core.c:1179) pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846) pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) usb_unbind_interface (drivers/usb/core/driver.c:458) device_release_driver_internal (drivers/base/dd.c:1279) bus_remove_device (drivers/base/bus.c:529) device_del (drivers/base/core.c:3665) usb_disable_device (drivers/usb/core/message.c:1420) usb_disconnect (drivers/usb/core.c:2261) hub_event (drivers/usb/core/hub.c:5833) process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423) kthread (kernel/kthread.c:319) ret_from_fork (arch/x86/entry/entry_64.S:301) Fixes: 3536da06db0b ("NFC: llcp: Clean local timers and works when removing a device") Signed-off-by: Jisoo Jang Link: https://lore.kernel.org/r/20230111131914.3338838-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Jakub Kicinski commit ee16c404f9bd03c6e083f76d45be0b6a774c0d14 Merge: 3d25b1e836927 b0907cadabcae Author: Jens Axboe Date: Fri Jan 13 20:47:48 2023 -0700 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.2 Pull MD fix from Song: "It fixes an issue introduced by recent code refactor." * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix incorrect declaration about claim_rdev in md_import_device commit 84ed64b1a7a7fcd507598dee7708c1f225123711 Author: Maurizio Lombardi Date: Tue Jan 10 13:53:10 2023 +0100 scsi: target: core: Fix warning on RT kernels Calling spin_lock_irqsave() does not disable the interrupts on realtime kernels, remove the warning and replace assert_spin_locked() with lockdep_assert_held(). Signed-off-by: Maurizio Lombardi Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230110125310.55884-1-mlombard@redhat.com Signed-off-by: Martin K. Petersen commit 97ec4d559d939743e8af83628be5af8da610d9dc Merge: 2ce7592df99f7 3d25b1e836927 Author: Linus Torvalds Date: Fri Jan 13 17:41:19 2023 -0600 Merge tag 'block-6.2-2023-01-13' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Nothing major in here, just a collection of NVMe fixes and dropping a wrong might_sleep() that static checkers tripped over but which isn't valid" * tag 'block-6.2-2023-01-13' of git://git.kernel.dk/linux: MAINTAINERS: stop nvme matching for nvmem files nvme: don't allow unprivileged passthrough on partitions nvme: replace the "bool vec" arguments with flags in the ioctl path nvme: remove __nvme_ioctl nvme-pci: fix error handling in nvme_pci_enable() nvme-pci: add NVME_QUIRK_IDENTIFY_CNS quirk to Apple T2 controllers nvme-apple: add NVME_QUIRK_IDENTIFY_CNS quirk to fix regression block: Drop spurious might_sleep() from blk_put_queue() commit 2ce7592df99f7356cc8697ad10849987237abca4 Merge: 9e058c2952cad 544d163d659d4 Author: Linus Torvalds Date: Fri Jan 13 17:37:09 2023 -0600 Merge tag 'io_uring-6.2-2023-01-13' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A fix for a regression that happened last week, rest is fixes that will be headed to stable as well. In detail: - Fix for a regression added with the leak fix from last week (me) - In writing a test case for that leak, inadvertently discovered a case where we a poll request can race. So fix that up and mark it for stable, and also ensure that fdinfo covers both the poll tables that we have. The latter was an oversight when the split poll table were added (me) - Fix for a lockdep reported issue with IOPOLL (Pavel)" * tag 'io_uring-6.2-2023-01-13' of git://git.kernel.dk/linux: io_uring: lock overflowing for IOPOLL io_uring/poll: attempt request issue after racy poll wakeup io_uring/fdinfo: include locked hash table in fdinfo output io_uring/poll: add hash if ready poll request can't complete inline io_uring/io-wq: only free worker if it was allocated for creation commit 9e058c2952cad4baca0464266c4b1fe68f77052b Merge: 92783a90bcbde fd3a8cff4d4a4 Author: Linus Torvalds Date: Fri Jan 13 17:32:22 2023 -0600 Merge tag 'pci-v6.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci fixes from Bjorn Helgaas: - Work around apparent firmware issue that made Linux reject MMCONFIG space, which broke PCI extended config space (Bjorn Helgaas) - Fix CONFIG_PCIE_BT1 dependency due to mid-air collision between a PCI_MSI_IRQ_DOMAIN -> PCI_MSI change and addition of PCIE_BT1 (Lukas Bulwahn) * tag 'pci-v6.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: x86/pci: Treat EfiMemoryMappedIO as reservation of ECAM space x86/pci: Simplify is_mmconf_reserved() messages PCI: dwc: Adjust to recent removal of PCI_MSI_IRQ_DOMAIN commit 42633ed852deadc14d44660ad71e2f6640239120 Author: Sami Tolvanen Date: Thu Jan 12 22:49:48 2023 +0000 kbuild: Fix CFI hash randomization with KASAN Clang emits a asan.module_ctor constructor to each object file when KASAN is enabled, and these functions are indirectly called in do_ctors. With CONFIG_CFI_CLANG, the compiler also emits a CFI type hash before each address-taken global function so they can pass indirect call checks. However, in commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"), x86 implemented boot time hash randomization, which relies on the .cfi_sites section generated by objtool. As objtool is run against vmlinux.o instead of individual object files with X86_KERNEL_IBT (enabled by default), CFI types in object files that are not part of vmlinux.o end up not being included in .cfi_sites, and thus won't get randomized and trip CFI when called. Only .vmlinux.export.o and init/version-timestamp.o are linked into vmlinux separately from vmlinux.o. As these files don't contain any functions, disable KASAN for both of them to avoid breaking hash randomization. Link: https://github.com/ClangBuiltLinux/linux/issues/1742 Fixes: 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization") Signed-off-by: Sami Tolvanen Acked-by: Peter Zijlstra (Intel) Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230112224948.1479453-2-samitolvanen@google.com commit 3b293487b8752cc42c1cbf8a0447bc6076c075fa Author: Kees Cook Date: Thu Jan 12 15:03:16 2023 -0800 firmware: coreboot: Check size of table entry and use flex-array The memcpy() of the data following a coreboot_table_entry couldn't be evaluated by the compiler under CONFIG_FORTIFY_SOURCE. To make it easier to reason about, add an explicit flexible array member to struct coreboot_device so the entire entry can be copied at once. Additionally, validate the sizes before copying. Avoids this run-time false positive warning: memcpy: detected field-spanning write (size 168) of single field "&device->entry" at drivers/firmware/google/coreboot_table.c:103 (size 8) Reported-by: Paul Menzel Link: https://lore.kernel.org/all/03ae2704-8c30-f9f0-215b-7cdf4ad35a9a@molgen.mpg.de/ Cc: Jack Rosenthal Cc: Guenter Roeck Cc: Julius Werner Cc: Brian Norris Cc: Stephen Boyd Cc: Greg Kroah-Hartman Signed-off-by: Kees Cook Reviewed-by: Julius Werner Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230107031406.gonna.761-kees@kernel.org Reviewed-by: Stephen Boyd Reviewed-by: Jack Rosenthal Link: https://lore.kernel.org/r/20230112230312.give.446-kees@kernel.org commit da35048f2600633a7f9ba5fa7d6e3b1d0195938b Author: Nicholas Piggin Date: Thu Jan 12 20:54:26 2023 +1000 kallsyms: Fix scheduling with interrupts disabled in self-test kallsyms_on_each* may schedule so must not be called with interrupts disabled. The iteration function could disable interrupts, but this also changes lookup_symbol() to match the change to the other timing code. Reported-by: Erhard F. Link: https://lore.kernel.org/all/bug-216902-206035@https.bugzilla.kernel.org%2F/ Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202212251728.8d0872ff-oliver.sang@intel.com Fixes: 30f3bb09778d ("kallsyms: Add self-test facility") Tested-by: "Erhard F." Signed-off-by: Nicholas Piggin Signed-off-by: Luis Chamberlain commit 22eebaa631c40f3dac169ba781e0de471b83bf45 Author: Peter Foley Date: Thu Jan 12 23:37:06 2023 -0500 ata: pata_cs5535: Don't build on UML This driver uses MSR functions that aren't implemented under UML. Avoid building it to prevent tripping up allyesconfig. e.g. /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x3a3): undefined reference to `__tracepoint_read_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x3d2): undefined reference to `__tracepoint_write_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x457): undefined reference to `__tracepoint_write_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x481): undefined reference to `do_trace_write_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x4d5): undefined reference to `do_trace_write_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x4f5): undefined reference to `do_trace_read_msr' /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x51c): undefined reference to `do_trace_write_msr' Signed-off-by: Peter Foley Reviewed-by: Randy Dunlap Signed-off-by: Damien Le Moal commit 92783a90bcbde8659dd4a160506c46c56db494d6 Merge: f5fe24ef17b5f 310bc39546a43 Author: Linus Torvalds Date: Fri Jan 13 14:41:50 2023 -0600 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix the PMCR_EL0 reset value after the PMU rework - Correctly handle S2 fault triggered by a S1 page table walk by not always classifying it as a write, as this breaks on R/O memslots - Document why we cannot exit with KVM_EXIT_MMIO when taking a write fault from a S1 PTW on a R/O memslot - Put the Apple M2 on the naughty list for not being able to correctly implement the vgic SEIS feature, just like the M1 before it - Reviewer updates: Alex is stepping down, replaced by Zenghui x86: - Fix various rare locking issues in Xen emulation and teach lockdep to detect them - Documentation improvements - Do not return host topology information from KVM_GET_SUPPORTED_CPUID" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/xen: Avoid deadlock by adding kvm->arch.xen.xen_lock leaf node lock KVM: Ensure lockdep knows about kvm->lock vs. vcpu->mutex ordering rule KVM: x86/xen: Fix potential deadlock in kvm_xen_update_runstate_guest() KVM: x86/xen: Fix lockdep warning on "recursive" gpc locking Documentation: kvm: fix SRCU locking order docs KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID KVM: nSVM: clarify recalc_intercepts() wrt CR8 MAINTAINERS: Remove myself as a KVM/arm64 reviewer MAINTAINERS: Add Zenghui Yu as a KVM/arm64 reviewer KVM: arm64: vgic: Add Apple M2 cpus to the list of broken SEIS implementations KVM: arm64: Convert FSC_* over to ESR_ELx_FSC_* KVM: arm64: Document the behaviour of S1PTW faults on RO memslots KVM: arm64: Fix S1PTW handling on RO memslots KVM: arm64: PMU: Fix PMCR_EL0 reset value commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c Author: Mateusz Guzik Date: Fri Jan 13 19:44:47 2023 +0100 lockref: stop doing cpu_relax in the cmpxchg loop On the x86-64 architecture even a failing cmpxchg grants exclusive access to the cacheline, making it preferable to retry the failed op immediately instead of stalling with the pause instruction. To illustrate the impact, below are benchmark results obtained by running various will-it-scale tests on top of the 6.2-rc3 kernel and Cascade Lake (2 sockets * 24 cores * 2 threads) CPU. All results in ops/s. Note there is some variance in re-runs, but the code is consistently faster when contention is present. open3 ("Same file open/close"): proc stock no-pause 1 805603 814942 (+%1) 2 1054980 1054781 (-0%) 8 1544802 1822858 (+18%) 24 1191064 2199665 (+84%) 48 851582 1469860 (+72%) 96 609481 1427170 (+134%) fstat2 ("Same file fstat"): proc stock no-pause 1 3013872 3047636 (+1%) 2 4284687 4400421 (+2%) 8 3257721 5530156 (+69%) 24 2239819 5466127 (+144%) 48 1701072 5256609 (+209%) 96 1269157 6649326 (+423%) Additionally, a kernel with a private patch to help access() scalability: access2 ("Same file access"): proc stock patched patched +nopause 24 2378041 2005501 5370335 (-15% / +125%) That is, fixing the problems in access itself *reduces* scalability after the cacheline ping-pong only happens in lockref with the pause instruction. Note that fstat and access benchmarks are not currently integrated into will-it-scale, but interested parties can find them in pull requests to said project. Code at hand has a rather tortured history. First modification showed up in commit d472d9d98b46 ("lockref: Relax in cmpxchg loop"), written with Itanium in mind. Later it got patched up to use an arch-dependent macro to stop doing it on s390 where it caused a significant regression. Said macro had undergone revisions and was ultimately eliminated later, going back to cpu_relax. While I intended to only remove cpu_relax for x86-64, I got the following comment from Linus: I would actually prefer just removing it entirely and see if somebody else hollers. You have the numbers to prove it hurts on real hardware, and I don't think we have any numbers to the contrary. So I think it's better to trust the numbers and remove it as a failure, than say "let's just remove it on x86-64 and leave everybody else with the potentially broken code" Additionally, Will Deacon (maintainer of the arm64 port, one of the architectures previously benchmarked): So, from the arm64 side of the fence, I'm perfectly happy just removing the cpu_relax() calls from lockref. As such, come back full circle in history and whack it altogether. Signed-off-by: Mateusz Guzik Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/ Acked-by: Tony Luck # ia64 Acked-by: Nicholas Piggin # powerpc Acked-by: Will Deacon # arm64 Acked-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit b574baa64cf84e7793fe79f4491ae36c16e65a0b Author: Richard Zhu Date: Mon Dec 19 15:12:21 2022 +0800 phy: freescale: imx8m-pcie: Add one missing error return There should be one error return when fail to fetch the perst reset. Add the missing error return. Fixes: dce9edff16ee ("phy: freescale: imx8m-pcie: Add i.MX8MP PCIe PHY support") Signed-off-by: Richard Zhu Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/1671433941-2037-1-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Vinod Koul commit fd3a8cff4d4a4acb0af49dd947c822717c053cf7 Author: Bjorn Helgaas Date: Tue Jan 10 12:02:43 2023 -0600 x86/pci: Treat EfiMemoryMappedIO as reservation of ECAM space Normally we reject ECAM space unless it is reported as reserved in the E820 table or via a PNP0C02 _CRS method (PCI Firmware, r3.3, sec 4.1.2). 07eab0901ede ("efi/x86: Remove EfiMemoryMappedIO from E820 map"), removes E820 entries that correspond to EfiMemoryMappedIO regions because some other firmware uses EfiMemoryMappedIO for PCI host bridge windows, and the E820 entries prevent Linux from allocating BAR space for hot-added devices. Some firmware doesn't report ECAM space via PNP0C02 _CRS methods, but does mention it as an EfiMemoryMappedIO region via EFI GetMemoryMap(), which is normally converted to an E820 entry by a bootloader or EFI stub. After 07eab0901ede, that E820 entry is removed, so we reject this ECAM space, which makes PCI extended config space (offsets 0x100-0xfff) inaccessible. The lack of extended config space breaks anything that relies on it, including perf, VSEC telemetry, EDAC, QAT, SR-IOV, etc. Allow use of ECAM for extended config space when the region is covered by an EfiMemoryMappedIO region, even if it's not included in E820 or PNP0C02 _CRS. Link: https://lore.kernel.org/r/ac2693d8-8ba3-72e0-5b66-b3ae008d539d@linux.intel.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216891 Fixes: 07eab0901ede ("efi/x86: Remove EfiMemoryMappedIO from E820 map") Link: https://lore.kernel.org/r/20230110180243.1590045-3-helgaas@kernel.org Reported-by: Kan Liang Reported-by: Tony Luck Reported-by: Giovanni Cabiddu Reported-by: Yunying Sun Reported-by: Baowen Zheng Reported-by: Zhenzhong Duan Reported-by: Yang Lixiao Tested-by: Tony Luck Tested-by: Giovanni Cabiddu Tested-by: Kan Liang Tested-by: Yunying Sun Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Reviewed-by: Rafael J. Wysocki commit d60c471a8670635b65b3d67b6e7aaa263d191cc3 Author: Marijn Suijten Date: Wed Dec 14 23:37:32 2022 +0100 phy: Revert "phy: qualcomm: usb28nm: Add MDM9607 init sequence" This reverts commit 557a28811c7e0286d3816842032db5eb7bb5f156. This commit introduced an init sequence from downstream DT [1] in the driver. As mentioned by the comment above the HSPHY_INIT_CFG macro for this sequence: /* * The macro is used to define an initialization sequence. Each tuple * is meant to program 'value' into phy register at 'offset' with 'delay' * in us followed. */ Instead of corresponding to offsets into the phy register, the sequence read by the downstream driver [2] is passed into ulpi_write [3] which crafts the address-value pair into a new value and writes it into the same register at USB_ULPI_VIEWPORT [4]. In other words, this init sequence is programmed into the hardware in a totally different way than downstream and is unlikely to achieve the desired result, if the hsphy is working at all. An alternative method needs to be found to write these init values at the desired location. Fortunately mdm9607 did not land upstream yet [5] and should have its compatible revised to use the generic one, instead of a compatible that writes wrong data to the wrong registers. [1]: https://android.googlesource.com/kernel/msm/+/android-7.1.0_r0.2/arch/arm/boot/dts/qcom/mdm9607.dtsi#585 [2]: https://android.googlesource.com/kernel/msm/+/android-7.1.0_r0.2/drivers/usb/phy/phy-msm-usb.c#4183 [3]: https://android.googlesource.com/kernel/msm/+/android-7.1.0_r0.2/drivers/usb/phy/phy-msm-usb.c#468 [4]: https://android.googlesource.com/kernel/msm/+/android-7.1.0_r0.2/drivers/usb/phy/phy-msm-usb.c#418 [5]: https://lore.kernel.org/linux-arm-msm/20210805222812.40731-1-konrad.dybcio@somainline.org/ Reported-by: Michael Srba Signed-off-by: Marijn Suijten Reviewed-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20221214223733.648167-1-marijn.suijten@somainline.org Signed-off-by: Vinod Koul commit 5daba914da0e48950e9407ea4d75fa57029c9adc Author: Shang XiaoJing Date: Mon Dec 5 19:58:23 2022 +0800 phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() The clk_disable_unprepare() should be called in the error handling of rockchip_usb2phy_power_on(). Fixes: 0e08d2a727e6 ("phy: rockchip-inno-usb2: add a new driver for Rockchip usb2phy") Signed-off-by: Shang XiaoJing Link: https://lore.kernel.org/r/20221205115823.16957-1-shangxiaojing@huawei.com Signed-off-by: Vinod Koul commit 83a7f8e4899fb4cd77c787a3373f3e82b49a080f Author: Maxime Ripard Date: Fri Jan 13 16:46:37 2023 +0100 drm/vc4: bo: Fix unused variable warning Commit 07a2975c65f2 ("drm/vc4: bo: Fix drmm_mutex_init memory hog") removed the only use of the ret variable, but didn't remove the variable itself leading to a unused variable warning. Remove that variable. Reported-by: Stephen Rothwell Fixes: 07a2975c65f2 ("drm/vc4: bo: Fix drmm_mutex_init memory hog") Reviewed-by: Maíra Canal Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230113154637.1704116-1-maxime@cerno.tech commit 0bf913e07b377cfc288cfe488ca30b7d67059d8a Merge: 40d92fc4fa81a d3f450533bbcb Author: Linus Torvalds Date: Fri Jan 13 10:37:10 2023 -0600 Merge tag 'efi-fixes-for-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - avoid a potential crash on the efi_subsys_init() error path - use more appropriate error code for runtime services calls issued after a crash in the firmware occurred - avoid READ_ONCE() for accessing firmware tables that may appear misaligned in memory * tag 'efi-fixes-for-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: tpm: Avoid READ_ONCE() for accessing the event log efi: rt-wrapper: Add missing include efi: fix userspace infinite retry read efivars after EFI runtime services page fault efi: fix NULL-deref in init error path commit 40d92fc4fa81a93b4659b98512dcb9d0ccd94cfd Merge: 689968db7b614 a33ae832bf3f2 Author: Linus Torvalds Date: Fri Jan 13 10:35:26 2023 -0600 Merge tag 'docs-6.2-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "Three documentation fixes (or rather two and one warning): - Sphinx 6.0 broke our configuration mechanism, so fix it - I broke our configuration for non-Alabaster themes; Akira fixed it - Deprecate Sphinx < 2.4 with an eye toward future removal" * tag 'docs-6.2-fixes' of git://git.lwn.net/linux: docs/conf.py: Use about.html only in sidebar of alabaster theme docs: Deprecate use of Sphinx < 2.4.x docs: Fix the docs build with Sphinx 6.0 commit e4f4db47794c9f474b184ee1418f42e6a07412b6 Author: Luis Gerhorst Date: Mon Jan 9 16:05:46 2023 +0100 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel. To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small. The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation: [...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...] After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64. In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details. Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes. Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") Signed-off-by: Luis Gerhorst Signed-off-by: Daniel Borkmann Acked-by: Henriette Hofmeier Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de commit d3f450533bbcb6dd4d7d59cadc9b61b7321e4ac1 Author: Ard Biesheuvel Date: Mon Jan 9 10:44:31 2023 +0100 efi: tpm: Avoid READ_ONCE() for accessing the event log Nathan reports that recent kernels built with LTO will crash when doing EFI boot using Fedora's GRUB and SHIM. The culprit turns out to be a misaligned load from the TPM event log, which is annotated with READ_ONCE(), and under LTO, this gets translated into a LDAR instruction which does not tolerate misaligned accesses. Interestingly, this does not happen when booting the same kernel straight from the UEFI shell, and so the fact that the event log may appear misaligned in memory may be caused by a bug in GRUB or SHIM. However, using READ_ONCE() to access firmware tables is slightly unusual in any case, and here, we only need to ensure that 'event' is not dereferenced again after it gets unmapped, but this is already taken care of by the implicit barrier() semantics of the early_memunmap() call. Cc: Cc: Peter Jones Cc: Jarkko Sakkinen Cc: Matthew Garrett Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://github.com/ClangBuiltLinux/linux/issues/1782 Signed-off-by: Ard Biesheuvel commit 544d163d659d45a206d8929370d5a2984e546cb7 Author: Pavel Begunkov Date: Thu Jan 12 13:08:56 2023 +0000 io_uring: lock overflowing for IOPOLL syzbot reports an issue with overflow filling for IOPOLL: WARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734 CPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Workqueue: events_unbound io_ring_exit_work Call trace:  io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734  io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773  io_fill_cqe_req io_uring/io_uring.h:168 [inline]  io_do_iopoll+0x474/0x62c io_uring/rw.c:1065  io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513  io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056  io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869  process_one_work+0x2d8/0x504 kernel/workqueue.c:2289  worker_thread+0x340/0x610 kernel/workqueue.c:2436  kthread+0x12c/0x158 kernel/kthread.c:376  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863 There is no real problem for normal IOPOLL as flush is also called with uring_lock taken, but it's getting more complicated for IOPOLL|SQPOLL, for which __io_cqring_overflow_flush() happens from the CQ waiting path. Reported-and-tested-by: syzbot+6805087452d72929404e@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 689968db7b6145b2e4beb8b472d31162ffa5ad7d Merge: d863f0539b525 56b88b50565cd Author: Linus Torvalds Date: Fri Jan 13 08:20:29 2023 -0600 Merge tag 'sound-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became a slightly big update, but it's more or less expected, as the first batch after holidays. All changes (but for the last two last-minute fixes) have been stewed in linux-next long enough, so it's fairly safe to take: - PCM UAF fix in 32bit compat layer - ASoC board-specific fixes for Intel, AMD, Medathek, Qualcomm - SOF power management fixes - ASoC Intel link failure fixes - A series of fixes for USB-audio regressions - CS35L41 HD-audio codec regression fixes - HD-audio device-specific fixes / quirks Note that one SPI patch has been taken in ASoC subtree mistakenly, and the same fix is found in spi tree, but it should be OK to apply" * tag 'sound-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (39 commits) ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list ALSA: control-led: use strscpy in set_led_id() ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format() ASoC: dt-bindings: qcom,lpass-tx-macro: correct clocks on SC7280 ASoC: dt-bindings: qcom,lpass-wsa-macro: correct clocks on SM8250 ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle ALSA: hda: cs35l41: Don't return -EINVAL from system suspend/resume ASoC: fsl_micfil: Correct the number of steps on SX controls ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing" ALSA: usb-audio: More refactoring of hw constraint rules ALSA: usb-audio: Relax hw constraints for implicit fb sync ALSA: usb-audio: Make sure to stop endpoints before closing EPs ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 ... commit fa17087e244263627a01d6a9b76b8fdaf410de34 Author: Tetsuo Handa Date: Fri Jan 13 23:11:38 2023 +0900 tomoyo: Update website link SourceForge.JP was renamed to OSDN in May 2015. Signed-off-by: Tetsuo Handa commit 1ed8a46256771de283772d482403691807214cf7 Author: Paul E. McKenney Date: Fri Jan 13 23:08:04 2023 +0900 tomoyo: Remove "select SRCU" Now that the SRCU Kconfig option is unconditionally selected, there is no longer any point in selecting it. Therefore, remove the "select SRCU" Kconfig statements. Signed-off-by: Paul E. McKenney Signed-off-by: Tetsuo Handa commit d863f0539b525ba714f85c15ea961b225a15dd21 Merge: cdbbca256cf3f 4f3085f87b51a Author: Linus Torvalds Date: Fri Jan 13 07:38:14 2023 -0600 Merge tag 'pm-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix assorted issues in the ARM cpufreq drivers and in the AMD P-state driver. Specifics: - Fix cpufreq policy reference counting in amd-pstate to prevent it from crashing on removal (Perry Yuan) - Fix double initialization and set suspend-freq for Apple's cpufreq driver (Arnd Bergmann, Hector Martin) - Fix reading of "reg" property, update cpufreq-dt's blocklist and update DT documentation for Qualcomm's cpufreq driver (Konrad Dybcio, Krzysztof Kozlowski) - Replace 0 with NULL in the Armada cpufreq driver (Miles Chen) - Fix potential overflows in the CPPC cpufreq driver (Pierre Gondois) - Update blocklist for the Tegra234 Soc cpufreq driver (Sumit Gupta)" * tag 'pm-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: amd-pstate: fix kernel hang issue while amd-pstate unregistering cpufreq: armada-37xx: stop using 0 as NULL pointer cpufreq: apple-soc: Switch to the lowest frequency on suspend dt-bindings: cpufreq: cpufreq-qcom-hw: document interrupts cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist cpufreq: qcom-hw: Fix reading "reg" with address/size-cells != 2 cpufreq: CPPC: Add u64 casts to avoid overflowing cpufreq: apple: remove duplicate intializer commit cdbbca256cf3f8b1f3f37a7102b54bf99f2fa656 Merge: 0d0833e0399ef df3a71aba40fb Author: Linus Torvalds Date: Fri Jan 13 07:32:55 2023 -0600 Merge tag 'acpi-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add one more ACPI IRQ override quirk, improve ACPI companion lookup for backlight devices and add missing kernel command line option values for backlight detection. Specifics: - Improve ACPI companion lookup for backlight devices in the cases when there is more than one candidate ACPI device object (Hans de Goede) - Add missing support for manual selection of NVidia-WMI-EC or Apple GMUX backlight in the kernel command line to the ACPI backlight driver (Hans de Goede) - Skip ACPI IRQ override on Asus Expertbook B2402CBA (Tamim Khan)" * tag 'acpi-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: Fix selecting wrong ACPI fwnode for the iGPU on some Dell laptops ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from the cmdline ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA commit 0d0833e0399efecf3d75b54c3bc277660166d9a4 Merge: ff5ebafd51ecc fde5f74ccfc77 Author: Linus Torvalds Date: Fri Jan 13 07:26:40 2023 -0600 Merge tag 'platform-drivers-x86-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "A set of assorted fixes and hardware-id additions" * tag 'platform-drivers-x86-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode platform/x86/amd: Fix refcount leak in amd_pmc_probe platform/x86: intel/pmc/core: Add Meteor Lake mobile support platform/x86: simatic-ipc: add another model platform/x86: simatic-ipc: correct name of a model platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting platform/x86: asus-wmi: Don't load fan curves without fan platform/x86: asus-wmi: Ignore fan on E410MA platform/x86: asus-wmi: Add quirk wmi_ignore_fan platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK platform/x86: asus-nb-wmi: Add alternate mapping for KEY_CAMERA platform/surface: aggregator: Add missing call to ssam_request_sync_free() platform/surface: aggregator: Ignore command messages not intended for us platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[] platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe commit ff5ebafd51ecc01014f1db510299eede60faf22a Merge: d45b832d6f41b e695bc7e54235 Author: Linus Torvalds Date: Fri Jan 13 07:18:59 2023 -0600 Merge tag 'drm-fixes-2023-01-13' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "There is a bit of a post-holiday build up here I expect, small fixes across the board, amdgpu and msm being the main leaders, with others having a few. One code removal patch for nouveau: buddy: - benchmark regression fix for top-down buddy allocation panel: - add Lenovo panel orientation quirk ttm: - fix kernel oops regression amdgpu: - fix missing fence references - fix missing pipeline sync fencing - SMU13 fan speed fix - SMU13 fix power cap handling - SMU13 BACO fix - Fix a possible segfault in bo validation error case - Delay removal of firmware framebuffer - Fix error when unloading amdkfd: - SVM fix when clearing vram - GC11 fix for multi-GPU i915: - Reserve enough fence slot for i915_vma_unbind_vsync - Fix potential use after free - Reset engines twice in case of reset failure - Use multi-cast registers for SVG Unit registers msm: - display: - doc warning fixes - dt attribs cleanups - memory leak fix - error handing in hdmi probe fix - dp_aux_isr incorrect signalling fix - shutdown path fix - accel: - a5xx: fix quirks to be a bitmask - a6xx: fix gx halt to avoid 1s hang - kexec shutdown fix - fix potential double free vmwgfx: - drop rcu usage to make code more robust virtio: - fix use-after-free in gem handle code nouveau: - drop unused nouveau_fbcon.c" * tag 'drm-fixes-2023-01-13' of git://anongit.freedesktop.org/drm/drm: (35 commits) drm: Optimize drm buddy top-down allocation method drm/ttm: Fix a regression causing kernel oops'es drm/i915/gt: Cover rest of SVG unit MCR registers drm/nouveau: Remove file nouveau_fbcon.c drm/amdkfd: Fix NULL pointer error for GC 11.0.1 on mGPU drm/amd/pm/smu13: BACO is supported when it's in BACO state drm/amdkfd: Add sync after creating vram bo drm/i915/gt: Reset twice drm/amdgpu: fix pipeline sync v2 drm/vmwgfx: Remove rcu locks from user resources drm/virtio: Fix GEM handle creation UAF drm/amdgpu: Fixed bug on error when unloading amdgpu drm/amd: Delay removal of the firmware framebuffer drm/amdgpu: Fix potential NULL dereference drm/i915: Fix potential context UAFs drm/i915: Reserve enough fence slot for i915_vma_unbind_async drm: Add orientation quirk for Lenovo ideapad D330-10IGL drm/msm/a6xx: Avoid gx gbit halt during rpm suspend drm/msm/adreno: Make adreno quirks not overwrite each other drm/msm: another fix for the headless Adreno GPU ... commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e Author: Clement Lecigne Date: Fri Jan 13 13:07:45 2023 +0100 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce snd_ctl_notify_one() helper"). Doing this way we are also fixing the following locking issue happening in the compat path which can be easily triggered and turned into an use-after-free. 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits: snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Cc: stable@kernel.org # 5.13+ Signed-off-by: Clement Lecigne Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230113120745.25464-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d45b832d6f41b003c1dee953096cfd4c6e5233b0 Merge: d9fc1511728c1 68a63a412d18b Author: Linus Torvalds Date: Fri Jan 13 07:11:45 2023 -0600 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Here's a sizeable batch of Friday the 13th arm64 fixes for -rc4. What could possibly go wrong? The obvious reason we have so much here is because of the holiday season right after the merge window, but we've also brought back an erratum workaround that was previously dropped at the last minute and there's an MTE coredumping fix that strays outside of the arch/arm64 directory. Summary: - Fix PAGE_TABLE_CHECK failures on hugepage splitting path - Fix PSCI encoding of MEM_PROTECT_RANGE function in UAPI header - Fix NULL deref when accessing debugfs node if PSCI is not present - Fix MTE core dumping when VMA list is being updated concurrently - Fix SME signal frame handling when SVE is not implemented by the CPU - Fix asm constraints for cmpxchg_double() to hazard both words - Fix build failure with stack tracer and older versions of Clang - Bring back workaround for Cortex-A715 erratum 2645198" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Fix build with CC=clang, CONFIG_FTRACE=y and CONFIG_STACK_TRACER=y arm64/mm: Define dummy pud_user_exec() when using 2-level page-table arm64: errata: Workaround possible Cortex-A715 [ESR|FAR]_ELx corruption firmware/psci: Don't register with debugfs if PSCI isn't available firmware/psci: Fix MEM_PROTECT_RANGE function numbers arm64/signal: Always allocate SVE signal frames on SME only systems arm64/signal: Always accept SVE signal frames on SME only systems arm64/sme: Fix context switch for SME only systems arm64: cmpxchg_double*: hazard against entire exchange variable arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning arm64: mte: Avoid the racy walk of the vma list during core dump elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size} arm64: mte: Fix double-freeing of the temporary tag storage during coredump arm64: ptrace: Use ARM64_SME to guard the SME register enumerations arm64/mm: add pud_user_exec() check in pud_user_accessible_page() arm64/mm: fix incorrect file_map_count for invalid pmd commit 142e821f68cf5da79ce722cb9c1323afae30e185 Author: Christophe JAILLET Date: Mon Dec 19 19:06:22 2022 +0100 iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() A clk, prepared and enabled in mtk_iommu_v1_hw_init(), is not released in the error handling path of mtk_iommu_v1_probe(). Add the corresponding clk_disable_unprepare(), as already done in the remove function. Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW") Signed-off-by: Christophe JAILLET Reviewed-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/593e7b7d97c6e064b29716b091a9d4fd122241fb.1671473163.git.christophe.jaillet@wanadoo.fr Signed-off-by: Joerg Roedel commit dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c Author: Yunfei Wang Date: Wed Jan 11 14:38:00 2023 +0800 iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an issue that retry_pfn overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will overflow. As a result, if the retry logic is executed, low_pfn is updated to 0, and then new_pfn < low_pfn returns false to make the allocation successful. This issue occurs in the following two situations: 1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cached_node is assigned as iovad->anchor. For example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfn_lo is smaller than iovad->cached_node. Example log as follows: [ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff 2. The node with the largest iova->pfn_lo value in the iova domain is deleted, iovad->cached_node will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain. After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 to fix the overflow issue. Signed-off-by: jianjiao zeng Signed-off-by: Yunfei Wang Cc: # 5.15.* Fixes: 4e89dce72521 ("iommu/iova: Retry from last rb tree node if iova search fails") Acked-by: Robin Murphy Link: https://lore.kernel.org/r/20230111063801.25107-1-yf.wang@mediatek.com Signed-off-by: Joerg Roedel commit a6a9a5da68084d5eac6ef85ad09df7fc9c971de4 Author: Miaoqian Lin Date: Fri Dec 30 12:31:00 2022 +0400 iommu: Fix refcount leak in iommu_device_claim_dma_owner iommu_group_get() returns the group with the reference incremented. Move iommu_group_get() after owner check to fix the refcount leak. Fixes: 89395ccedbc1 ("iommu: Add device-centric DMA ownership interfaces") Signed-off-by: Miaoqian Lin Reviewed-by: Lu Baolu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20221230083100.1489569-1-linmq006@gmail.com [ joro: Remove *group = NULL initialization ] Signed-off-by: Joerg Roedel commit 32ea2c57dc216b6ad8125fa680d31daa5d421c95 Author: Vladimir Oltean Date: Thu Dec 15 16:12:51 2022 +0200 iommu/arm-smmu-v3: Don't unregister on shutdown Similar to SMMUv2, this driver calls iommu_device_unregister() from the shutdown path, which removes the IOMMU groups with no coordination whatsoever with their users - shutdown methods are optional in device drivers. This can lead to NULL pointer dereferences in those drivers' DMA API calls, or worse. Instead of calling the full arm_smmu_device_remove() from arm_smmu_device_shutdown(), let's pick only the relevant function call - arm_smmu_device_disable() - more or less the reverse of arm_smmu_device_reset() - and call just that from the shutdown path. Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") Suggested-by: Robin Murphy Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20221215141251.3688780-2-vladimir.oltean@nxp.com Signed-off-by: Will Deacon commit ce31e6ca68bd7639bd3e5ef97be215031842bbab Author: Vladimir Oltean Date: Thu Dec 15 16:12:50 2022 +0200 iommu/arm-smmu: Don't unregister on shutdown Michael Walle says he noticed the following stack trace while performing a shutdown with "reboot -f". He suggests he got "lucky" and just hit the correct spot for the reboot while there was a packet transmission in flight. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 6.1.0-rc5-00088-gf3600ff8e322 #1930 Hardware name: Kontron KBox A-230-LS (DT) pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_map_page+0x9c/0x254 Call trace: iommu_get_dma_domain+0x14/0x20 dma_map_page_attrs+0x1ec/0x250 enetc_start_xmit+0x14c/0x10b0 enetc_xmit+0x60/0xdc dev_hard_start_xmit+0xb8/0x210 sch_direct_xmit+0x11c/0x420 __dev_queue_xmit+0x354/0xb20 ip6_finish_output2+0x280/0x5b0 __ip6_finish_output+0x15c/0x270 ip6_output+0x78/0x15c NF_HOOK.constprop.0+0x50/0xd0 mld_sendpack+0x1bc/0x320 mld_ifc_work+0x1d8/0x4dc process_one_work+0x1e8/0x460 worker_thread+0x178/0x534 kthread+0xe0/0xe4 ret_from_fork+0x10/0x20 Code: d503201f f9416800 d503233f d50323bf (f9404c00) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt This appears to be reproducible when the board has a fixed IP address, is ping flooded from another host, and "reboot -f" is used. The following is one more manifestation of the issue: $ reboot -f kvm: exiting hardware virtualization cfg80211: failed to load regulatory.db arm-smmu 5000000.iommu: disabling translation sdhci-esdhc 2140000.mmc: Removing from iommu group 11 sdhci-esdhc 2150000.mmc: Removing from iommu group 12 fsl-edma 22c0000.dma-controller: Removing from iommu group 17 dwc3 3100000.usb: Removing from iommu group 9 dwc3 3110000.usb: Removing from iommu group 10 ahci-qoriq 3200000.sata: Removing from iommu group 2 fsl-qdma 8380000.dma-controller: Removing from iommu group 20 platform f080000.display: Removing from iommu group 0 etnaviv-gpu f0c0000.gpu: Removing from iommu group 1 etnaviv etnaviv: Removing from iommu group 1 caam_jr 8010000.jr: Removing from iommu group 13 caam_jr 8020000.jr: Removing from iommu group 14 caam_jr 8030000.jr: Removing from iommu group 15 caam_jr 8040000.jr: Removing from iommu group 16 fsl_enetc 0000:00:00.0: Removing from iommu group 4 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.1: Removing from iommu group 5 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.2: Removing from iommu group 6 fsl_enetc_mdio 0000:00:00.3: Removing from iommu group 8 mscc_felix 0000:00:00.5: Removing from iommu group 3 fsl_enetc 0000:00:00.6: Removing from iommu group 7 pcieport 0001:00:00.0: Removing from iommu group 18 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x00000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 pcieport 0002:00:00.0: Removing from iommu group 19 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_unmap_page+0x38/0xe0 Call trace: iommu_get_dma_domain+0x14/0x20 dma_unmap_page_attrs+0x38/0x1d0 enetc_unmap_tx_buff.isra.0+0x6c/0x80 enetc_poll+0x170/0x910 __napi_poll+0x40/0x1e0 net_rx_action+0x164/0x37c __do_softirq+0x128/0x368 run_ksoftirqd+0x68/0x90 smpboot_thread_fn+0x14c/0x190 Code: d503201f f9416800 d503233f d50323bf (f9405400) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- The problem seems to be that iommu_group_remove_device() is allowed to run with no coordination whatsoever with the shutdown procedure of the enetc PCI device. In fact, it almost seems as if it implies that the pci_driver :: shutdown() method is mandatory if DMA is used with an IOMMU, otherwise this is inevitable. That was never the case; shutdown methods are optional in device drivers. This is the call stack that leads to iommu_group_remove_device() during reboot: kernel_restart -> device_shutdown -> platform_shutdown -> arm_smmu_device_shutdown -> arm_smmu_device_remove -> iommu_device_unregister -> bus_for_each_dev -> remove_iommu_group -> iommu_release_device -> iommu_group_remove_device I don't know much about the arm_smmu driver, but arm_smmu_device_shutdown() invoking arm_smmu_device_remove() looks suspicious, since it causes the IOMMU device to unregister and that's where everything starts to unravel. It forces all other devices which depend on IOMMU groups to also point their ->shutdown() to ->remove(), which will make reboot slower overall. There are 2 moments relevant to this behavior. First was commit b06c076ea962 ("Revert "iommu/arm-smmu: Make arm-smmu explicitly non-modular"") when arm_smmu_device_shutdown() was made to run the exact same thing as arm_smmu_device_remove(). Prior to that, there was no iommu_device_unregister() call in arm_smmu_device_shutdown(). However, that was benign until commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration"), which made iommu_device_unregister() call remove_iommu_group(). Restore the old shutdown behavior by making remove() call shutdown(), but shutdown() does not call the remove() specific bits. Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") Reported-by: Michael Walle Tested-by: Michael Walle # on kontron-sl28 Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20221215141251.3688780-1-vladimir.oltean@nxp.com Signed-off-by: Will Deacon commit ac9c5e92dd15b9927e7355ccf79df76a58b44344 Author: Robin Murphy Date: Thu Dec 15 16:51:55 2022 +0000 iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY even betterer Although it's vanishingly unlikely that anyone would integrate an SMMU within a coherent interconnect without also making the pagetable walk interface coherent, the same effect happens if a coherent SMMU fails to advertise CTTW correctly. This turns out to be the case on some popular NXP SoCs, where VFIO started failing the IOMMU_CAP_CACHE_COHERENCY test, even though IOMMU_CACHE *was* previously achieving the desired effect anyway thanks to the underlying integration. While those SoCs stand to gain some more general benefits from a firmware update to override CTTW correctly in DT/ACPI, it's also easy to work around this in Linux as well, to avoid imposing too much on affected users - since the upstream client devices *are* correctly marked as coherent, we can trivially infer their coherent paths through the SMMU as well. Reported-by: Vladimir Oltean Fixes: df198b37e72c ("iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY better") Signed-off-by: Robin Murphy Tested-by: Vladimir Oltean Link: https://lore.kernel.org/r/d6dc41952961e5c7b21acac08a8bf1eb0f69e124.1671123115.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit f276aacf5d2f7fb57e400db44c807ea3b9525fd6 Author: Janne Grunau Date: Fri Jan 13 19:23:08 2023 +0900 spi: Use a 32-bit DT property for spi-cs-setup-delay-ns 65us is not a reasonable maximum for this property, as some devices might need a much longer setup time (e.g. those driven by firmware on the other end). Plus, device tree property values are in 32-bit cells and smaller widths should not be used without good reason. Also move the logic to a helper function, since this will later be used to parse other CS delay properties too. Fixes: 33a2fde5f77b ("spi: Introduce spi-cs-setup-ns property") Signed-off-by: Janne Grunau Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20230113102309.18308-2-marcan@marcan.st Signed-off-by: Mark Brown commit f89d783d68dcc6b2ce4fe3bda972ae0f84df0dca Author: Amadeusz Sławiński Date: Fri Jan 13 20:03:08 2023 +0100 ASoC: Intel: avs: Implement PCI shutdown On shutdown reference to i915 driver needs to be released to not spam logs with unnecessary warnings. While at it do some additional cleanup to make sure DSP is powered down and interrupts from device are disabled. Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation") Reported-by: Kornel Dulęba Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Link: https://lore.kernel.org/r/20230113190310.1451693-2-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit fde5f74ccfc771941b018b5415fa9664426e10ad Author: Mark Pearson Date: Thu Jan 12 17:12:28 2023 -0500 platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode Recently AMT mode was enabled (somewhat unexpectedly) on the Lenovo Z13 platform. The FW is advertising it is available and the driver tries to use it - unfortunately it reports the profile mode incorrectly. Note, there is also some extra work needed to enable the dynamic aspect of AMT support that I will be following up with; but more testing is needed first. This patch just fixes things so the profiles are reported correctly. Link: https://gitlab.freedesktop.org/hadess/power-profiles-daemon/-/issues/115 Fixes: 46dcbc61b739 ("platform/x86: thinkpad-acpi: Add support for automatic mode transitions") Reviewed-by: Mario Limonciello Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230112221228.490946-1-mpearson-lenovo@squebb.ca Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit da07d2f9c153e457e845d4dcfdd13568d71d18a4 Author: Qais Yousef Date: Thu Jan 12 12:27:08 2023 +0000 sched/fair: Fixes for capacity inversion detection Traversing the Perf Domains requires rcu_read_lock() to be held and is conditional on sched_energy_enabled(). Ensure right protections applied. Also skip capacity inversion detection for our own pd; which was an error. Fixes: 44c7b80bffc3 ("sched/fair: Detect capacity inversion") Reported-by: Dietmar Eggemann Signed-off-by: Qais Yousef (Google) Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Link: https://lore.kernel.org/r/20230112122708.330667-3-qyousef@layalina.io commit e26fd28db82899be71b4b949527373d0a6be1e65 Author: Qais Yousef Date: Thu Jan 12 12:27:07 2023 +0000 sched/uclamp: Fix a uninitialized variable warnings Addresses the following warnings: > config: riscv-randconfig-m031-20221111 > compiler: riscv64-linux-gcc (GCC) 12.1.0 > > smatch warnings: > kernel/sched/fair.c:7263 find_energy_efficient_cpu() error: uninitialized symbol 'util_min'. > kernel/sched/fair.c:7263 find_energy_efficient_cpu() error: uninitialized symbol 'util_max'. Fixes: 244226035a1f ("sched/uclamp: Fix fits_capacity() check in feec()") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Qais Yousef (Google) Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Link: https://lore.kernel.org/r/20230112122708.330667-2-qyousef@layalina.io commit df3a71aba40fbe4bbd0842170e70c236eaed7c40 Merge: f64e4275ef740 77c7248882385 420a1116aef0e Author: Rafael J. Wysocki Date: Fri Jan 13 11:11:05 2023 +0100 Merge branches 'acpi-resource' and 'acpi-video' Merge an ACPI resource management quirk and an ACPI backlight driver fix for 6.2-rc4: - Skip ACPI IRQ override on Asus Expertbook B2402CBA (Tamim Khan). - Add missing support for manual selection of NVidia-WMI-EC or Apple GMUX backlight in the kernel command line to the ACPI backlight driver (Hans de Goede). * acpi-resource: ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA * acpi-video: ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from the cmdline commit 92a9c0ad86d47ff4cce899012e355c400f02cfb8 Author: Jaroslav Kysela Date: Fri Jan 13 09:53:11 2023 +0100 ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() The subs function argument may be NULL, so do not use it before the NULL check. Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Reported-by: coverity-bot Link: https://lore.kernel.org/alsa-devel/202301121424.4A79A485@keescook/ Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230113085311.623325-1-perex@perex.cz Signed-off-by: Takashi Iwai commit aedee9e8d9224de35081e73e63333a402907c53c Author: Peter Foley Date: Thu Jan 12 23:23:59 2023 -0500 kconfig: Update all declared targets Currently qconf-cfg.sh is the only script that touches the "-bin" target, even though all of the conf_cfg rules declare that they do. Make the recipe unconditionally touch all declared targets to avoid incompatibilities with upcoming versions of GNU make: https://lists.gnu.org/archive/html/info-gnu/2022-10/msg00008.html e.g. scripts/kconfig/Makefile:215: warning: pattern recipe did not update peer target 'scripts/kconfig/nconf-bin'. scripts/kconfig/Makefile:215: warning: pattern recipe did not update peer target 'scripts/kconfig/mconf-bin'. scripts/kconfig/Makefile:215: warning: pattern recipe did not update peer target 'scripts/kconfig/gconf-bin'. Signed-off-by: Peter Foley Signed-off-by: Masahiro Yamada commit ea22f4319c3409d847d70eaaf149cc480a73220d Author: Sudheer Mogilappagari Date: Wed Jan 11 15:56:07 2023 -0800 ethtool: add netlink attr in rss get reply only if value is not null Current code for RSS_GET ethtool command includes netlink attributes in reply message to user space even if they are null. Added checks to include netlink attribute in reply message only if a value is received from driver. Drivers might return null for RSS indirection table or hash key. Instead of including attributes with empty value in the reply message, add netlink attribute only if there is content. Fixes: 7112a04664bf ("ethtool: add netlink based get rss support") Signed-off-by: Sudheer Mogilappagari Reviewed-by: Michal Kubecek Link: https://lore.kernel.org/r/20230111235607.85509-1-sudheer.mogilappagari@intel.com Signed-off-by: Jakub Kicinski commit 01644a1f98ff45a4044395ce2bbfd534747e0676 Author: David Howells Date: Wed Jan 11 18:07:15 2023 +0000 rxrpc: Fix wrong error return in rxrpc_connect_call() Fix rxrpc_connect_call() to return -ENOMEM rather than 0 if it fails to look up a peer. This generated a smatch warning: net/rxrpc/call_object.c:303 rxrpc_connect_call() warn: missing error code 'ret' I think this also fixes a syzbot-found bug: rxrpc: Assertion failed - 1(0x1) == 11(0xb) is false ------------[ cut here ]------------ kernel BUG at net/rxrpc/call_object.c:645! where the call being put is in the wrong state - as would be the case if we failed to clear up correctly after the error in rxrpc_connect_call(). Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread") Reported-by: kernel test robot Reported-by: Dan Carpenter Reported-and-tested-by: syzbot+4bb6356bb29d6299360e@syzkaller.appspotmail.com Signed-off-by: David Howells Link: https://lore.kernel.org/r/202301111153.9eZRYLf1-lkp@intel.com/ Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/2438405.1673460435@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 80c825296134a8285d970a868187fef32e7c2b9f Merge: 0ea90f36a1e1f 926446ae24c03 Author: Jakub Kicinski Date: Thu Jan 12 21:50:43 2023 -0800 Merge branch 'amd-xgbe-pfc-and-kr-training-fixes' Raju Rangoju says: ==================== amd-xgbe: PFC and KR-Training fixes This patch series fixes the issues in kr-training and pfc 0001 - There is difference in the TX Flow Control registers (TFCR) between the revisions of the hardware. Update the driver to use the TFCR based on the reported version of the hardware. 0002 - AN restart triggered during KR training not only aborts the KR training process but also move the HW to unstable state. Add the necessary changes to fix kr-taining. ==================== Link: https://lore.kernel.org/r/20230111172852.1875384-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 926446ae24c03311a480fb96eb78f0ce7ea6d091 Author: Raju Rangoju Date: Wed Jan 11 22:58:52 2023 +0530 amd-xgbe: Delay AN timeout during KR training AN restart triggered during KR training not only aborts the KR training process but also move the HW to unstable state. Driver has to wait upto 500ms or until the KR training is completed before restarting AN cycle. Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe") Co-developed-by: Sudheesh Mavila Signed-off-by: Sudheesh Mavila Signed-off-by: Raju Rangoju Acked-by: Shyam Sundar S K Signed-off-by: Jakub Kicinski commit 579923d84b04abb6cd4cd1fd9974096a2dd1832b Author: Raju Rangoju Date: Wed Jan 11 22:58:51 2023 +0530 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent There is difference in the TX Flow Control registers (TFCR) between the revisions of the hardware. The older revisions of hardware used to have single register per queue. Whereas, the newer revision of hardware (from ver 30H onwards) have one register per priority. Update the driver to use the TFCR based on the reported version of the hardware. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Co-developed-by: Ajith Nayak Signed-off-by: Ajith Nayak Signed-off-by: Raju Rangoju Acked-by: Shyam Sundar S K Signed-off-by: Jakub Kicinski commit 0ea90f36a1e1f7a44580caed7ae1b96e5da14bb9 Merge: d9fc1511728c1 f216033d770f7 Author: Jakub Kicinski Date: Thu Jan 12 20:01:44 2023 -0800 Merge tag 'wireless-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Some fixes, stack only for now: * iTXQ conversion fixes, various bugs reported * properly reset multiple BSSID settings * fix for a link_sta crash * fix for AP VLAN checks * fix for MLO address translation * tag 'wireless-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix MLO + AP_VLAN check mac80211: Fix MLO address translation for multiple bss case wifi: mac80211: reset multiple BSSID options in stop_ap() wifi: mac80211: Fix iTXQ AMPDU fragmentation handling wifi: mac80211: sdata can be NULL during AMPDU start wifi: mac80211: Proper mark iTXQs for resumption wifi: mac80211: fix initialization of rx->link and rx->link_sta ==================== Link: https://lore.kernel.org/r/20230112111941.82408-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit e695bc7e542358978434c8489a5a164d2bbefae8 Merge: 51883883acff1 f4a75b5933c99 Author: Dave Airlie Date: Fri Jan 13 13:01:22 2023 +1000 Merge tag 'drm-msm-fixes-2023-01-12' of https://gitlab.freedesktop.org/drm/msm into drm-fixes msm-fixes for v6.3-rc4 Display Fixes: - Fix the documentation for dpu_encoder_phys_wb_init() and dpu_encoder_phys_wb_setup_fb() APIs to address doc warnings - Remove vcca-supply and vdds-supply as mandatory for 14nm PHY and 10nm PHY DT schemas respectively as they are not present on some SOCs using these PHYs - Add the dsi-phy-regulator-ldo-mode to dsi-phy-28nm.yaml as it was missed out during txt to yaml migration - Remove operating-points-v2 and power-domain as a required property for the DSI controller as thats not the case for every SOC - Fix the description from display escape clock to display core clock in the dsi controller yaml - Fix the memory leak for mdp1-mem path for the cases when we return early after failing to get mdp0-mem ICC paths for msm - Fix error handling path in msm_hdmi_dev_probe() to release the phy ref count when devm_pm_runtime_enable() fails - Fix the dp_aux_isr() routine to make sure it doesnt incorrectly signal the aux transaction as complete if the ISR was not an AUX isr. This fixes a big hitter stability bug on chromebooks. - Add protection against null pointer dereference when there is no kms object as in the case of headless adreno GPU in the shutdown path. GPU Fixes: - a5xx: fix quirks to actually be a bitmask and not overwrite each other - a6xx: fix gx halt sequence to avoid 1000ms hang on some devices - kexec shutdown fix - fix potential double free Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGv7=in_MHW3kdkhqh7ZFoVCmnikmr29YYHCXR=7aOEneg@mail.gmail.com commit 9f907439dc80e4a2fcfb949927b36c036468dbb3 Author: Tonghao Zhang Date: Wed Jan 11 17:29:01 2023 +0800 bpf: hash map, avoid deadlock with suitable hash mask The deadlock still may occur while accessed in NMI and non-NMI context. Because in NMI, we still may access the same bucket but with different map_locked index. For example, on the same CPU, .max_entries = 2, we update the hash map, with key = 4, while running bpf prog in NMI nmi_handle(), to update hash map with key = 20, so it will have the same bucket index but have different map_locked index. To fix this issue, using min mask to hash again. Fixes: 20b6cc34ea74 ("bpf: Avoid hashtab deadlock with map_locked") Signed-off-by: Tonghao Zhang Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Song Liu Cc: Yonghong Song Cc: John Fastabend Cc: KP Singh Cc: Stanislav Fomichev Cc: Hao Luo Cc: Jiri Olsa Cc: Hou Tao Acked-by: Yonghong Song Acked-by: Hou Tao Link: https://lore.kernel.org/r/20230111092903.92389-1-tong@infragraf.org Signed-off-by: Martin KaFai Lau commit 51883883acff13df355ea60d4ede9f6e0e50a9d8 Merge: 28d31e1aeda06 58fc14e14d288 Author: Dave Airlie Date: Fri Jan 13 12:44:21 2023 +1000 Merge tag 'drm-intel-fixes-2023-01-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Reserve enough fence slot for i915_vma_unbind_vsync (Nirmoy) - Fix potential use after free (Rob Clark) - Reset engines twice in case of reset failure (Chris) - Use multi-cast registers for SVG Unit registers (Gustavo) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y8AbHelGeXc5eQ8U@intel.com commit 28d31e1aeda0687feffaf3613b56375afe09db9d Merge: a283773308a08 a6941f89d7c6a Author: Dave Airlie Date: Fri Jan 13 12:37:24 2023 +1000 Merge tag 'amd-drm-fixes-6.2-2023-01-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-01-11: amdgpu: - SMU13 fan speed fix - SMU13 fix power cap handling - SMU13 BACO fix - Fix a possible segfault in bo validation error case - Delay removal of firmware framebuffer - Fix error when unloading amdkfd: - SVM fix when clearing vram - GC11 fix for multi-GPU Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230112033004.8184-1-alexander.deucher@amd.com commit a283773308a08c7009b3e095d188eb809a51425c Merge: b7bfaa761d760 5640e81607152 Author: Dave Airlie Date: Fri Jan 13 11:44:54 2023 +1000 Merge tag 'drm-misc-fixes-2023-01-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Several fixes for amdgpu (all addressing issues with fences), yet another orientation quirk for a Lenovo device, a use-after-free fix for virtio, a regression fix in TTM and a performance regression in drm buddy. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230112130954.pxt77g3a7rokha42@houat commit d9fc1511728c15df49ff18e49a494d00f78b7cd4 Merge: 5be413a6e2a16 be53771c87f4e Author: Linus Torvalds Date: Thu Jan 12 18:20:44 2023 -0600 Merge tag 'net-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from rxrpc. The rxrpc changes are noticeable large: to address a recent regression has been necessary completing the threaded refactor. Current release - regressions: - rxrpc: - only disconnect calls in the I/O thread - move client call connection to the I/O thread - fix incoming call setup race - eth: mlx5: - restore pkt rate policing support - fix memory leak on updating vport counters Previous releases - regressions: - gro: take care of DODGY packets - ipv6: deduct extension header length in rawv6_push_pending_frames - tipc: fix unexpected link reset due to discovery messages Previous releases - always broken: - sched: disallow noqueue for qdisc classes - eth: ice: fix potential memory leak in ice_gnss_tty_write() - eth: ixgbe: fix pci device refcount leak - eth: mlx5: - fix command stats access after free - fix macsec possible null dereference when updating MAC security entity (SecY)" * tag 'net-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) r8152: add vendor/device ID pair for Microsoft Devkit net: stmmac: add aux timestamps fifo clearance wait bnxt: make sure we return pages to the pool net: hns3: fix wrong use of rss size during VF rss config ipv6: raw: Deduct extension header length in rawv6_push_pending_frames net: lan966x: check for ptp to be enabled in lan966x_ptp_deinit() net: sched: disallow noqueue for qdisc classes iavf/iavf_main: actually log ->src mask when talking about it igc: Fix PPS delta between two synchronized end-points ixgbe: fix pci device refcount leak octeontx2-pf: Fix resource leakage in VF driver unbind selftests/net: l2_tos_ttl_inherit.sh: Ensure environment cleanup on failure. selftests/net: l2_tos_ttl_inherit.sh: Run tests in their own netns. selftests/net: l2_tos_ttl_inherit.sh: Set IPv6 addresses with "nodad". net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY) net/mlx5e: Fix macsec ssci attribute handling in offload path net/mlx5: E-switch, Coverity: overlapping copy net/mlx5e: Don't support encap rules with gbp option net/mlx5: Fix ptp max frequency adjustment range net/mlx5e: Fix memory leak on updating vport counters ... commit 5be413a6e2a16e08c8f0f1b59794a7203b5eca2c Merge: bad8c4a850eaf 1ecf7bd9c267a Author: Linus Torvalds Date: Thu Jan 12 17:09:20 2023 -0600 Merge tag 's390-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Add various missing READ_ONCE() to cmpxchg() loops prevent the compiler from potentially generating incorrect code. This includes a rather large change to the s390 specific hardware sampling code and its current use of cmpxchg_double(). Do the fix now to get it out of the way of Peter Zijlstra's cmpxchg128() work, and have something that can be backported. The added new code includes a private 128 bit cmpxchg variant which will be removed again after Peter's rework is available. Also note that this 128 bit cmpxchg variant is used to implement 128 bit READ_ONCE(), while strictly speaking it wouldn't be necessary, and _READ_ONCE() should also be sufficient; even though it isn't obvious for all converted locations that this is the case. Therefore use this implementation for for the sake of clarity and consistency for now. - Fix ipl report address handling to avoid kdump failures/hangs. - Fix misuse of #(el)if in kernel decompressor. - Define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36, caused by the recently changed discard behaviour. - Make sure _edata and _end symbols are always page aligned. - The current header guard DEBUG_H in one of the s390 specific header files is too generic and conflicts with the ath9k wireless driver. Add an _ASM_S390_ prefix to the guard to make it unique. - Update defconfigs. * tag 's390-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs KVM: s390: interrupt: use READ_ONCE() before cmpxchg() s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops s390/kexec: fix ipl report address for kdump s390: fix -Wundef warning for CONFIG_KERNEL_ZSTD s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 s390: expicitly align _edata and _end symbols on page boundary s390/debug: add _ASM_S390_ prefix to header guard commit bad8c4a850eaf386df681d951e3afc06bf1c7cf8 Merge: 772d0e9144df4 f57034cedeb6e Author: Linus Torvalds Date: Thu Jan 12 17:02:20 2023 -0600 Merge tag 'for-linus-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - two cleanup patches - a fix of a memory leak in the Xen pvfront driver - a fix of a locking issue in the Xen hypervisor console driver * tag 'for-linus-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/pvcalls: free active map buffer on pvcalls_front_free_map hvc/xen: lock console list traversal x86/xen: Remove the unused function p2m_index() xen: make remove callback of xen driver void returned commit 772d0e9144df4fdf68b23f2136a512e2e5670e9a Merge: a7b19c603e0ca f3cb80804b829 Author: Linus Torvalds Date: Thu Jan 12 16:53:39 2023 -0600 Merge tag 'timers-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer doc fixes from Ingo Molnar: - Fix various DocBook formatting errors in kernel/time/ that generated (justified) warnings during a kernel-doc build. * tag 'timers-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Fix various kernel-doc problems commit a7b19c603e0ca156fb2422017a053d5d48fc769b Merge: ea66bf86536d4 5268a2842066c Author: Linus Torvalds Date: Thu Jan 12 16:47:32 2023 -0600 Merge tag 'perf-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events hw enablement from Ingo Molnar: - More hardware-enablement for Intel Meteor Lake & Emerald Rapid systems: pure model ID enumeration additions that do not affect other systems. * tag 'perf-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Add Emerald Rapids perf/x86/msr: Add Emerald Rapids perf/x86/msr: Add Meteor Lake support perf/x86/cstate: Add Meteor Lake support commit ea66bf86536d4d98932843896e9d940110a06701 Merge: cf4d5be89c0ad 9a5418bc48bab Author: Linus Torvalds Date: Thu Jan 12 16:39:43 2023 -0600 Merge tag 'sched-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix scheduler frequency invariance bug related to overly long tickless periods triggering an integer overflow and disabling the feature. - Fix use-after-free bug in dup_user_cpus_ptr(). - Fix do_set_cpus_allowed() deadlock scenarios related to calling kfree() with the pi_lock held. NOTE: the rcu_free() is the 'lazy' solution here - we looked at patches to free the structure after the pi_lock got dropped, but that looked quite a bit messier - and none of this is truly performance critical. We can revisit this if it's too lazy of a solution ... * tag 'sched-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Use kfree_rcu() in do_set_cpus_allowed() sched/core: Fix use-after-free bug in dup_user_cpus_ptr() sched/core: Fix arch_scale_freq_tick() on tickless systems commit cf4d5be89c0ad339108e672a2f973bf276bd5d2c Merge: f129b61612af0 cad90e5381d84 Author: Linus Torvalds Date: Thu Jan 12 14:41:32 2023 -0600 Merge tag 'core-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Ingo Molnar: - Fix objtool to be more permissive with hand-written assembly that uses non-function symbols in executable sections. * tag 'core-urgent-2023-01-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Tolerate STT_NOTYPE symbols at end of section commit f129b61612af0627fb208b5daf6666f7a3ad9e07 Merge: c757fc92a3f73 00b18da408933 Author: Linus Torvalds Date: Thu Jan 12 14:38:22 2023 -0600 Merge tag 'urgent-nolibc.2023.01.09a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc fixes from Paul McKenney: - The fd_set structure was incorrectly defined as arrays of u32 instead of long, which breaks BE64. Fix courtesy of Sven Schnelle. - S_ISxxx macros were incorrectly testing the bits after applying them instead of bitwise ANDing S_FMT with the value. Fix from Warner Losh. - The mips code was randomly broken due to an unprotected "noreorder" directive in the _start code that could prevent the assembler from filling delayed slots. This in turn resulted in random other instructions being placed into those slots. Fix courtesy of Willy Tarreau. - The current nolibc header layout refrains from including files that are not explicitly included by the code using nolibc. Unfortunately, this causes build failures when such files contain definitions that are used (for example) by libgcc. Example definitions include raise() and memset(), which are called by some architectures, but only at certain optimization levels. Fix courtesy of Willy Tarreau. - gcc 11.3 in ARM thumb2 mode at -O2 recognized a memset() construction inside the memset() definition. The compiler replaced this construction with a call to... memset(). Userland cannot be forced to build with -ffreestanding, so an empty asm() statement was introduced into the loop the loop in order to prevent the compiler from making this unproductive transformation. Fix courtesy of Willy Tarreau. - Most of the O_* macros were wrong on RISCV because their octal values were coded as hexadecimal. This resulted in the getdents64() selftest failing. Fix courtesy of Willy Tarreau. This was tested on x86_64, i386, armv5, armv7, thumb1, thumb2, mips and riscv, all at -O0, -Os and -O3. * tag 'urgent-nolibc.2023.01.09a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools/nolibc: fix the O_* fcntl/open macro definitions for riscv tools/nolibc: prevent gcc from making memset() loop over itself tools/nolibc: fix missing includes causing build issues at -O0 tools/nolibc: restore mips branch ordering in the _start block tools/nolibc: Fix S_ISxxx macros nolibc: fix fd_set type commit 9fdaca2c1e157dc0a3c0faecf3a6a68e7d8d0c7b Author: Mark Brown Date: Wed Jan 11 22:33:07 2023 +0000 kselftest: Fix error message for unconfigured LLVM builds We are missing a ) when we attempt to complain about not having enough configuration for clang, resulting in the rather inscrutable error: ../lib.mk:23: *** unterminated call to function 'error': missing ')'. Stop. Add the required ) so we print the message we were trying to print. Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit cf5ac2d45f6e4d11ad78e7b10ae9a4121ba5e995 Author: Hans de Goede Date: Wed Jan 11 21:14:26 2023 +0100 platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode acpi_get_and_request_gpiod() does not take a gpio_lookup_flags argument specifying that the pins direction should be initialized to a specific value. This means that in some cases the pins might be left in input mode, causing the gpiod_set() calls made to enable the clk / regulator to not work. One example of this problem is the clk-enable GPIO for the ov01a1s sensor on a Dell Latitude 9420 being left in input mode causing the clk to never get enabled. Explicitly set the direction of the pins to output to fix this. Fixes: 5de691bffe57 ("platform/x86: Add intel_skl_int3472 driver") Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Reviewed-by: Daniel Scally Reviewed-by: Sakari Ailus Link: https://lore.kernel.org/r/20230111201426.947853-1-hdegoede@redhat.com commit ccb32e2be14271a60e9ba89c6d5660cc9998773c Author: Miaoqian Lin Date: Thu Dec 29 11:25:33 2022 +0400 platform/x86/amd: Fix refcount leak in amd_pmc_probe pci_get_domain_bus_and_slot() takes reference, the caller should release the reference by calling pci_dev_put() after use. Call pci_dev_put() in the error path to fix this. Fixes: 3d7d407dfb05 ("platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature") Signed-off-by: Miaoqian Lin Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20221229072534.1381432-1-linmq006@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6aa5207838ccf79879f212034435a5606f890eea Author: Gayatri Kammela Date: Wed Dec 28 15:05:53 2022 -0800 platform/x86: intel/pmc/core: Add Meteor Lake mobile support Add Meteor Lake mobile support to pmc core driver. Meteor Lake mobile parts reuse all the Meteor Lake PCH IPs. Cc: David E Box Signed-off-by: Gayatri Kammela Link: https://lore.kernel.org/r/20221228230553.2497183-1-gayatri.kammela@linux.intel.com Signed-off-by: Hans de Goede commit d348b1d761e358a4ba03fb34aa7e3dbd278db236 Author: Henning Schild Date: Thu Dec 22 11:37:20 2022 +0100 platform/x86: simatic-ipc: add another model Add IPC PX-39A support. Signed-off-by: Henning Schild Link: https://lore.kernel.org/r/20221222103720.8546-3-henning.schild@siemens.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ed058eab22d64c00663563e8e1e112989c65c59f Author: Henning Schild Date: Thu Dec 22 11:37:19 2022 +0100 platform/x86: simatic-ipc: correct name of a model What we called IPC427G should be renamed to BX-39A to be more in line with the actual product name. Signed-off-by: Henning Schild Link: https://lore.kernel.org/r/20221222103720.8546-2-henning.schild@siemens.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit b0907cadabcae6f1248f37a32a6e777f9ff6d4aa Author: Adrian Huang Date: Tue Jan 10 09:45:12 2023 +0800 md: fix incorrect declaration about claim_rdev in md_import_device Commit fb541ca4c365 ("md: remove lock_bdev / unlock_bdev") removes wrappers for blkdev_get/blkdev_put. However, the uninitialized local static variable of pointer type 'claim_rdev' in md_import_device() is NULL, which leads to the following warning call trace: WARNING: CPU: 22 PID: 1037 at block/bdev.c:577 bd_prepare_to_claim+0x131/0x150 CPU: 22 PID: 1037 Comm: mdadm Not tainted 6.2.0-rc3+ #69 .. RIP: 0010:bd_prepare_to_claim+0x131/0x150 .. Call Trace: ? _raw_spin_unlock+0x15/0x30 ? iput+0x6a/0x220 blkdev_get_by_dev.part.0+0x4b/0x300 md_import_device+0x126/0x1d0 new_dev_store+0x184/0x240 md_attr_store+0x80/0xf0 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x2be/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc It turns out the md device cannot be used: md: could not open device unknown-block(259,0). md: md127 stopped. Fix the issue by declaring the local static variable of struct type and passing the pointer of the variable to blkdev_get_by_dev(). Fixes: fb541ca4c365 ("md: remove lock_bdev / unlock_bdev") Cc: Christoph Hellwig Signed-off-by: Adrian Huang Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu commit 6dc485f9940df8105ea729cbeb7a7d18d409dde5 Author: Hans de Goede Date: Wed Dec 21 23:07:24 2022 +0100 platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present Unlike keys where userspace only reacts to keypresses, userspace may act on switches in both (0 and 1) of their positions. For example if a SW_TABLET_MODE switch is registered then GNOME will not automatically show the onscreen keyboard when a text field gets focus on touchscreen devices when SW_TABLET_MODE reports 0 and when SW_TABLET_MODE reports 1 libinput will block (filter out) builtin keyboard and touchpad events. So to avoid unwanted side-effects EV_SW type inputs should only be registered if they are actually present, only register SW_CAMERA_LENS_COVER if it is actually there. Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221221220724.119594-2-hdegoede@redhat.com commit 1af7fef0d9d3fa075bf4e850f705df1fe97d33ce Author: Hans de Goede Date: Wed Dec 21 23:07:23 2022 +0100 platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting Use KE_VSW instead of KE_SW for the SW_CAMERA_LENS_COVER key_entry and get the value of the switch from the status field when handling SW_CAMERA_LENS_COVER events, instead of always reporting 0. Also correctly set the initial SW_CAMERA_LENS_COVER value. Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221221220724.119594-1-hdegoede@redhat.com commit 01fd7e7851ba2275662f771ee17d1f80e7bbfa52 Author: Thomas Weißschuh Date: Wed Dec 21 17:59:51 2022 +0000 platform/x86: asus-wmi: Don't load fan curves without fan If we do not have a fan it does not make sense to load curves for it. This removes the following warnings from the kernel log: asus_wmi: fan_curve_get_factory_default (0x00110024) failed: -19 asus_wmi: fan_curve_get_factory_default (0x00110025) failed: -19 Fixes: a2bdf10ce96e ("platform/x86: asus-wmi: Increase FAN_CURVE_BUF_LEN to 32") Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20221221-asus-fan-v1-3-e07f3949725b@weissschuh.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 82cc5c6c624c63f7b57214e325e2ea685d924e89 Author: Thomas Weißschuh Date: Wed Dec 21 17:59:50 2022 +0000 platform/x86: asus-wmi: Ignore fan on E410MA The ASUS VivoBook has a fan device described in its ACPI tables but does not actually contain any physical fan. Use the quirk to inhibit fan handling. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20221221-asus-fan-v1-2-e07f3949725b@weissschuh.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c874b6de4cdfa2822a07b479887cd5f87fb5d078 Author: Thomas Weißschuh Date: Wed Dec 21 17:59:49 2022 +0000 platform/x86: asus-wmi: Add quirk wmi_ignore_fan Some laptops have a fan device listed in their ACPI tables but do not actually contain a fan. Introduce a quirk that can be used to override the fan detection logic. This was observed with a ASUS VivoBook E410MA running firmware E410MAB.304. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20221221-asus-fan-v1-1-e07f3949725b@weissschuh.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ec4a1d9301100c011312357ea25627b98eb293d5 Author: Yoshihiro Shimoda Date: Mon Dec 26 15:42:16 2022 +0900 phy: renesas: r8a779f0-eth-serdes: Fix register setting Fix register setting which is typo in r8a779f0_eth_serdes_chan_setting(). Fixes: 742859441d44 ("phy: renesas: Add Renesas Ethernet SERDES driver for R-Car S4-8") Signed-off-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221226064216.3895421-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Vinod Koul commit db9494895b405bf318dc7e563dee6daa51b3b6ed Author: Hans de Goede Date: Thu Jan 12 19:18:41 2023 +0100 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK The 0x33 keycode is emitted by Fn + F6 on a ASUS FX705GE laptop. Reported-by: Nemcev Aleksey Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230112181841.84652-1-hdegoede@redhat.com commit c78a4e191839edc1e8c3e51565cf2e71d40e8883 Author: Thomas Weißschuh Date: Wed Dec 21 03:49:59 2022 +0000 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_CAMERA This keycode is emitted on a Asus VivoBook E410MAB with firmware E410MAB.304. The physical key has a strikken-through camera printed on it. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20221216-asus-key-v1-1-45da124119a3@weissschuh.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 17eee264ef386ef30a69dd70e36f29893b85c170 Author: Shang XiaoJing Date: Fri Nov 25 10:12:22 2022 +0800 phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe() sp_usb_phy_probe() will call platform_get_resource_byname() that may fail and return NULL. devm_ioremap() will use usbphy->moon4_res_mem->start as input, which may causes null-ptr-deref. Check the ret value of platform_get_resource_byname() to avoid the null-ptr-deref. Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021") Signed-off-by: Shang XiaoJing Link: https://lore.kernel.org/r/20221125021222.25687-1-shangxiaojing@huawei.com Signed-off-by: Vinod Koul commit c965daac370f08a9b71d573a71d13cda76f2a884 Author: Maximilian Luz Date: Tue Dec 20 18:56:07 2022 +0100 platform/surface: aggregator: Add missing call to ssam_request_sync_free() Although rare, ssam_request_sync_init() can fail. In that case, the request should be freed via ssam_request_sync_free(). Currently it is leaked instead. Fix this. Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20221220175608.1436273-1-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ae0fa0a3126a86c801c3220fcd8eefe03aa39f3e Author: Maximilian Luz Date: Fri Dec 2 23:33:19 2022 +0100 platform/surface: aggregator: Ignore command messages not intended for us It is possible that we (the host/kernel driver) receive command messages that are not intended for us. Ignore those for now. The whole story is a bit more complicated: It is possible to enable debug output on SAM, which is sent via SSH command messages. By default this output is sent to a debug connector, with its own target ID (TID=0x03). It is possible to override the target of the debug output and set it to the host/kernel driver. This, however, does not change the original target ID of the message. Meaning, we receive messages with TID=0x03 (debug) but expect to only receive messages with TID=0x00 (host). The problem is that the different target ID also comes with a different scope of request IDs. In particular, these do not follow the standard event rules (i.e. do not fall into a set of small reserved values). Therefore, current message handling interprets them as responses to pending requests and tries to match them up via the request ID. However, these debug output messages are not in fact responses, and therefore this will at best fail to find the request and at worst pass on the wrong data as response for a request. Therefore ignore any command messages not intended for us (host) for now. We can implement support for the debug messages once we have a better understanding of them. Note that this may also provide a bit more stability and avoid some driver confusion in case any other targets want to talk to us in the future, since we don't yet know what to do with those as well. A warning for the dropped messages should suffice for now and also give us a chance of discovering new targets if they come along without any potential for bugs/instabilities. Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20221202223327.690880-2-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3d25b1e8369273d76f5f2634f164236ba9e40d32 Merge: 49e4d04f04861 c7c0644ead24c Author: Jens Axboe Date: Thu Jan 12 10:36:35 2023 -0700 Merge tag 'nvme-6.2-2023-01-12' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - Identify quirks for Apple controllers (Hector Martin) - fix error handling in nvme_pci_enable (Tong Zhang) - refuse unprivileged passthrough on partitions (Christoph Hellwig) - fix MAINTAINERS to not match nvmem subsystem headers (Russell King)" * tag 'nvme-6.2-2023-01-12' of git://git.infradead.org/nvme: MAINTAINERS: stop nvme matching for nvmem files nvme: don't allow unprivileged passthrough on partitions nvme: replace the "bool vec" arguments with flags in the ioctl path nvme: remove __nvme_ioctl nvme-pci: fix error handling in nvme_pci_enable() nvme-pci: add NVME_QUIRK_IDENTIFY_CNS quirk to Apple T2 controllers nvme-apple: add NVME_QUIRK_IDENTIFY_CNS quirk to fix regression commit 6e5aedb9324aab1c14a23fae3d8eeb64a679c20e Author: Jens Axboe Date: Tue Jan 10 10:44:37 2023 -0700 io_uring/poll: attempt request issue after racy poll wakeup If we have multiple requests waiting on the same target poll waitqueue, then it's quite possible to get a request triggered and get disappointed in not being able to make any progress with it. If we race in doing so, we'll potentially leave the poll request on the internal tables, but removed from the waitqueue. That means that any subsequent trigger of the poll waitqueue will not kick that request into action, causing an application to potentially wait for completion of a request that will never happen. Fix this by adding a new poll return state, IOU_POLL_REISSUE. Rather than have complicated logic for how to re-arm a given type of request, just punt it for a reissue. While in there, move the 'ret' variable to the only section where it gets used. This avoids confusion the scope of it. Cc: stable@vger.kernel.org Fixes: eb0089d629ba ("io_uring: single shot poll removal optimisation") Signed-off-by: Jens Axboe commit 36c2b9d6710427f802494ba070621cb415198293 Author: Michael Klein Date: Tue Dec 20 13:11:03 2022 +0100 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD Add touchscreen info for the CSL Panther Tab HD. Signed-off-by: Michael Klein Link: https://lore.kernel.org/r/20221220121103.uiwn5l7fii2iggct@LLGMVZLB-0037 Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6c331f32e32ac71eb3e8b93fceda2802d7ecb889 Author: Duke Xin(辛安文) Date: Tue Dec 27 01:44:30 2022 -0800 USB: serial: option: add Quectel EM05-G (GR) modem The EM05-G (GR) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "RMNET" : AT + DIAG + NMEA + Modem + QMI "MBIM" : MBIM + AT + DIAG + NMEA + Modem The detailed description of the USB configuration for each mode as follows: RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0313 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0313 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Duke Xin(辛安文) Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit bb78654b0b46316dac687fd4b7dc7cce636f46cd Author: Duke Xin(辛安文) Date: Tue Dec 27 01:28:25 2022 -0800 USB: serial: option: add Quectel EM05-G (CS) modem The EM05-G (CS) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "RMNET" : AT + DIAG + NMEA + Modem + QMI "MBIM" : MBIM + AT + DIAG + NMEA + Modem The detailed description of the USB configuration for each mode as follows: RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030C Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030C Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Duke Xin(辛安文) Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 64e57b2195725c1ae2246a8a2ce224abb60620ac Author: Andy Shevchenko Date: Thu Jan 12 13:28:52 2023 +0200 ASoC: Intel: sof_es8336: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: a164137ce91a ("ASoC: Intel: add machine driver for SOF+ES8336") Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230112112852.67714-6-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit c8aa49abdeda2ab587aadb083e670f6aa0236f93 Author: Andy Shevchenko Date: Thu Jan 12 13:28:51 2023 +0200 ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: 9a87fc1e0619 ("ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102") Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230112112852.67714-5-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit cbf87bcf46e399e9a5288430d940efbad3551c68 Author: Andy Shevchenko Date: Thu Jan 12 13:28:50 2023 +0200 ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: a232b96dcece ("ASoC: Intel: bytcr_rt5640: use HID translation util") Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230112112852.67714-4-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 721858823d7cdc8f2a897579b040e935989f6f02 Author: Andy Shevchenko Date: Thu Jan 12 13:28:49 2023 +0200 ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: 02c0a3b3047f ("ASoC: Intel: bytcr_rt5651: add MCLK, quirks and cleanups") Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230112112852.67714-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 6b1c0bd6fdefbf3c3d75680c2708f5423ef72e46 Author: Andy Shevchenko Date: Thu Jan 12 13:28:48 2023 +0200 ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: 3c22a73fb873 ("ASoC: Intel: bytcht_es8316: fix HID handling") Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230112112852.67714-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit a152d05ae4a71d802d50cf9177dba34e8bb09f68 Author: Volker Lendecke Date: Wed Jan 11 12:37:58 2023 +0100 cifs: Fix uninitialized memory read for smb311 posix symlink create If smb311 posix is enabled, we send the intended mode for file creation in the posix create context. Instead of using what's there on the stack, create the mfsymlink file with 0644. Fixes: ce558b0e17f8a ("smb3: Add posix create context for smb3.11 posix mounts") Cc: stable@vger.kernel.org Signed-off-by: Volker Lendecke Reviewed-by: Tom Talpey Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 09e44868f1e03c7825ca4283256abedc95e249a3 Author: Filipe Manana Date: Tue Jan 10 14:56:38 2023 +0000 btrfs: do not abort transaction on failure to update log root When syncing a log, if we fail to update a log root in the log root tree, we are aborting the transaction if the failure was not -ENOSPC. This is excessive because there is a chance that a transaction commit can succeed, and therefore avoid to turn the filesystem into RO mode. All we need to be careful about is to mark the log for a full commit, which we already do, to make sure no one commits a super block pointing to an outdated log root tree. So don't abort the transaction if we fail to update a log root in the log root tree, and log an error if the failure is not -ENOSPC, so that it does not go completely unnoticed. CC: stable@vger.kernel.org # 6.0+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 16199ad9eb6db60a6b10794a09fc1ac6d09312ff Author: Filipe Manana Date: Tue Jan 10 14:56:37 2023 +0000 btrfs: do not abort transaction on failure to write log tree when syncing log When syncing the log, if we fail to write log tree extent buffers, we mark the log for a full commit and abort the transaction. However we don't need to abort the transaction, all we really need to do is to make sure no one can commit a superblock pointing to new log tree roots. Just because we got a failure writing extent buffers for a log tree, it does not mean we will also fail to do a transaction commit. One particular case is if due to a bug somewhere, when writing log tree extent buffers, the tree checker detects some corruption and the writeout fails because of that. Aborting the transaction can be very disruptive for a user, specially if the issue happened on a root filesystem. One example is the scenario in the Link tag below, where an isolated corruption on log tree leaves was causing transaction aborts when syncing the log. Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/ CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 94cd63ae679973edeb5ea95ec25a54467c3e54c8 Author: Filipe Manana Date: Tue Jan 10 14:56:36 2023 +0000 btrfs: add missing setup of log for full commit at add_conflicting_inode() When logging conflicting inodes, if we reach the maximum limit of inodes, we return BTRFS_LOG_FORCE_COMMIT to force a transaction commit. However we don't mark the log for full commit (with btrfs_set_log_full_commit()), which means that once we leave the log transaction and before we commit the transaction, some other task may sync the log, which is incomplete as we have not logged all conflicting inodes, leading to some inconsistent in case that log ends up being replayed. So also call btrfs_set_log_full_commit() at add_conflicting_inode(). Fixes: e09d94c9e448 ("btrfs: log conflicting inodes without holding log mutex of the initial inode") CC: stable@vger.kernel.org # 6.1 Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 8bb6898da6271d82d8e76d8088d66b971a7dcfa6 Author: Filipe Manana Date: Tue Jan 10 14:56:35 2023 +0000 btrfs: fix directory logging due to race with concurrent index key deletion Sometimes we log a directory without holding its VFS lock, so while we logging it, dir index entries may be added or removed. This typically happens when logging a dentry from a parent directory that points to a new directory, through log_new_dir_dentries(), or when while logging some other inode we also need to log its parent directories (through btrfs_log_all_parents()). This means that while we are at log_dir_items(), we may not find a dir index key we found before, because it was deleted in the meanwhile, so a call to btrfs_search_slot() may return 1 (key not found). In that case we return from log_dir_items() with a success value (the variable 'err' has a value of 0). This can lead to a few problems, specially in the case where the variable 'last_offset' has a value of (u64)-1 (and it's initialized to that when it was declared): 1) By returning from log_dir_items() with success (0) and a value of (u64)-1 for '*last_offset_ret', we end up not logging any other dir index keys that follow the missing, just deleted, index key. The (u64)-1 value makes log_directory_changes() not call log_dir_items() again; 2) Before returning with success (0), log_dir_items(), will log a dir index range item covering a range from the last old dentry index (stored in the variable 'last_old_dentry_offset') to the value of 'last_offset'. If 'last_offset' has a value of (u64)-1, then it means if the log is persisted and replayed after a power failure, it will cause deletion of all the directory entries that have an index number between last_old_dentry_offset + 1 and (u64)-1; 3) We can end up returning from log_dir_items() with ctx->last_dir_item_offset having a lower value than inode->last_dir_index_offset, because the former is set to the current key we are processing at process_dir_items_leaf(), and at the end of log_directory_changes() we set inode->last_dir_index_offset to the current value of ctx->last_dir_item_offset. So if for example a deletion of a lower dir index key happened, we set ctx->last_dir_item_offset to that index value, then if we return from log_dir_items() because btrfs_search_slot() returned 1, we end up returning from log_dir_items() with success (0) and then log_directory_changes() sets inode->last_dir_index_offset to a lower value than it had before. This can result in unpredictable and unexpected behaviour when we need to log again the directory in the same transaction, and can result in ending up with a log tree leaf that has duplicated keys, as we do batch insertions of dir index keys into a log tree. So fix this by making log_dir_items() move on to the next dir index key if it does not find the one it was looking for. Reported-by: David Arendt Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/ CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6d3d970b2735b967650d319be27268fedc5598d1 Author: Filipe Manana Date: Tue Jan 10 14:56:34 2023 +0000 btrfs: fix missing error handling when logging directory items When logging a directory, at log_dir_items(), if we get an error when attempting to search the subvolume tree for a dir index item, we end up returning 0 (success) from log_dir_items() because 'err' is left with a value of 0. This can lead to a few problems, specially in the case the variable 'last_offset' has a value of (u64)-1 (and it's initialized to that when it was declared): 1) By returning from log_dir_items() with success (0) and a value of (u64)-1 for '*last_offset_ret', we end up not logging any other dir index keys that follow the missing, just deleted, index key. The (u64)-1 value makes log_directory_changes() not call log_dir_items() again; 2) Before returning with success (0), log_dir_items(), will log a dir index range item covering a range from the last old dentry index (stored in the variable 'last_old_dentry_offset') to the value of 'last_offset'. If 'last_offset' has a value of (u64)-1, then it means if the log is persisted and replayed after a power failure, it will cause deletion of all the directory entries that have an index number between last_old_dentry_offset + 1 and (u64)-1; 3) We can end up returning from log_dir_items() with ctx->last_dir_item_offset having a lower value than inode->last_dir_index_offset, because the former is set to the current key we are processing at process_dir_items_leaf(), and at the end of log_directory_changes() we set inode->last_dir_index_offset to the current value of ctx->last_dir_item_offset. So if for example a deletion of a lower dir index key happened, we set ctx->last_dir_item_offset to that index value, then if we return from log_dir_items() because btrfs_search_slot() returned an error, we end up returning without any error from log_dir_items() and then log_directory_changes() sets inode->last_dir_index_offset to a lower value than it had before. This can result in unpredictable and unexpected behaviour when we need to log again the directory in the same transaction, and can result in ending up with a log tree leaf that has duplicated keys, as we do batch insertions of dir index keys into a log tree. Fix this by setting 'err' to the value of 'ret' in case btrfs_search_slot() or btrfs_previous_item() returned an error. That will result in falling back to a full transaction commit. Reported-by: David Arendt Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/ Fixes: e02119d5a7b4 ("Btrfs: Add a write ahead tree log to optimize synchronous operations") CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7c24fa225081f31bc6da6a355c1ba801889ab29a Author: Dai Ngo Date: Wed Jan 11 16:06:51 2023 -0800 NFSD: replace delayed_work with work_struct for nfsd_client_shrinker Since nfsd4_state_shrinker_count always calls mod_delayed_work with 0 delay, we can replace delayed_work with work_struct to save some space and overhead. Also add the call to cancel_work after unregister the shrinker in nfs4_state_shutdown_net. Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit be53771c87f4e322a9835d3faa9cd73a4ecdec5b Author: Andre Przywara Date: Wed Jan 11 13:32:28 2023 +0000 r8152: add vendor/device ID pair for Microsoft Devkit The Microsoft Devkit 2023 is a an ARM64 based machine featuring a Realtek 8153 USB3.0-to-GBit Ethernet adapter. As in their other machines, Microsoft uses a custom USB device ID. Add the respective ID values to the driver. This makes Ethernet work on the MS Devkit device. The chip has been visually confirmed to be a RTL8153. Signed-off-by: Andre Przywara Link: https://lore.kernel.org/r/20230111133228.190801-1-andre.przywara@arm.com Signed-off-by: Paolo Abeni commit 07a2975c65f2be2e22591d795a9c39b00f95fd11 Author: Maxime Ripard Date: Thu Jan 12 10:12:43 2023 +0100 drm/vc4: bo: Fix drmm_mutex_init memory hog Commit 374146cad469 ("drm/vc4: Switch to drmm_mutex_init") converted, among other functions, vc4_create_object() to use drmm_mutex_init(). However, that function is used to allocate a BO, and therefore the mutex needs to be freed much sooner than when the DRM device is removed from the system. For each buffer allocation we thus end up allocating a small structure as part of the DRM-managed mechanism that is never freed, eventually leading us to no longer having any free memory anymore. Let's switch back to mutex_init/mutex_destroy to deal with it properly. Fixes: 374146cad469 ("drm/vc4: Switch to drmm_mutex_init") Reviewed-by: Daniel Vetter Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230112091243.490799-1-maxime@cerno.tech commit 5640e81607152d7f2d2558227c0f6cb78b8f39cf Author: Arunpravin Paneer Selvam Date: Thu Jan 12 04:00:27 2023 -0800 drm: Optimize drm buddy top-down allocation method We are observing performance drop in many usecases which include games, 3D benchmark applications,etc.. To solve this problem, We are strictly not allowing top down flag enabled allocations to steal the memory space from cpu visible region. The idea is, we are sorting each order list entries in ascending order and compare the last entry of each order list in the freelist and return the max block. This patch improves the 3D benchmark scores and solves fragmentation issues. All drm buddy selftests are verfied. drm_buddy: pass:6 fail:0 skip:0 total:6 Signed-off-by: Arunpravin Paneer Selvam Acked-by: Christian König Acked-by: Alex Deucher Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230112120027.3072-1-Arunpravin.PaneerSelvam@amd.com Signed-off-by: Christian König CC: Cc: stable@vger.kernel.org # 5.18+ commit eb6c59b735aa6cca77cdbb59cc69d69a0d63d986 Author: Anastasia Belova Date: Tue Jan 10 12:14:50 2023 +0300 xfrm: compat: change expression for switch in xfrm_xlate64 Compare XFRM_MSG_NEWSPDINFO (value from netlink configuration messages enum) with nlh_src->nlmsg_type instead of nlh_src->nlmsg_type - XFRM_MSG_BASE. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4e9505064f58 ("net/xfrm/compat: Copy xfrm_spdattr_type_t atributes") Signed-off-by: Anastasia Belova Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> Tested-by: Dmitry Safonov <0x7f454c46@gmail.com> Signed-off-by: Steffen Klassert commit 040b35c19bf2bdbb8ba5f8742b4e199ace3cbdc3 Author: Zack Rusin Date: Wed Jan 11 12:50:15 2023 -0500 drm/ttm: Fix a regression causing kernel oops'es The branch is explicitly taken if ttm == NULL which means that to avoid a null pointer reference the ttm object can not be used inside. Switch back to dst_mem to avoid kernel oops'es. This fixes kernel oops'es with any buffer objects which don't have ttm_tt, e.g. with vram based screen objects on vmwgfx. Signed-off-by: Zack Rusin Fixes: e3c92eb4a84f ("drm/ttm: rework on ttm_resource to use size_t type") Cc: Somalapuram Amaranath Cc: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230111175015.1134923-1-zack@kde.org Signed-off-by: Christian König commit d784fc8be6814b31854f7b529919ca4506ff8066 Author: Andy Shevchenko Date: Thu Jan 12 13:23:56 2023 +0200 ASoC: amd: acp-es8336: Drop reference count of ACPI device after use Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") Signed-off-by: Andy Shevchenko Acked-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230112112356.67643-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit c757fc92a3f73734872c7793b97f06434773d65d Merge: cf9668a2f2a6a b442990d244ba Author: Linus Torvalds Date: Thu Jan 12 06:10:45 2023 -0600 Merge tag 'spi-fix-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: - Fixes for long standing issues with accesses to spidev->spi during teardown in the spidev userspace driver. - Rename the newly added spi-cs-setup-ns DT property to be more in line with our other delay properties before it becomes ABI. - A few driver specific fixes. * tag 'spi-fix-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spidev: remove debug messages that access spidev->spi without locking spi: spidev: fix a race condition when accessing spidev->spi spi: Rename spi-cs-setup-ns property to spi-cs-setup-delay-ns spi: dt-bindings: Rename spi-cs-setup-ns to spi-cs-setup-delay-ns spi: cadence: Fix busy cycles calculation spi: mediatek: Enable irq before the spi registration commit cf9668a2f2a6a82d5b03894a5f5ae98d17596982 Merge: e58f087e9c579 f528fe213a6ad Author: Linus Torvalds Date: Thu Jan 12 05:59:37 2023 -0600 Merge tag 'regulator-fix-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small driver specific fixes, one of which I queued for 6.1 but didn't actually send out so has had *plenty* of testing in -next" * tag 'regulator-fix-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom-rpmh: PM8550 ldo11 regulator is an nldo regulator: da9211: Use irq handler when ready commit e58f087e9c579a909e62600c3812801227cd564c Merge: 23025cbccada8 c0f7ae27539fb Author: Linus Torvalds Date: Thu Jan 12 05:56:06 2023 -0600 Merge tag 'mtd/fixes-for-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: - cfi: Allow building spi-intel standalone to avoid build issues - parsers: scpart: Fix __udivdi3 undefined on mips - parsers: tplink_safeloader: Fix potential memory leak during parsing - Update email of Tudor Ambarus * tag 'mtd/fixes-for-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: MAINTAINERS: Update email of Tudor Ambarus mtd: cfi: allow building spi-intel standalone mtd: parsers: scpart: fix __udivdi3 undefined on mips mtd: parsers: Fix potential memory leak in mtd_parser_tplink_safeloader_parse() commit 84aa3059f42ffd702b7ba2e94867eb670070bf40 Merge: ca88eeb308a22 242fc66ae6e1e Author: Takashi Iwai Date: Thu Jan 12 12:52:08 2023 +0100 Merge tag 'asoc-fix-v6.2-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.2 There's quite a few fixes here, mostly board specific apart from the SOF power management ones. We also have some new quirks and Kconfig tweaks to enable existing code on new platforms, and a one liner which exposes the SOF firmware state in debugfs to aid with debugging. There's also a SPI fix that I mistakenly put in the wrong queue and did some merges on top of before I noticed, it seemed more trouble than it was worth to unpick things. A copy of the same patch is also in the spi tree. commit 23025cbccada8908fc6cd4d09e851de66898d2d7 Merge: e8f60cd7db24f a67aad57d9aee Author: Linus Torvalds Date: Thu Jan 12 05:50:56 2023 -0600 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Ten small fixes (less the one that cleaned up a reverted removal), nine in drivers of which the ufs one is the most critical. The single core patch is a minor speedup to error handling" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() scsi: hisi_sas: Fix tag freeing for reserved tags scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery scsi: scsi_debug: Delete unreachable code in inquiry_vpd_b0() scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile scsi: core: scsi_error: Do not queue pointless abort workqueue functions scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace scsi: mpi3mr: Remove usage of dma_get_required_mask() API scsi: mpt3sas: Remove usage of dma_get_required_mask() API commit 9bfa2544dbd1133f0b0af4e967de3bb9c1e3a497 Author: Claudiu Beznea Date: Thu Dec 8 13:52:41 2022 +0200 ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 The 2nd DDR clock for sam9x60 DDR controller is peripheral clock with id 49. Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20221208115241.36312-1-claudiu.beznea@microchip.com commit ca88eeb308a221c2dcd4a64031d2e5fcd3db9eaa Author: Luka Guzenko Date: Tue Jan 10 21:25:14 2023 +0100 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx The HP Spectre x360 13-aw0xxx devices use the ALC285 codec with GPIO 0x04 controlling the micmute LED and COEF 0x0b index 8 controlling the mute LED. A quirk was added to make these work as well as a fixup. Signed-off-by: Luka Guzenko Cc: Link: https://lore.kernel.org/r/20230110202514.2792-1-l.guzenko@web.de Signed-off-by: Takashi Iwai commit 26ce6ec364f18d2915923bc05784084e54a5c4cc Author: Juergen Gross Date: Mon Jan 9 16:09:22 2023 +0100 x86/mm: fix poking_init() for Xen PV guests Commit 3f4c8211d982 ("x86/mm: Use mm_alloc() in poking_init()") broke the kernel for running as Xen PV guest. It seems as if the new address space is never activated before being used, resulting in Xen rejecting to accept the new CR3 value (the PGD isn't pinned). Fix that by adding the now missing call of paravirt_arch_dup_mmap() to poking_init(). That call was previously done by dup_mm()->dup_mmap() and it is a NOP for all cases but for Xen PV, where it is just doing the pinning of the PGD. Fixes: 3f4c8211d982 ("x86/mm: Use mm_alloc() in poking_init()") Signed-off-by: Juergen Gross Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230109150922.10578-1-jgross@suse.com commit ae9dcb91c6069e20b3b9505d79cbc89fd6e086f5 Author: Noor Azura Ahmad Tarmizi Date: Wed Jan 11 13:02:00 2023 +0800 net: stmmac: add aux timestamps fifo clearance wait Add timeout polling wait for auxiliary timestamps snapshot FIFO clear bit (ATSFC) to clear. This is to ensure no residue fifo value is being read erroneously. Fixes: f4da56529da6 ("net: stmmac: Add support for external trigger timestamping") Cc: # 5.10.x Signed-off-by: Noor Azura Ahmad Tarmizi Link: https://lore.kernel.org/r/20230111050200.2130-1-noor.azura.ahmad.tarmizi@intel.com Signed-off-by: Jakub Kicinski commit f58c89700630da6554b24fd3df293a24874c10c1 Author: Yihang Li Date: Wed Jan 4 12:03:20 2023 +0800 scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id Currently the driver sets the port invalid if one phy in the port is not enabled, which may cause issues in expander situation. In directly attached situation, if phy up doesn't occur in time when refreshing port id, the port is incorrectly set to invalid which will also cause disk lost. Therefore set a port invalid only if there are no devices attached to the port. Signed-off-by: Yihang Li Signed-off-by: Xiang Chen Link: https://lore.kernel.org/r/1672805000-141102-3-git-send-email-chenxiang66@hisilicon.com Signed-off-by: Martin K. Petersen commit 037b48057e8b485a8d72f808122796aeadbbee32 Author: Xingui Yang Date: Wed Jan 4 12:03:19 2023 +0800 scsi: hisi_sas: Use abort task set to reset SAS disks when discovered Currently clear task set is used to abort all commands remaining in the disk when the SAS disk is discovered, and if the disk is discovered by two initiators, other I_T nexuses are also affected. So use abort task set instead and take effect only on the specified I_T nexus. Signed-off-by: Xingui Yang Signed-off-by: Xiang Chen Link: https://lore.kernel.org/r/1672805000-141102-2-git-send-email-chenxiang66@hisilicon.com Signed-off-by: Martin K. Petersen commit eb25df88287b37a63b9fb9ca6d333af2f504407a Merge: 97f5e03a4a27d 6650c8e906ce5 Author: Jakub Kicinski Date: Wed Jan 11 20:50:42 2023 -0800 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-01-10 (ixgbe, igc, iavf) This series contains updates to ixgbe, igc, and iavf drivers. Yang Yingliang adds calls to pci_dev_put() for proper ref count tracking on ixgbe. Christopher adds setting of Toggle on Target Time bits for proper pulse per second (PPS) synchronization for igc. Daniil Tatianin fixes, likely, copy/paste issue that misreported destination instead of source for IP mask for iavf error. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf/iavf_main: actually log ->src mask when talking about it igc: Fix PPS delta between two synchronized end-points ixgbe: fix pci device refcount leak ==================== Link: https://lore.kernel.org/r/20230110223825.648544-1-anthony.l.nguyen@intel.com Reviewed-by: Alexander Duyck Signed-off-by: Jakub Kicinski commit 97f5e03a4a27d27ee4fed0cdb1658c81cf2784db Author: Jakub Kicinski Date: Tue Jan 10 20:25:47 2023 -0800 bnxt: make sure we return pages to the pool Before the commit under Fixes the page would have been released from the pool before the napi_alloc_skb() call, so normal page freeing was fine (released page == no longer in the pool). After the change we just mark the page for recycling so it's still in the pool if the skb alloc fails, we need to recycle. Same commit added the same bug in the new bnxt_rx_multi_page_skb(). Fixes: 1dc4c557bfed ("bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff") Reviewed-by: Andy Gospodarek Link: https://lore.kernel.org/r/20230111042547.987749-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ae9f29fdfd827ad06c1ae8155c042245a9d00757 Author: Jie Wang Date: Tue Jan 10 19:53:59 2023 +0800 net: hns3: fix wrong use of rss size during VF rss config Currently, it used old rss size to get current tc mode. As a result, the rss size is updated, but the tc mode is still configured based on the old rss size. So this patch fixes it by using the new rss size in both process. Fixes: 93969dc14fcd ("net: hns3: refactor VF rss init APIs with new common rss init APIs") Signed-off-by: Jie Wang Signed-off-by: Hao Lan Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230110115359.10163-1-lanhao@huawei.com Signed-off-by: Jakub Kicinski commit f385f7d244134246f984975ed34cd75f77de479f Author: Dai Ngo Date: Wed Jan 11 12:17:09 2023 -0800 NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time Currently the nfsd-client shrinker is registered and unregistered at the time the nfsd module is loaded and unloaded. The problem with this is the shrinker is being registered before all of the relevant fields in nfsd_net are initialized when nfsd is started. This can lead to an oops when memory is low and the shrinker is called while nfsd is not running. This patch moves the register/unregister of nfsd-client shrinker from module load/unload time to nfsd startup/shutdown time. Fixes: 44df6f439a17 ("NFSD: add delegation reaper to react to low memory condition") Reported-by: Mike Galbraith Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd Author: Xingyuan Mo Date: Thu Jan 12 00:24:53 2023 +0800 NFSD: fix use-after-free in nfsd4_ssc_setup_dul() If signal_pending() returns true, schedule_timeout() will not be executed, causing the waiting task to remain in the wait queue. Fixed by adding a call to finish_wait(), which ensures that the waiting task will always be removed from the wait queue. Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") Signed-off-by: Xingyuan Mo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 19fa92fb72f8bc542f1673862058f3b078114004 Author: Lizzy Fleckenstein Date: Mon Jan 9 21:18:37 2023 +0100 init/Kconfig: fix typo (usafe -> unsafe) Fix the help text for the PRINTK_SAFE_LOG_BUF_SHIFT setting. Link: https://lkml.kernel.org/r/20230109201837.23873-1-eliasfleckenstein@web.de Signed-off-by: Lizzy Fleckenstein Reviewed-by: Nick Desaulniers Cc: Masahiro Yamada Signed-off-by: Andrew Morton commit fd9edbdbdcde6b489ce59f326755ef16a2ffadd7 Author: Liam Howlett Date: Mon Jan 9 20:58:20 2023 +0000 nommu: fix split_vma() map_count error During the maple tree conversion of nommu, an error in counting the VMAs was introduced by counting the existing VMA again. The counting used to be decremented by one and incremented by two, but now it only increments by two. Fix the counting error by moving the increment outside the setup_vma_to_mm() function to the callers. Link: https://lkml.kernel.org/r/20230109205809.956325-1-Liam.Howlett@oracle.com Fixes: 8220543df148 ("nommu: remove uses of VMA linked list") Signed-off-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 80be727ec87225797771a39f3e6801baf291faaf Author: Liam Howlett Date: Mon Jan 9 20:57:21 2023 +0000 nommu: fix do_munmap() error path When removing a VMA from the tree fails due to no memory, do not free the VMA since a reference still exists. Link: https://lkml.kernel.org/r/20230109205708.956103-1-Liam.Howlett@oracle.com Fixes: 8220543df148 ("nommu: remove uses of VMA linked list") Signed-off-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 7f31cced5724e6d414fe750aa1cd7e7b578ec22f Author: Liam Howlett Date: Mon Jan 9 20:55:21 2023 +0000 nommu: fix memory leak in do_mmap() error path The preallocation of the maple tree nodes may leak if the error path to "error_just_free" is taken. Fix this by moving the freeing of the maple tree nodes to a shared location for all error paths. Link: https://lkml.kernel.org/r/20230109205507.955577-1-Liam.Howlett@oracle.com Fixes: 8220543df148 ("nommu: remove uses of VMA linked list") Signed-off-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit bf61acbed8a8b38949a247333ee253899acdc35d Author: Robert Foss Date: Fri Jan 6 16:21:51 2023 +0100 MAINTAINERS: update Robert Foss' email address Update the email address for Robert's maintainer entries and fill in .mailmap accordingly. Link: https://lkml.kernel.org/r/20230106152151.115648-1-robert.foss@linaro.org Signed-off-by: Robert Foss Cc: Arnd Bergmann Cc: Baolin Wang Cc: Colin Ian King Cc: Kalle Valo Cc: Kirill Tkhai Cc: Qais Yousef Cc: Vasily Averin Signed-off-by: Andrew Morton commit 5316a017d093f644675a56523bcf5787ba8f4fef Author: Alexey Dobriyan Date: Fri Jan 6 22:30:14 2023 +0300 proc: fix PIE proc-empty-vm, proc-pid-vm tests vsyscall detection code uses direct call to the beginning of the vsyscall page: asm ("call %P0" :: "i" (0xffffffffff600000)) It generates "call rel32" instruction but it is not relocated if binary is PIE, so binary segfaults into random userspace address and vsyscall page status is detected incorrectly. Do more direct: asm ("call *%rax") which doesn't do need any relocaltions. Mark g_vsyscall as volatile for a good measure, I didn't find instruction setting it to 0. Now the code is obviously correct: xor eax, eax mov rdi, rbp mov rsi, rbp mov DWORD PTR [rip+0x2d15], eax # g_vsyscall = 0 mov rax, 0xffffffffff600000 call rax mov DWORD PTR [rip+0x2d02], 1 # g_vsyscall = 1 mov eax, DWORD PTR ds:0xffffffffff600000 mov DWORD PTR [rip+0x2cf1], 2 # g_vsyscall = 2 mov edi, [rip+0x2ceb] # exit(g_vsyscall) call exit Note: fixed proc-empty-vm test oopses 5.19.0-28-generic kernel but this is separate story. Link: https://lkml.kernel.org/r/Y7h2xvzKLg36DSq8@p183 Fixes: 5bc73bb3451b9 ("proc: test how it holds up with mapping'less process") Signed-off-by: Alexey Dobriyan Reported-by: Mirsad Goran Todorovac Tested-by: Mirsad Goran Todorovac Cc: Signed-off-by: Andrew Morton commit 8651a137e62ebfde3df95cbb1ca055d013ec5b9e Author: Lorenzo Stoakes Date: Sat Jan 7 00:00:05 2023 +0000 mm: update mmap_sem comments to refer to mmap_lock The rename from mm->mmap_sem to mm->mmap_lock was performed in commit da1c55f1b272 ("mmap locking API: rename mmap_sem to mmap_lock") and commit c1e8d7c6a7a6 ("map locking API: convert mmap_sem comments"), however some incorrect comments remain. This patch simply corrects those comments which are obviously incorrect within mm itself. Link: https://lkml.kernel.org/r/33fba04389ab63fc4980e7ba5442f521df6dc657.1673048927.git.lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0411d6ee50e3b74a793848e4f41f45860163f5cc Author: SeongJae Park Date: Fri Jan 6 20:33:31 2023 +0000 include/linux/mm: fix release_pages_arg kernel doc comment Commit 449c796768c9 ("mm: teach release_pages() to take an array of encoded page pointers too") added the kernel doc comment for release_pages() on top of 'union release_pages_arg', so making 'make htmldocs' complains as below: ./include/linux/mm.h:1268: warning: cannot understand function prototype: 'typedef union ' The kernel doc comment for the function is already on top of the function's definition in mm/swap.c, and the new comment is actually not for the function but indeed release_pages_arg. Fixing the comment to reflect the intent would be one option. But, kernel doc cannot parse the union as below due to the attribute. ./include/linux/mm.h:1272: error: Cannot parse struct or union! Modify the comment to reflect the intent but do not mark it as a kernel doc comment. Link: https://lkml.kernel.org/r/20230106203331.127532-1-sj@kernel.org Fixes: 449c796768c9 ("mm: teach release_pages() to take an array of encoded page pointers too") Signed-off-by: SeongJae Park Acked-by: Randy Dunlap Signed-off-by: Andrew Morton commit d09dce1fff8a9da10144e878ef4bbf90c65559e5 Author: Randy Dunlap Date: Mon Jan 2 13:16:14 2023 -0800 lib/win_minmax: use /* notation for regular comments Don't use kernel-doc "/**" notation for non-kernel-doc comments. Prevents a kernel-doc warning: lib/win_minmax.c:31: warning: expecting prototype for lib/minmax.c(). Prototype was for minmax_subwin_update() instead Link: https://lkml.kernel.org/r/20230102211614.26343-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Neal Cardwell Cc: Eric Dumazet Cc: David S. Miller Signed-off-by: Andrew Morton commit 0de4a7f5ba5744d1de5ce0b076bb73a86530c60c Author: Andrey Konovalov Date: Wed Jan 4 02:09:33 2023 +0100 kasan: mark kasan_kunit_executing as static Mark kasan_kunit_executing as static, as it is only used within mm/kasan/report.c. Link: https://lkml.kernel.org/r/f64778a4683b16a73bba72576f73bf4a2b45a82f.1672794398.git.andreyknvl@google.com Fixes: c8c7016f50c8 ("kasan: fail non-kasan KUnit tests on KASAN reports") Reported-by: kernel test robot Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit 7633355e5c7f29c049a9048e461427d1d8ed3051 Author: Ryusuke Konishi Date: Thu Jan 5 14:53:56 2023 +0900 nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted. By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be. Link: https://lkml.kernel.org/r/000000000000bd89e205f0e38355@google.com Link: https://lkml.kernel.org/r/20230105055356.8811-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+ede796cecd5296353515@syzkaller.appspotmail.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 1beb8ae302a01fb487787f5a4fb97cf5338a86c1 Author: Nhat Pham Date: Fri Jan 6 14:00:16 2023 -0800 Docs/admin-guide/mm/zswap: remove zsmalloc's lack of writeback warning Writeback has been implemented for zsmalloc, so this warning no longer holds. Link: https://lkml.kernel.org/r/20230106220016.172303-1-nphamcs@gmail.com Fixes: 9997bc017549a ("zsmalloc: implement writeback mechanism for zsmalloc") Suggested-by: Thomas Weißschuh Signed-off-by: Nhat Pham Reviewed-by: Sergey Senozhatsky Cc: Johannes Weiner Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit fed15f1345dc8a7fc8baa81e8b55c3ba010d7f4b Author: Peter Xu Date: Wed Jan 4 17:52:05 2023 -0500 mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects Userfaultfd-wp uses pte markers to mark wr-protected pages for both shmem and hugetlb. Shmem has pre-allocation ready for markers, but hugetlb path was overlooked. Doing so by calling huge_pte_alloc() if the initial pgtable walk fails to find the huge ptep. It's possible that huge_pte_alloc() can fail with high memory pressure, in that case stop the loop immediately and fail silently. This is not the most ideal solution but it matches with what we do with shmem meanwhile it avoids the splat in dmesg. Link: https://lkml.kernel.org/r/20230104225207.1066932-2-peterx@redhat.com Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes") Signed-off-by: Peter Xu Reported-by: James Houghton Reviewed-by: Mike Kravetz Acked-by: David Hildenbrand Acked-by: James Houghton Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Muchun Song Cc: Nadav Amit Cc: [5.19+] Signed-off-by: Andrew Morton commit b30c14cd61025eeea2f2e8569606cd167ba9ad2d Author: James Houghton Date: Wed Jan 4 23:19:10 2023 +0000 hugetlb: unshare some PMDs when splitting VMAs PMD sharing can only be done in PUD_SIZE-aligned pieces of VMAs; however, it is possible that HugeTLB VMAs are split without unsharing the PMDs first. Without this fix, it is possible to hit the uffd-wp-related WARN_ON_ONCE in hugetlb_change_protection [1]. The key there is that hugetlb_unshare_all_pmds will not attempt to unshare PMDs in non-PUD_SIZE-aligned sections of the VMA. It might seem ideal to unshare in hugetlb_vm_op_open, but we need to unshare in both the new and old VMAs, so unsharing in hugetlb_vm_op_split seems natural. [1]: https://lore.kernel.org/linux-mm/CADrL8HVeOkj0QH5VZZbRzybNE8CG-tEGFshnA+bG9nMgcWtBSg@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230104231910.1464197-1-jthoughton@google.com Fixes: 6dfeaff93be1 ("hugetlb/userfaultfd: unshare all pmds for hugetlbfs when register wp") Signed-off-by: James Houghton Reviewed-by: Mike Kravetz Acked-by: Peter Xu Cc: Axel Rasmussen Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit a1193de562f54c7c9f60ca9f2db96e50a7608de1 Author: Suren Baghdasaryan Date: Wed Jan 4 16:02:40 2023 -0800 mm: fix vma->anon_name memory leak for anonymous shmem VMAs free_anon_vma_name() is missing a check for anonymous shmem VMA which leads to a memory leak due to refcount not being dropped. Fix this by calling anon_vma_name_put() unconditionally. It will free vma->anon_name whenever it's non-NULL. Link: https://lkml.kernel.org/r/20230105000241.1450843-1-surenb@google.com Fixes: d09e8ca6cb93 ("mm: anonymous shared memory naming") Signed-off-by: Suren Baghdasaryan Suggested-by: David Hildenbrand Reviewed-by: David Hildenbrand Reported-by: syzbot+91edf9178386a07d06a7@syzkaller.appspotmail.com Cc: Hugh Dickins Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 3de0c269adc6c2fac0bb1fb11965f0de699dc32b Author: Zach O'Keefe Date: Sat Dec 24 00:20:35 2022 -0800 mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE SHMEM_HUGE_DENY is for emergency use by the admin, to disable allocation of shmem huge pages if, for example, a dangerous bug is found in their usage: see "deny" in Documentation/mm/transhuge.rst. An app using madvise(,,MADV_COLLAPSE) should not be allowed to override it: restore its precedence over shmem_huge_force. Restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE. Link: https://lkml.kernel.org/r/20221224082035.3197140-2-zokeefe@google.com Fixes: 7c6c6cc4d3a2 ("mm/shmem: add flag to enforce shmem THP in hugepage_vma_check()") Signed-off-by: Zach O'Keefe Suggested-by: Hugh Dickins Acked-by: David Hildenbrand Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit 52dc031088f00e323140ece4004e70c33153c6dd Author: Zach O'Keefe Date: Sat Dec 24 00:20:34 2022 -0800 mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end MADV_COLLAPSE acts on one hugepage-aligned/sized region at a time, until it has collapsed all eligible memory contained within the bounds supplied by the user. At the top of each hugepage iteration we (re)lock mmap_lock and (re)validate the VMA for eligibility and update variables that might have changed while mmap_lock was dropped. One thing that might occur is that the VMA could be resized, and as such, we refetch vma->vm_end to make sure we don't collapse past the end of the VMA's new end. However, it's possible that when refetching vma->vm_end that we expand the region acted on by MADV_COLLAPSE if vma->vm_end is greater than size+len supplied by the user. The consequence here is that we may attempt to collapse more memory than requested, possibly yielding either "too much success" or "false failure" user-visible results. An example of the former is if we MADV_COLLAPSE the first 4MiB of a 2TiB mmap()'d file, the incorrect refetch would cause the operation to block for much longer than anticipated as we attempt to collapse the entire TiB region. An example of the latter is that applying MADV_COLLPSE to a 4MiB file mapped to the start of a 6MiB VMA will successfully collapse the first 4MiB, then incorrectly attempt to collapse the last hugepage-aligned/sized region -- fail (since readahead/page cache lookup will fail) -- and report a failure to the user. I don't believe there is a kernel stability concern here as we always (re)validate the VMA / region accordingly. Also as Hugh mentions, the user-visible effects are: we try to collapse more memory than requested by the user, and/or failing an operation that should have otherwise succeeded. An example is trying to collapse a 4MiB file contained within a 12MiB VMA. Don't expand the acted-on region when refetching vma->vm_end. Link: https://lkml.kernel.org/r/20221224082035.3197140-1-zokeefe@google.com Fixes: 4d24de9425f7 ("mm: MADV_COLLAPSE: refetch vm_end after reacquiring mmap_lock") Signed-off-by: Zach O'Keefe Reported-by: Hugh Dickins Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit 51d3d5eb74ff53b92dcff48b30ae2ed8edd85a32 Author: David Hildenbrand Date: Fri Dec 9 09:09:12 2022 +0100 mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA Currently, we don't enable writenotify when enabling userfaultfd-wp on a shared writable mapping (for now only shmem and hugetlb). The consequence is that vma->vm_page_prot will still include write permissions, to be set as default for all PTEs that get remapped (e.g., mprotect(), NUMA hinting, page migration, ...). So far, vma->vm_page_prot is assumed to be a safe default, meaning that we only add permissions (e.g., mkwrite) but not remove permissions (e.g., wrprotect). For example, when enabling softdirty tracking, we enable writenotify. With uffd-wp on shared mappings, that changed. More details on vma->vm_page_prot semantics were summarized in [1]. This is problematic for uffd-wp: we'd have to manually check for a uffd-wp PTEs/PMDs and manually write-protect PTEs/PMDs, which is error prone. Prone to such issues is any code that uses vma->vm_page_prot to set PTE permissions: primarily pte_modify() and mk_pte(). Instead, let's enable writenotify such that PTEs/PMDs/... will be mapped write-protected as default and we will only allow selected PTEs that are definitely safe to be mapped without write-protection (see can_change_pte_writable()) to be writable. In the future, we might want to enable write-bit recovery -- e.g., can_change_pte_writable() -- at more locations, for example, also when removing uffd-wp protection. This fixes two known cases: (a) remove_migration_pte() mapping uffd-wp'ed PTEs writable, resulting in uffd-wp not triggering on write access. (b) do_numa_page() / do_huge_pmd_numa_page() mapping uffd-wp'ed PTEs/PMDs writable, resulting in uffd-wp not triggering on write access. Note that do_numa_page() / do_huge_pmd_numa_page() can be reached even without NUMA hinting (which currently doesn't seem to be applicable to shmem), for example, by using uffd-wp with a PROT_WRITE shmem VMA. On such a VMA, userfaultfd-wp is currently non-functional. Note that when enabling userfaultfd-wp, there is no need to walk page tables to enforce the new default protection for the PTEs: we know that they cannot be uffd-wp'ed yet, because that can only happen after enabling uffd-wp for the VMA in general. Also note that this makes mprotect() on ranges with uffd-wp'ed PTEs not accidentally set the write bit -- which would result in uffd-wp not triggering on later write access. This commit makes uffd-wp on shmem behave just like uffd-wp on anonymous memory in that regard, even though, mixing mprotect with uffd-wp is controversial. [1] https://lkml.kernel.org/r/92173bad-caa3-6b43-9d1e-9a471fdbc184@redhat.com Link: https://lkml.kernel.org/r/20221209080912.7968-1-david@redhat.com Fixes: b1f9e876862d ("mm/uffd: enable write protection for shmem & hugetlbfs") Signed-off-by: David Hildenbrand Reported-by: Ives van Hoorne Debugged-by: Peter Xu Acked-by: Peter Xu Cc: Hugh Dickins Cc: Alistair Popple Cc: Mike Rapoport Cc: Nadav Amit Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton commit ab0c3f1251b4670978fde0bd54161795a139b060 Author: Hugh Dickins Date: Thu Dec 22 12:41:50 2022 -0800 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma uprobe_write_opcode() uses collapse_pte_mapped_thp() to restore huge pmd, when removing a breakpoint from hugepage text: vma->anon_vma is always set in that case, so undo the prohibition. And MADV_COLLAPSE ought to be able to collapse some page tables in a vma which happens to have anon_vma set from CoWing elsewhere. Is anon_vma lock required? Almost not: if any page other than expected subpage of the non-anon huge page is found in the page table, collapse is aborted without making any change. However, it is possible that an anon page was CoWed from this extent in another mm or vma, in which case a concurrent lookup might look here: so keep it away while clearing pmd (but perhaps we shall go back to using pmd_lock() there in future). Note that collapse_pte_mapped_thp() is exceptional in freeing a page table without having cleared its ptes: I'm uneasy about that, and had thought pte_clear()ing appropriate; but exclusive i_mmap lock does fix the problem, and we would have to move the mmu_notification if clearing those ptes. What this fixes is not a dangerous instability. But I suggest Cc stable because uprobes "healing" has regressed in that way, so this should follow 8d3c106e19e8 into those stable releases where it was backported (and may want adjustment there - I'll supply backports as needed). Link: https://lkml.kernel.org/r/b740c9fb-edba-92ba-59fb-7a5592e5dfc@google.com Fixes: 8d3c106e19e8 ("mm/khugepaged: take the right locks for page table retraction") Signed-off-by: Hugh Dickins Acked-by: David Hildenbrand Cc: Jann Horn Cc: Yang Shi Cc: Zach O'Keefe Cc: Song Liu Cc: [5.4+] Signed-off-by: Andrew Morton commit 44f86392bdd165da7e43d3c772aeb1e128ffd6c8 Author: David Hildenbrand Date: Thu Dec 22 21:55:11 2022 +0100 mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection() We have to update the uffd-wp SWP PTE bit independent of the type of migration entry. Currently, if we're unlucky and we want to install/clear the uffd-wp bit just while we're migrating a read-only mapped hugetlb page, we would miss to set/clear the uffd-wp bit. Further, if we're processing a readable-exclusive migration entry and neither want to set or clear the uffd-wp bit, we could currently end up losing the uffd-wp bit. Note that the same would hold for writable migrating entries, however, having a writable migration entry with the uffd-wp bit set would already mean that something went wrong. Note that the change from !is_readable_migration_entry -> writable_migration_entry is harmless and actually cleaner, as raised by Miaohe Lin and discussed in [1]. [1] https://lkml.kernel.org/r/90dd6a93-4500-e0de-2bf0-bf522c311b0c@huawei.com Link: https://lkml.kernel.org/r/20221222205511.675832-3-david@redhat.com Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes") Signed-off-by: David Hildenbrand Reviewed-by: Mike Kravetz Cc: Miaohe Lin Cc: Muchun Song Cc: Peter Xu Cc: Signed-off-by: Andrew Morton commit 0e678153f5be7e6c8d28835f5a678618da4b7a9c Author: David Hildenbrand Date: Thu Dec 22 21:55:10 2022 +0100 mm/hugetlb: fix PTE marker handling in hugetlb_change_protection() Patch series "mm/hugetlb: uffd-wp fixes for hugetlb_change_protection()". Playing with virtio-mem and background snapshots (using uffd-wp) on hugetlb in QEMU, I managed to trigger a VM_BUG_ON(). Looking into the details, hugetlb_change_protection() seems to not handle uffd-wp correctly in all cases. Patch #1 fixes my test case. I don't have reproducers for patch #2, as it requires running into migration entries. I did not yet check in detail yet if !hugetlb code requires similar care. This patch (of 2): There are two problematic cases when stumbling over a PTE marker in hugetlb_change_protection(): (1) We protect an uffd-wp PTE marker a second time using uffd-wp: we will end up in the "!huge_pte_none(pte)" case and mess up the PTE marker. (2) We unprotect a uffd-wp PTE marker: we will similarly end up in the "!huge_pte_none(pte)" case even though we cleared the PTE, because the "pte" variable is stale. We'll mess up the PTE marker. For example, if we later stumble over such a "wrongly modified" PTE marker, we'll treat it like a present PTE that maps some garbage page. This can, for example, be triggered by mapping a memfd backed by huge pages, registering uffd-wp, uffd-wp'ing an unmapped page and (a) uffd-wp'ing it a second time; or (b) uffd-unprotecting it; or (c) unregistering uffd-wp. Then, ff we trigger fallocate(FALLOC_FL_PUNCH_HOLE) on that file range, we will run into a VM_BUG_ON: [ 195.039560] page:00000000ba1f2987 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 [ 195.039565] flags: 0x7ffffc0001000(reserved|node=0|zone=0|lastcpupid=0x1fffff) [ 195.039568] raw: 0007ffffc0001000 ffffe742c0000008 ffffe742c0000008 0000000000000000 [ 195.039569] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 195.039569] page dumped because: VM_BUG_ON_PAGE(compound && !PageHead(page)) [ 195.039573] ------------[ cut here ]------------ [ 195.039574] kernel BUG at mm/rmap.c:1346! [ 195.039579] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 195.039581] CPU: 7 PID: 4777 Comm: qemu-system-x86 Not tainted 6.0.12-200.fc36.x86_64 #1 [ 195.039583] Hardware name: LENOVO 20WNS1F81N/20WNS1F81N, BIOS N35ET50W (1.50 ) 09/15/2022 [ 195.039584] RIP: 0010:page_remove_rmap+0x45b/0x550 [ 195.039588] Code: [...] [ 195.039589] RSP: 0018:ffffbc03c3633ba8 EFLAGS: 00010292 [ 195.039591] RAX: 0000000000000040 RBX: ffffe742c0000000 RCX: 0000000000000000 [ 195.039592] RDX: 0000000000000002 RSI: ffffffff8e7aac1a RDI: 00000000ffffffff [ 195.039592] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffbc03c3633a08 [ 195.039593] R10: 0000000000000003 R11: ffffffff8f146328 R12: ffff9b04c42754b0 [ 195.039594] R13: ffffffff8fcc6328 R14: ffffbc03c3633c80 R15: ffff9b0484ab9100 [ 195.039595] FS: 00007fc7aaf68640(0000) GS:ffff9b0bbf7c0000(0000) knlGS:0000000000000000 [ 195.039596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.039597] CR2: 000055d402c49110 CR3: 0000000159392003 CR4: 0000000000772ee0 [ 195.039598] PKRU: 55555554 [ 195.039599] Call Trace: [ 195.039600] [ 195.039602] __unmap_hugepage_range+0x33b/0x7d0 [ 195.039605] unmap_hugepage_range+0x55/0x70 [ 195.039608] hugetlb_vmdelete_list+0x77/0xa0 [ 195.039611] hugetlbfs_fallocate+0x410/0x550 [ 195.039612] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 195.039616] vfs_fallocate+0x12e/0x360 [ 195.039618] __x64_sys_fallocate+0x40/0x70 [ 195.039620] do_syscall_64+0x58/0x80 [ 195.039623] ? syscall_exit_to_user_mode+0x17/0x40 [ 195.039624] ? do_syscall_64+0x67/0x80 [ 195.039626] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 195.039628] RIP: 0033:0x7fc7b590651f [ 195.039653] Code: [...] [ 195.039654] RSP: 002b:00007fc7aaf66e70 EFLAGS: 00000293 ORIG_RAX: 000000000000011d [ 195.039655] RAX: ffffffffffffffda RBX: 0000558ef4b7f370 RCX: 00007fc7b590651f [ 195.039656] RDX: 0000000018000000 RSI: 0000000000000003 RDI: 000000000000000c [ 195.039657] RBP: 0000000008000000 R08: 0000000000000000 R09: 0000000000000073 [ 195.039658] R10: 0000000008000000 R11: 0000000000000293 R12: 0000000018000000 [ 195.039658] R13: 00007fb8bbe00000 R14: 000000000000000c R15: 0000000000001000 [ 195.039661] Fix it by not going into the "!huge_pte_none(pte)" case if we stumble over an exclusive marker. spin_unlock() + continue would get the job done. However, instead, make it clearer that there are no fall-through statements: we process each case (hwpoison, migration, marker, !none, none) and then unlock the page table to continue with the next PTE. Let's avoid "continue" statements and use a single spin_unlock() at the end. Link: https://lkml.kernel.org/r/20221222205511.675832-1-david@redhat.com Link: https://lkml.kernel.org/r/20221222205511.675832-2-david@redhat.com Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes") Signed-off-by: David Hildenbrand Reviewed-by: Peter Xu Reviewed-by: Mike Kravetz Cc: Miaohe Lin Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit f12cd06109f47c2fb4b23a45ab55404c47ef7fae Author: Yang Yingliang Date: Wed Dec 28 17:36:03 2022 +0800 powerpc/64s/hash: Make stress_hpt_timer_fn() static stress_hpt_timer_fn() is only used in hash_utils.c, make it static. Fixes: 6b34a099faa1 ("powerpc/64s/hash: add stress_hpt kernel boot option to increase hash faults") Signed-off-by: Yang Yingliang Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221228093603.3166599-1-yangyingliang@huawei.com commit e8f60cd7db24f94f2dbed6bec30dd16a68fc0828 Merge: 7dd4b804e0804 cf129830ee820 Author: Linus Torvalds Date: Wed Jan 11 17:12:14 2023 -0600 Merge tag 'perf-tools-fixes-for-v6.2-2-2023-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Make 'perf kmem' cope with the removal of some kmem:kmem_cache_alloc_node and kmem:kmalloc_node in the 11e9734bcb6a7361 ("mm/slab_common: unify NUMA and UMA version of tracepoints") commit, making sure it works with Linux >= 6.2 as well as with older kernels where those tracepoints are present. - Also make it handle the new "node" kmem:kmalloc and kmem:kmem_cache_alloc tracepoint field introduced in that same commit. - Fix hardware tracing PMU address filter duplicate symbol selection, that was preventing to match with static functions with the same name present in different object files. - Fix regression on what linux/types.h file gets used to build the "BPF prologue" 'perf test' entry, the system one lacks the fmode_t definition used in this test, so provide that type in the test itself. - Avoid build breakage with libbpf < 0.8.0 + LIBBPF_DYNAMIC=1. If the user asks for linking with the libbpf package provided by the distro, then it has to be >= 0.8.0. Using the libbpf supplied with the kernel would be a fallback in that case. - Fix the build when libbpf isn't available or explicitly disabled via NO_LIBBPF=1. - Don't try to install libtraceevent plugins as its not anymore in the kernel sources and will thus always fail. * tag 'perf-tools-fixes-for-v6.2-2-2023-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf auxtrace: Fix address filter duplicate symbol selection perf bpf: Avoid build breakage with libbpf < 0.8.0 + LIBBPF_DYNAMIC=1 perf build: Fix build error when NO_LIBBPF=1 perf tools: Don't install libtraceevent plugins as its not anymore in the kernel sources perf kmem: Support field "node" in evsel__process_alloc_event() coping with recent tracepoint restructuring perf kmem: Support legacy tracepoints perf build: Properly guard libbpf includes perf tests bpf prologue: Fix bpf-script-test-prologue test compile issue with clang commit 310bc39546a435c83cc27a0eba878afac0d74714 Author: David Woodhouse Date: Wed Jan 11 18:06:51 2023 +0000 KVM: x86/xen: Avoid deadlock by adding kvm->arch.xen.xen_lock leaf node lock In commit 14243b387137a ("KVM: x86/xen: Add KVM_IRQ_ROUTING_XEN_EVTCHN and event channel delivery") the clever version of me left some helpful notes for those who would come after him: /* * For the irqfd workqueue, using the main kvm->lock mutex is * fine since this function is invoked from kvm_set_irq() with * no other lock held, no srcu. In future if it will be called * directly from a vCPU thread (e.g. on hypercall for an IPI) * then it may need to switch to using a leaf-node mutex for * serializing the shared_info mapping. */ mutex_lock(&kvm->lock); In commit 2fd6df2f2b47 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") the other version of me ran straight past that comment without reading it, and introduced a potential deadlock by taking vcpu->mutex and kvm->lock in the wrong order. Solve this as originally suggested, by adding a leaf-node lock in the Xen state rather than using kvm->lock for it. Fixes: 2fd6df2f2b47 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") Signed-off-by: David Woodhouse Message-Id: <20230111180651.14394-4-dwmw2@infradead.org> [Rebase, add docs. - Paolo] Signed-off-by: Paolo Bonzini commit a48fe6376919c182597b737984bb905a909727c2 Author: Bjorn Helgaas Date: Tue Jan 10 12:02:42 2023 -0600 x86/pci: Simplify is_mmconf_reserved() messages is_mmconf_reserved() takes a "with_e820" parameter that only determines the message logged if it finds the MMCONFIG region is reserved. Pass the message directly, which will simplify a future patch that adds a new way of looking for that reservation. No functional change intended. Link: https://lore.kernel.org/r/20230110180243.1590045-2-helgaas@kernel.org Tested-by: Tony Luck Tested-by: Giovanni Cabiddu Tested-by: Kan Liang Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams commit a33ae832bf3f2ac33e2e44b99f76130d3be848c5 Author: Akira Yokosawa Date: Tue Jan 10 18:47:25 2023 +0900 docs/conf.py: Use about.html only in sidebar of alabaster theme "about.html" is available only for the alabaster theme [1]. Unconditionally putting it to html_sidebars prevents us from using other themes which respect html_sidebars. Remove about.html from the initialization and insert it at the front for the alabaster theme. Link: [1] https://alabaster.readthedocs.io/en/latest/installation.html#sidebars Fixes: d5389d3145ef ("docs: Switch the default HTML theme to alabaster") Signed-off-by: Akira Yokosawa Cc: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/4b162dbe-2a7f-1710-93e0-754cf8680aae@gmail.com Signed-off-by: Jonathan Corbet commit 1ecf7bd9c267ab85aff3c4a17fe56bc9754a13be Author: Heiko Carstens Date: Wed Jan 11 15:04:47 2023 +0100 s390: update defconfigs Signed-off-by: Heiko Carstens commit 85e79ec7b78f863178ca488fd8cb5b3de6347756 Author: Naohiro Aota Date: Tue Jan 10 15:04:32 2023 +0900 btrfs: zoned: enable metadata over-commit for non-ZNS setup The commit 79417d040f4f ("btrfs: zoned: disable metadata overcommit for zoned") disabled the metadata over-commit to track active zones properly. However, it also introduced a heavy overhead by allocating new metadata block groups and/or flushing dirty buffers to release the space reservations. Specifically, a workload (write only without any sync operations) worsen its performance from 343.77 MB/sec (v5.19) to 182.89 MB/sec (v6.0). The performance is still bad on current misc-next which is 187.95 MB/sec. And, with this patch applied, it improves back to 326.70 MB/sec (+73.82%). This patch introduces a new fs_info->flag BTRFS_FS_NO_OVERCOMMIT to indicate it needs to disable the metadata over-commit. The flag is enabled when a device with max active zones limit is loaded into a file-system. Fixes: 79417d040f4f ("btrfs: zoned: disable metadata overcommit for zoned") CC: stable@vger.kernel.org # 6.0+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 75181406b4eafacc531ff2ee5fb032bd93317e2b Author: Qu Wenruo Date: Tue Jan 10 15:14:17 2023 +0800 btrfs: qgroup: do not warn on record without old_roots populated [BUG] There are some reports from the mailing list that since v6.1 kernel, the WARN_ON() inside btrfs_qgroup_account_extent() gets triggered during rescan: WARNING: CPU: 3 PID: 6424 at fs/btrfs/qgroup.c:2756 btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] CPU: 3 PID: 6424 Comm: snapperd Tainted: P OE 6.1.2-1-default #1 openSUSE Tumbleweed 05c7a1b1b61d5627475528f71f50444637b5aad7 RIP: 0010:btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] Call Trace: btrfs_commit_transaction+0x30c/0xb40 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? start_transaction+0xc3/0x5b0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_qgroup_rescan+0x42/0xc0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_ioctl+0x1ab9/0x25c0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? __rseq_handle_notify_resume+0xa9/0x4a0 ? mntput_no_expire+0x4a/0x240 ? __seccomp_filter+0x319/0x4d0 __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x5b/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd9b790d9bf [CAUSE] Since commit e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), if our qgroup is already in inconsistent state, we will no longer do the time-consuming backref walk. This can leave some qgroup records without a valid old_roots ulist. Normally this is fine, as btrfs_qgroup_account_extents() would also skip those records if we have NO_ACCOUNTING flag set. But there is a small window, if we have NO_ACCOUNTING flag set, and inserted some qgroup_record without a old_roots ulist, but then the user triggered a qgroup rescan. During btrfs_qgroup_rescan(), we firstly clear NO_ACCOUNTING flag, then commit current transaction. And since we have a qgroup_record with old_roots = NULL, we trigger the WARN_ON() during btrfs_qgroup_account_extents(). [FIX] Unfortunately due to the introduction of NO_ACCOUNTING flag, the assumption that every qgroup_record would have its old_roots populated is no longer correct. Fix the false alerts and drop the WARN_ON(). Reported-by: Lukas Straub Reported-by: HanatoK Fixes: e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting") CC: stable@vger.kernel.org # 6.1 Link: https://lore.kernel.org/linux-btrfs/2403c697-ddaf-58ad-3829-0335fc89df09@gmail.com/ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit ed02363fbbed52a3f5ea0d188edd09045a806eb5 Author: Qu Wenruo Date: Mon Dec 12 10:19:37 2022 +0800 btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list() [BUG] When test case btrfs/219 (aka, mount a registered device but with a lower generation) failed, there is not any useful information for the end user to find out what's going wrong. The mount failure just looks like this: # mount -o loop /tmp/219.img2 /mnt/btrfs/ mount: /mnt/btrfs: mount(2) system call failed: File exists. dmesg(1) may have more information after failed mount system call. While the dmesg contains nothing but the loop device change: loop1: detected capacity change from 0 to 524288 [CAUSE] In device_list_add() we have a lot of extra checks to reject invalid cases. That function also contains the regular device scan result like the following prompt: BTRFS: device fsid 6222333e-f9f1-47e6-b306-55ddd4dcaef4 devid 1 transid 8 /dev/loop0 scanned by systemd-udevd (3027) But unfortunately not all errors have their own error messages, thus if we hit something wrong in device_add_list(), there may be no error messages at all. [FIX] Add errors message for all non-ENOMEM errors. For ENOMEM, I'd say we're in a much worse situation, and there should be some OOM messages way before our call sites. CC: stable@vger.kernel.org # 6.0+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 42a90008f890afc41837dfeec1f0b1e7bcecf94a Author: David Woodhouse Date: Wed Jan 11 18:06:50 2023 +0000 KVM: Ensure lockdep knows about kvm->lock vs. vcpu->mutex ordering rule Documentation/virt/kvm/locking.rst tells us that kvm->lock is taken outside vcpu->mutex. But that doesn't actually happen very often; it's only in some esoteric cases like migration with AMD SEV. This means that lockdep usually doesn't notice, and doesn't do its job of keeping us honest. Ensure that lockdep *always* knows about the ordering of these two locks, by briefly taking vcpu->mutex in kvm_vm_ioctl_create_vcpu() while kvm->lock is held. Signed-off-by: David Woodhouse Message-Id: <20230111180651.14394-3-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit bbe17c625d6843e9cdf14d81fbece1b0f0c3fb2f Author: David Woodhouse Date: Wed Jan 11 18:06:49 2023 +0000 KVM: x86/xen: Fix potential deadlock in kvm_xen_update_runstate_guest() The kvm_xen_update_runstate_guest() function can be called when the vCPU is being scheduled out, from a preempt notifier. It *opportunistically* updates the runstate area in the guest memory, if the gfn_to_pfn_cache which caches the appropriate address is still valid. If there is *contention* when it attempts to obtain gpc->lock, then locking inside the priority inheritance checks may cause a deadlock. Lockdep reports: [13890.148997] Chain exists of: &gpc->lock --> &p->pi_lock --> &rq->__lock [13890.149002] Possible unsafe locking scenario: [13890.149003] CPU0 CPU1 [13890.149004] ---- ---- [13890.149005] lock(&rq->__lock); [13890.149007] lock(&p->pi_lock); [13890.149009] lock(&rq->__lock); [13890.149011] lock(&gpc->lock); [13890.149013] *** DEADLOCK *** In the general case, if there's contention for a read lock on gpc->lock, that's going to be because something else is either invalidating or revalidating the cache. Either way, we've raced with seeing it in an invalid state, in which case we would have aborted the opportunistic update anyway. So in the 'atomic' case when called from the preempt notifier, just switch to using read_trylock() and avoid the PI handling altogether. Signed-off-by: David Woodhouse Message-Id: <20230111180651.14394-2-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 23e60258aeafb04e5dd813f03cb0c8ab7b01462a Author: David Woodhouse Date: Wed Jan 11 18:06:48 2023 +0000 KVM: x86/xen: Fix lockdep warning on "recursive" gpc locking In commit 5ec3289b31 ("KVM: x86/xen: Compatibility fixes for shared runstate area") we declared it safe to obtain two gfn_to_pfn_cache locks at the same time: /* * The guest's runstate_info is split across two pages and we * need to hold and validate both GPCs simultaneously. We can * declare a lock ordering GPC1 > GPC2 because nothing else * takes them more than one at a time. */ However, we forgot to tell lockdep. Do so, by setting a subclass on the first lock before taking the second. Fixes: 5ec3289b31 ("KVM: x86/xen: Compatibility fixes for shared runstate area") Suggested-by: Peter Zijlstra Signed-off-by: David Woodhouse Message-Id: <20230111180651.14394-1-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 71d0393576e9e1ef536c3bc3cf11f661c58dded9 Merge: 3a9ae31ac26a5 de535c0234dd2 Author: Paolo Bonzini Date: Wed Jan 11 13:31:53 2023 -0500 Merge tag 'kvmarm-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/arm64 fixes for 6.2, take #1 - Fix the PMCR_EL0 reset value after the PMU rework - Correctly handle S2 fault triggered by a S1 page table walk by not always classifying it as a write, as this breaks on R/O memslots - Document why we cannot exit with KVM_EXIT_MMIO when taking a write fault from a S1 PTW on a R/O memslot - Put the Apple M2 on the naughty step for not being able to correctly implement the vgic SEIS feature, just liek the M1 before it - Reviewer updates: Alex is stepping down, replaced by Zenghui commit 3a9ae31ac26a58d33008c42f6cd022afc2af2dc0 Author: Paolo Bonzini Date: Mon Jan 9 06:02:16 2023 -0500 Documentation: kvm: fix SRCU locking order docs kvm->srcu is taken in KVM_RUN and several other vCPU ioctls, therefore vcpu->mutex is susceptible to the same deadlock that is documented for kvm->slots_lock. The same holds for kvm->lock, since kvm->lock is held outside vcpu->mutex. Fix the documentation and rearrange it to highlight the difference between these locks and kvm->slots_arch_lock, and how kvm->slots_arch_lock can be useful while processing a vmexit. Signed-off-by: Paolo Bonzini commit 696e1a48b1a1b01edad542a1ef293665864a4dd0 Author: Pablo Neira Ayuso Date: Wed Jan 11 17:07:33 2023 +0100 netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the boundaries of the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet + vlan header are copied directly from the skbuff data area. Fix incorrect arithmetic operator: subtract, not add, the size of the vlan header in case of double-tagged packets to adjust the length accordingly to address CVE-2023-0179. Reported-by: Davide Ornaghi Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support") Signed-off-by: Pablo Neira Ayuso commit 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 Author: Gavrilov Ilia Date: Wed Jan 11 11:57:39 2023 +0000 netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters") Signed-off-by: Ilia.Gavrilov Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit c273289fac370b6488757236cd62cc2cf04830b7 Author: Florian Westphal Date: Wed Jan 4 12:54:42 2023 +0100 selftests: netfilter: fix transaction test script timeout handling The kselftest framework uses a default timeout of 45 seconds for all test scripts. Increase the timeout to two minutes for the netfilter tests, this should hopefully be enough, Make sure that, should the script be canceled, the net namespace and the spawned ping instances are removed. Fixes: 25d8bcedbf43 ("selftests: add script to stress-test nft packet path vs. control plane") Reported-by: Mirsad Goran Todorovac Signed-off-by: Florian Westphal Tested-by: Mirsad Goran Todorovac Signed-off-by: Pablo Neira Ayuso commit cf129830ee820f7fc90b98df193cd49d49344d09 Author: Adrian Hunter Date: Tue Jan 10 20:56:59 2023 +0200 perf auxtrace: Fix address filter duplicate symbol selection When a match has been made to the nth duplicate symbol, return success not error. Example: Before: $ cat file.c cat: file.c: No such file or directory $ cat file1.c #include static void func(void) { printf("First func\n"); } void other(void); int main() { func(); other(); return 0; } $ cat file2.c #include static void func(void) { printf("Second func\n"); } void other(void) { func(); } $ gcc -Wall -Wextra -o test file1.c file2.c $ perf record -e intel_pt//u --filter 'filter func @ ./test' -- ./test Multiple symbols with name 'func' #1 0x1149 l func which is near main #2 0x1179 l func which is near other Disambiguate symbol name by inserting #n after the name e.g. func #2 Or select a global symbol by inserting #0 or #g or #G Failed to parse address filter: 'filter func @ ./test' Filter format is: filter|start|stop|tracestop [/ ] [@] Where multiple filters are separated by space or comma. $ perf record -e intel_pt//u --filter 'filter func #2 @ ./test' -- ./test Failed to parse address filter: 'filter func #2 @ ./test' Filter format is: filter|start|stop|tracestop [/ ] [@] Where multiple filters are separated by space or comma. After: $ perf record -e intel_pt//u --filter 'filter func #2 @ ./test' -- ./test First func Second func [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.016 MB perf.data ] $ perf script --itrace=b -Ftime,flags,ip,sym,addr --ns 1231062.526977619: tr strt 0 [unknown] => 558495708179 func 1231062.526977619: tr end call 558495708188 func => 558495708050 _init 1231062.526979286: tr strt 0 [unknown] => 55849570818d func 1231062.526979286: tr end return 55849570818f func => 55849570819d other Fixes: 1b36c03e356936d6 ("perf record: Add support for using symbols in address filters") Reported-by: Dmitrii Dolgov <9erthalion6@gmail.com> Signed-off-by: Adrian Hunter Tested-by: Dmitry Dolgov <9erthalion6@gmail.com> Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230110185659.15979-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a66f1efcf748febea7758c4c3c8b5bc5294949ef Author: Rob Clark Date: Tue Jan 10 13:28:59 2023 -0800 drm/msm/gpu: Fix potential double-free If userspace was calling the MSM_SET_PARAM ioctl on multiple threads to set the COMM or CMDLINE param, it could trigger a race causing the previous value to be kfree'd multiple times. Fix this by serializing on the gpu lock. Signed-off-by: Rob Clark Fixes: d4726d770068 ("drm/msm: Add a way to override processes comm/cmdline") Patchwork: https://patchwork.freedesktop.org/patch/517778/ Link: https://lore.kernel.org/r/20230110212903.1925878-1-robdclark@gmail.com commit e752e5454e6417da3f40ec1306a041ea96c56423 Author: Joel Fernandes (Google) Date: Mon Jan 9 22:25:47 2023 +0000 adreno: Shutdown the GPU properly During kexec on ARM device, we notice that device_shutdown() only calls pm_runtime_force_suspend() while shutting down the GPU. This means the GPU kthread is still running and further, there maybe active submits. This causes all kinds of issues during a kexec reboot: Warning from shutdown path: [ 292.509662] WARNING: CPU: 0 PID: 6304 at [...] adreno_runtime_suspend+0x3c/0x44 [ 292.509863] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 292.509872] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 292.509881] pc : adreno_runtime_suspend+0x3c/0x44 [ 292.509891] lr : pm_generic_runtime_suspend+0x30/0x44 [ 292.509905] sp : ffffffc014473bf0 [...] [ 292.510043] Call trace: [ 292.510051] adreno_runtime_suspend+0x3c/0x44 [ 292.510061] pm_generic_runtime_suspend+0x30/0x44 [ 292.510071] pm_runtime_force_suspend+0x54/0xc8 [ 292.510081] adreno_shutdown+0x1c/0x28 [ 292.510090] platform_shutdown+0x2c/0x38 [ 292.510104] device_shutdown+0x158/0x210 [ 292.510119] kernel_restart_prepare+0x40/0x4c And here from GPU kthread, an SError OOPs: [ 192.648789] el1h_64_error+0x7c/0x80 [ 192.648812] el1_interrupt+0x20/0x58 [ 192.648833] el1h_64_irq_handler+0x18/0x24 [ 192.648854] el1h_64_irq+0x7c/0x80 [ 192.648873] local_daif_inherit+0x10/0x18 [ 192.648900] el1h_64_sync_handler+0x48/0xb4 [ 192.648921] el1h_64_sync+0x7c/0x80 [ 192.648941] a6xx_gmu_set_oob+0xbc/0x1fc [ 192.648968] a6xx_hw_init+0x44/0xe38 [ 192.648991] msm_gpu_hw_init+0x48/0x80 [ 192.649013] msm_gpu_submit+0x5c/0x1a8 [ 192.649034] msm_job_run+0xb0/0x11c [ 192.649058] drm_sched_main+0x170/0x434 [ 192.649086] kthread+0x134/0x300 [ 192.649114] ret_from_fork+0x10/0x20 Fix by calling adreno_system_suspend() in the device_shutdown() path. [ Applied Rob Clark feedback on fixing adreno_unbind() similarly, also tested as above. ] Cc: Rob Clark Cc: Steven Rostedt Cc: Ricardo Ribalda Cc: Ross Zwisler Signed-off-by: Joel Fernandes (Google) Reviewed-by: Ricardo Ribalda Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/517633/ Link: https://lore.kernel.org/r/20230109222547.1368644-1-joel@joelfernandes.org Signed-off-by: Rob Clark commit 3cb0f23039e0e3395a96e0f52bd69910ced2f720 Author: Masahiro Yamada Date: Fri Jan 6 17:18:21 2023 +0100 ARM: 9284/1: include from proc-macros.S to fix -Wundef warnings Since commit 80b6093b55e3 ("kbuild: add -Wundef to KBUILD_CPPFLAGS for W=1 builds"), building with W=1 detects -Wundef warnings for assembly code. $ make W=1 ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- arch/arm/mm/ [snip] AS arch/arm/mm/cache-v7.o In file included from arch/arm/mm/cache-v7.S:17: arch/arm/mm/proc-macros.S:109:5: warning: "L_PTE_SHARED" is not defined, evaluates to 0 [-Wundef] 109 | #if L_PTE_SHARED != PTE_EXT_SHARED | ^~~~~~~~~~~~ arch/arm/mm/proc-macros.S:109:21: warning: "PTE_EXT_SHARED" is not defined, evaluates to 0 [-Wundef] 109 | #if L_PTE_SHARED != PTE_EXT_SHARED | ^~~~~~~~~~~~~~ arch/arm/mm/proc-macros.S:113:10: warning: "L_PTE_XN" is not defined, evaluates to 0 [-Wundef] 113 | (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\ | ^~~~~~~~ arch/arm/mm/proc-macros.S:113:19: warning: "L_PTE_USER" is not defined, evaluates to 0 [-Wundef] 113 | (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\ | ^~~~~~~~~~ arch/arm/mm/proc-macros.S:113:30: warning: "L_PTE_RDONLY" is not defined, evaluates to 0 [-Wundef] 113 | (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\ | ^~~~~~~~~~~~ arch/arm/mm/proc-macros.S:113:43: warning: "L_PTE_DIRTY" is not defined, evaluates to 0 [-Wundef] 113 | (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\ | ^~~~~~~~~~~ arch/arm/mm/proc-macros.S:113:55: warning: "L_PTE_YOUNG" is not defined, evaluates to 0 [-Wundef] 113 | (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\ | ^~~~~~~~~~~ arch/arm/mm/proc-macros.S:114:10: warning: "L_PTE_PRESENT" is not defined, evaluates to 0 [-Wundef] 114 | L_PTE_PRESENT) > L_PTE_SHARED | ^~~~~~~~~~~~~ arch/arm/mm/proc-macros.S:114:27: warning: "L_PTE_SHARED" is not defined, evaluates to 0 [-Wundef] 114 | L_PTE_PRESENT) > L_PTE_SHARED | ^~~~~~~~~~~~ Include from proc-macros.S to fix the warnings. Signed-off-by: Masahiro Yamada Signed-off-by: Russell King (Oracle) commit a4e03921c1bb118e6718e0a3b0322a2c13ed172b Author: Giulio Benetti Date: Tue Dec 13 20:24:03 2022 +0100 ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment zero_page is a void* pointer but memblock_alloc() returns phys_addr_t type so this generates a warning while using clang and with -Wint-error enabled that becomes and error. So let's cast the return of memblock_alloc() to (void *). Cc: # 4.14.x + Fixes: 340a982825f7 ("ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation") Signed-off-by: Giulio Benetti Signed-off-by: Russell King (Oracle) commit 7fd26a27680aa9032920f798a5a8b38a2c61075f Author: Syed Saba Kareem Date: Wed Jan 11 15:51:23 2023 +0530 ASoC: amd: yc: Add DMI support for new acer/emdoor platforms Adding DMI entries to support new acer/emdoor platforms. Suggested-by: shanshengwang Signed-off-by: Syed Saba Kareem Link: https://lore.kernel.org/r/20230111102130.2276391-1-Syed.SabaKareem@amd.com Signed-off-by: Mark Brown commit 58fc14e14d288d728bf48377b81bb77fd17bfe3f Author: Gustavo Sousa Date: Thu Jan 5 10:37:01 2023 -0300 drm/i915/gt: Cover rest of SVG unit MCR registers CHICKEN_RASTER_{1,2} got overlooked with the move done in commit a9e69428b1b4 ("drm/i915: Define MCR registers explicitly"). Registers from the SVG unit became multicast as of Xe_HP graphics. BSpec: 66534 Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") Signed-off-by: Gustavo Sousa Cc: Matt Roper Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230105133701.19556-1-gustavo.sousa@intel.com (cherry picked from commit 10903b0a0f4d4964b352fa3df12d3d2ef5fb7a3b) Signed-off-by: Rodrigo Vivi commit 42400d99e9f0728c17240edb9645637ead40f6b9 Author: Heiko Carstens Date: Mon Jan 9 15:54:56 2023 +0100 KVM: s390: interrupt: use READ_ONCE() before cmpxchg() Use READ_ONCE() before cmpxchg() to prevent that the compiler generates code that fetches the to be compared old value several times from memory. Reviewed-by: Christian Borntraeger Acked-by: Christian Borntraeger Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20230109145456.2895385-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit e3f360db08d55a14112bd27454e616a24296a8b0 Author: Heiko Carstens Date: Mon Jan 9 11:51:20 2023 +0100 s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() Make sure that *ptr__ within arch_this_cpu_to_op_simple() is only dereferenced once by using READ_ONCE(). Otherwise the compiler could generate incorrect code. Cc: Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 82d3edb50a11bf3c5ef63294d5358ba230181413 Author: Heiko Carstens Date: Thu Jan 5 15:44:20 2023 +0100 s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops The current cmpxchg_double() loops within the perf hw sampling code do not have READ_ONCE() semantics to read the old value from memory. This allows the compiler to generate code which reads the "old" value several times from memory, which again allows for inconsistencies. For example: /* Reset trailer (using compare-double-and-swap) */ do { te_flags = te->flags & ~SDB_TE_BUFFER_FULL_MASK; te_flags |= SDB_TE_ALERT_REQ_MASK; } while (!cmpxchg_double(&te->flags, &te->overflow, te->flags, te->overflow, te_flags, 0ULL)); The compiler could generate code where te->flags used within the cmpxchg_double() call may be refetched from memory and which is not necessarily identical to the previous read version which was used to generate te_flags. Which in turn means that an incorrect update could happen. Fix this by adding READ_ONCE() semantics to all cmpxchg_double() loops. Given that READ_ONCE() cannot generate code on s390 which atomically reads 16 bytes, use a private compare-and-swap-double implementation to achieve that. Also replace cmpxchg_double() with the private implementation to be able to re-use the old value within the loops. As a side effect this converts the whole code to only use bit fields to read and modify bits within the hws trailer header. Reported-by: Alexander Gordeev Acked-by: Alexander Gordeev Acked-by: Hendrik Brueckner Reviewed-by: Thomas Richter Cc: Link: https://lore.kernel.org/linux-s390/Y71QJBhNTIatvxUT@osiris/T/#ma14e2a5f7aa8ed4b94b6f9576799b3ad9c60f333 Signed-off-by: Heiko Carstens commit b442990d244ba2ffe926c6603c42deb6fcc3b0db Merge: 6b35b173dbc17 e0fe6a31cac84 Author: Mark Brown Date: Wed Jan 11 14:15:22 2023 +0000 spi: Merge rename of spi-cs-setup-ns DT property The newly added spi-cs-setup-ns doesn't really fit with the existing property names for delays, rename it so that it does before it makes it into a release and becomes ABI. commit 6b35b173dbc1711f8d272e3f322d2ad697015919 Author: Bartosz Golaszewski Date: Fri Jan 6 11:07:19 2023 +0100 spi: spidev: remove debug messages that access spidev->spi without locking The two debug messages in spidev_open() dereference spidev->spi without taking the lock and without checking if it's not null. This can lead to a crash. Drop the messages as they're not needed - the user-space will get informed about ENOMEM with the syscall return value. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230106100719.196243-2-brgl@bgdev.pl Signed-off-by: Mark Brown commit a720416d94634068951773cb9e9d6f1b73769e5b Author: Bartosz Golaszewski Date: Fri Jan 6 11:07:18 2023 +0100 spi: spidev: fix a race condition when accessing spidev->spi There's a spinlock in place that is taken in file_operations callbacks whenever we check if spidev->spi is still alive (not null). It's also taken when spidev->spi is set to NULL in remove(). This however doesn't protect the code against driver unbind event while one of the syscalls is still in progress. To that end we need a lock taken continuously as long as we may still access spidev->spi. As both the file ops and the remove callback are never called from interrupt context, we can replace the spinlock with a mutex. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230106100719.196243-1-brgl@bgdev.pl Signed-off-by: Mark Brown commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef Merge: cb3e9864cdbe3 9828994ac492e Author: David S. Miller Date: Wed Jan 11 12:55:09 2023 +0000 Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-fixes-2023-01-09 commit cb3e9864cdbe35ff6378966660edbcbac955fe17 Author: Herbert Xu Date: Tue Jan 10 08:59:06 2023 +0800 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames The total cork length created by ip6_append_data includes extension headers, so we must exclude them when comparing them against the IPV6_CHECKSUM offset which does not include extension headers. Reported-by: Kyle Zeng Fixes: 357b40a18b04 ("[IPV6]: IPV6_CHECKSUM socket option can corrupt kernel memory") Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 169dd78043f7f4eabdef8d7ba0d4ddffe5cb3930 Author: Arend van Spriel Date: Wed Jan 11 11:11:56 2023 +0100 scripts: rpm: make clear that mkspec script contains 4.13 feature A fix was made in the mkspec script that uses a feature, ie. the OR expression, which requires RPM 4.13. However, the script indicates another minimum version. Lower versions may have success by using the --no-deps option as suggested, but feels like bumping the version to 4.13 is reasonable as it put me on the wrong track at first with RPM 4.11 on my Centos7 machine. Fixes: 02a893bc9975 ("kbuild: rpm-pkg: add libelf-devel as alternative for BuildRequires") Signed-off-by: Arend van Spriel Signed-off-by: Masahiro Yamada commit 0f9c608d4a1eb852d6769d2fc5906c71c02565ae Author: Rasmus Villemoes Date: Wed Jan 11 10:38:22 2023 +0100 init/Kconfig: fix LOCALVERSION_AUTO help text It was never guaranteed to be exactly eight, but since commit 548b8b5168c9 ("scripts/setlocalversion: make git describe output more reliable"), it has been exactly 12. Signed-off-by: Rasmus Villemoes Signed-off-by: Masahiro Yamada commit 6f515b663d49a14fb63f8c5d0a2a4ae53d44790a Author: Arnaud Ferraris Date: Thu Dec 15 11:19:47 2022 +0100 arm64: dts: rockchip: fix input enable pinconf on rk3399 When the input enable pinconf was introduced, a default drive-strength value of 2 was set for the pull up/down configs. However, this parameter is unneeded when configuring the pin as input, and having a single hardcoded value here is actually harmful: GPIOs on the RK3399 have various same drive-strength capabilities depending on the bank and port they belong to. As an example, trying to configure the GPIO4_PD3 pin as an input with pull-up enabled fails with the following output: [ 10.706542] rockchip-pinctrl pinctrl: unsupported driver strength 2 [ 10.713661] rockchip-pinctrl pinctrl: pin_config_set op failed for pin 155 (acceptable drive-strength values for this pin being 3, 6, 9 and 12) Let's drop the drive-strength property from all input pinconfs in order to solve this issue. Fixes: ec48c3e82ca3 ("arm64: dts: rockchip: add an input enable pinconf to rk3399") Signed-off-by: Arnaud Ferraris Reviewed-by: Caleb Connolly Link: https://lore.kernel.org/r/20221215101947.254896-1-arnaud.ferraris@collabora.com Signed-off-by: Heiko Stuebner commit 80422339a75088322b4d3884bd12fa0fe5d11050 Author: Johan Jonker Date: Wed Dec 28 21:17:32 2022 +0100 ARM: dts: rockchip: add power-domains property to dp node on rk3288 The clocks in the Rockchip rk3288 DisplayPort node are included in the power-domain@RK3288_PD_VIO logic, but the power-domains property in the dp node is missing, so fix it. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com Signed-off-by: Heiko Stuebner commit 9554f023385825be4b1e3557398c82e25be83da4 Author: Andy Yan Date: Thu Dec 29 19:50:43 2022 +0800 arm64: dts: rockchip: add io domain setting to rk3566-box-demo Add the missing pmu_io_domains setting, the gmac can't work well without this. Fixes: 2e0537b16b25 ("arm64: dts: rockchip: Add dts for rockchip rk3566 box demo board") Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20221229115043.3899733-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 4e2ec2500bfc5cf429ddcfe78b49cb76b36bc46d Author: Thomas Zimmermann Date: Tue Jan 10 13:35:26 2023 +0100 drm/nouveau: Remove file nouveau_fbcon.c Commit 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") converted nouveau to generic fbdev emulation. The driver's internal implementation later got accidentally restored during a merge commit. Remove the file from the driver. No functional changes. v2: * point Fixes tag to merge commit (Alex) Signed-off-by: Thomas Zimmermann Reviewed-by: Alex Deucher Fixes: 4e291f2f5853 ("Merge tag 'drm-misc-next-2022-11-10-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-next") Cc: Ben Skeggs Cc: Karol Herbst Cc: Lyude Paul Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Sam Ravnborg Cc: Jani Nikula Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20230110123526.28770-1-tzimmermann@suse.de commit b0e380b5d4275299adf43e249f18309331b6f54f Author: Clément Léger Date: Mon Jan 9 16:32:23 2023 +0100 net: lan966x: check for ptp to be enabled in lan966x_ptp_deinit() If ptp was not enabled due to missing IRQ for instance, lan966x_ptp_deinit() will dereference NULL pointers. Fixes: d096459494a8 ("net: lan966x: Add support for ptp clocks") Signed-off-by: Clément Léger Reviewed-by: Horatiu Vultur Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 7124c93887cc4e6c5b48920f83115e4a5892e870 Author: Randy Dunlap Date: Mon Jan 9 22:25:29 2023 -0800 phy: ti: fix Kconfig warning and operator precedence Fix Kconfig depends operator precedence to prevent a Kconfig warning: WARNING: unmet direct dependencies detected for MUX_MMIO Depends on [n]: MULTIPLEXER [=m] && OF [=n] Selected by [m]: - PHY_AM654_SERDES [=m] && (OF [=n] && ARCH_K3 || COMPILE_TEST [=y]) && COMMON_CLK [=y] Fixes: 71e2f5c5c224 ("phy: ti: Add a new SERDES driver for TI's AM654x SoC") Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC") Signed-off-by: Randy Dunlap Cc: Vinod Koul Cc: Kishon Vijay Abraham I Cc: linux-phy@lists.infradead.org Cc: Arnd Bergmann Link: https://lore.kernel.org/r/20230110062529.22668-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit 76d588dddc459fefa1da96e0a081a397c5c8e216 Author: Kajol Jain Date: Fri Jan 6 12:21:57 2023 +0530 powerpc/imc-pmu: Fix use of mutex in IRQs disabled section Current imc-pmu code triggers a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_PROVE_LOCKING enabled, while running a thread_imc event. Command to trigger the warning: # perf stat -e thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/ sleep 5 Performance counter stats for 'sleep 5': 0 thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/ 5.002117947 seconds time elapsed 0.000131000 seconds user 0.001063000 seconds sys Below is snippet of the warning in dmesg: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2869, name: perf-exec preempt_count: 2, expected: 0 4 locks held by perf-exec/2869: #0: c00000004325c540 (&sig->cred_guard_mutex){+.+.}-{3:3}, at: bprm_execve+0x64/0xa90 #1: c00000004325c5d8 (&sig->exec_update_lock){++++}-{3:3}, at: begin_new_exec+0x460/0xef0 #2: c0000003fa99d4e0 (&cpuctx_lock){-...}-{2:2}, at: perf_event_exec+0x290/0x510 #3: c000000017ab8418 (&ctx->lock){....}-{2:2}, at: perf_event_exec+0x29c/0x510 irq event stamp: 4806 hardirqs last enabled at (4805): [] _raw_spin_unlock_irqrestore+0x94/0xd0 hardirqs last disabled at (4806): [] perf_event_exec+0x394/0x510 softirqs last enabled at (0): [] copy_process+0xc34/0x1ff0 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 36 PID: 2869 Comm: perf-exec Not tainted 6.2.0-rc2-00011-g1247637727f2 #61 Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV Call Trace: dump_stack_lvl+0x98/0xe0 (unreliable) __might_resched+0x2f8/0x310 __mutex_lock+0x6c/0x13f0 thread_imc_event_add+0xf4/0x1b0 event_sched_in+0xe0/0x210 merge_sched_in+0x1f0/0x600 visit_groups_merge.isra.92.constprop.166+0x2bc/0x6c0 ctx_flexible_sched_in+0xcc/0x140 ctx_sched_in+0x20c/0x2a0 ctx_resched+0x104/0x1c0 perf_event_exec+0x340/0x510 begin_new_exec+0x730/0xef0 load_elf_binary+0x3f8/0x1e10 ... do not call blocking ops when !TASK_RUNNING; state=2001 set at [<00000000fd63e7cf>] do_nanosleep+0x60/0x1a0 WARNING: CPU: 36 PID: 2869 at kernel/sched/core.c:9912 __might_sleep+0x9c/0xb0 CPU: 36 PID: 2869 Comm: sleep Tainted: G W 6.2.0-rc2-00011-g1247637727f2 #61 Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV NIP: c000000000194a1c LR: c000000000194a18 CTR: c000000000a78670 REGS: c00000004d2134e0 TRAP: 0700 Tainted: G W (6.2.0-rc2-00011-g1247637727f2) MSR: 9000000000021033 CR: 48002824 XER: 00000000 CFAR: c00000000013fb64 IRQMASK: 1 The above warning triggered because the current imc-pmu code uses mutex lock in interrupt disabled sections. The function mutex_lock() internally calls __might_resched(), which will check if IRQs are disabled and in case IRQs are disabled, it will trigger the warning. Fix the issue by changing the mutex lock to spinlock. Fixes: 8f95faaac56c ("powerpc/powernv: Detect and create IMC device") Reported-by: Michael Petlan Reported-by: Peter Zijlstra Signed-off-by: Kajol Jain [mpe: Fix comments, trim oops in change log, add reported-by tags] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230106065157.182648-1-kjain@linux.ibm.com commit 3287ebd7fd01e853ca4da8be675322429400e2bd Author: Ojaswin Mujoo Date: Thu Jan 5 01:54:37 2023 +0530 powerpc/boot: Fix incorrect version calculation issue in ld_version The ld_version() function computes the wrong version value for certain ld versions such as the following: $ ld --version GNU ld (GNU Binutils; SUSE Linux Enterprise 15) 2.37.20211103-150100.7.37 For input 2.37.20211103, the value computed is 202348030000 which is higher than the value for a later version like 2.39.0, which is 23900000. This issue was highlighted because with the above ld version, the powerpc kernel build started failing with ld error: "unrecognized option --no-warn-rwx-segments". This was caused due to the recent commit 579aee9fc594 ("powerpc: suppress some linker warnings in recent linker versions") which added the --no-warn-rwx-segments linker flag if the ld version is greater than 2.39. Due to the bug in ld_version(), ld version 2.37.20111103 is wrongly calculated to be greater than 2.39 and the unsupported flag is added. To fix it, if version is of the form x.y.z and length(z) == 8, then most probably it is a date [yyyymmdd] commonly used for release snapshots and not an actual new version. Hence, ignore the date part replacing it with 0. Fixes: 579aee9fc594 ("powerpc: suppress some linker warnings in recent linker versions") Signed-off-by: Ojaswin Mujoo [mpe: Tweak change log wording/formatting, add Fixes tag] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230104202437.90039-1-ojaswin@linux.ibm.com commit 2fe58d977ee05da5bb89ef5dc4f5bf2dc15db46f Author: Paulo Alcantara Date: Tue Jan 10 20:35:46 2023 -0300 cifs: fix potential memory leaks in session setup Make sure to free cifs_ses::auth_key.response before allocating it as we might end up leaking memory in reconnect or mounting. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 22aeb01db7080e18c6aeb4361cc2556c9887099a Author: Paulo Alcantara Date: Tue Jan 10 19:23:21 2023 -0300 cifs: do not query ifaces on smb1 mounts Users have reported the following error on every 600 seconds (SMB_INTERFACE_POLL_INTERVAL) when mounting SMB1 shares: CIFS: VFS: \\srv\share error -5 on ioctl to get interface list It's supported only by SMB2+, so do not query network interfaces on SMB1 mounts. Fixes: 6e1c1c08cdf3 ("cifs: periodically query network interfaces from server") Reviewed-by: Shyam Prasad N Reviewed-by: Tom Talpey Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9c445d2637c938a800fcc8b5f0b10e60c94460c7 Author: Werner Sembach Date: Tue Jan 10 14:45:24 2023 +0100 Input: i8042 - add Clevo PCX0DX to i8042 quirk table The Clevo PCX0DX/TUXEDO XP1511, need quirks for the keyboard to not be occasionally unresponsive after resume. Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20230110134524.553620-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov commit 0aa7d35f5d00f83db2d512bf9d17e6498a33be47 Merge: 96398560f26aa 40543b3d9d2c1 Author: Jakub Kicinski Date: Tue Jan 10 18:26:33 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-01-09 (ice) This series contains updates to ice driver only. Jiasheng Jiang frees allocated cmd_buf if write_buf allocation failed to prevent memory leak. Yuan Can adds check, and proper cleanup, of gnss_tty_port allocation call to avoid memory leaks. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Add check for kzalloc ice: Fix potential memory leak in ice_gnss_tty_write() ==================== Link: https://lore.kernel.org/r/20230109225358.3478060-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 96398560f26aa07e8f2969d73c8197e6a6d10407 Author: Frederick Lawler Date: Mon Jan 9 10:39:06 2023 -0600 net: sched: disallow noqueue for qdisc classes While experimenting with applying noqueue to a classful queue discipline, we discovered a NULL pointer dereference in the __dev_queue_xmit() path that generates a kernel OOPS: # dev=enp0s5 # tc qdisc replace dev $dev root handle 1: htb default 1 # tc class add dev $dev parent 1: classid 1:1 htb rate 10mbit # tc qdisc add dev $dev parent 1:1 handle 10: noqueue # ping -I $dev -w 1 -c 1 1.1.1.1 [ 2.172856] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 2.173217] #PF: supervisor instruction fetch in kernel mode ... [ 2.178451] Call Trace: [ 2.178577] [ 2.178686] htb_enqueue+0x1c8/0x370 [ 2.178880] dev_qdisc_enqueue+0x15/0x90 [ 2.179093] __dev_queue_xmit+0x798/0xd00 [ 2.179305] ? _raw_write_lock_bh+0xe/0x30 [ 2.179522] ? __local_bh_enable_ip+0x32/0x70 [ 2.179759] ? ___neigh_create+0x610/0x840 [ 2.179968] ? eth_header+0x21/0xc0 [ 2.180144] ip_finish_output2+0x15e/0x4f0 [ 2.180348] ? dst_output+0x30/0x30 [ 2.180525] ip_push_pending_frames+0x9d/0xb0 [ 2.180739] raw_sendmsg+0x601/0xcb0 [ 2.180916] ? _raw_spin_trylock+0xe/0x50 [ 2.181112] ? _raw_spin_unlock_irqrestore+0x16/0x30 [ 2.181354] ? get_page_from_freelist+0xcd6/0xdf0 [ 2.181594] ? sock_sendmsg+0x56/0x60 [ 2.181781] sock_sendmsg+0x56/0x60 [ 2.181958] __sys_sendto+0xf7/0x160 [ 2.182139] ? handle_mm_fault+0x6e/0x1d0 [ 2.182366] ? do_user_addr_fault+0x1e1/0x660 [ 2.182627] __x64_sys_sendto+0x1b/0x30 [ 2.182881] do_syscall_64+0x38/0x90 [ 2.183085] entry_SYSCALL_64_after_hwframe+0x63/0xcd ... [ 2.187402] Previously in commit d66d6c3152e8 ("net: sched: register noqueue qdisc"), NULL was set for the noqueue discipline on noqueue init so that __dev_queue_xmit() falls through for the noqueue case. This also sets a bypass of the enqueue NULL check in the register_qdisc() function for the struct noqueue_disc_ops. Classful queue disciplines make it past the NULL check in __dev_queue_xmit() because the discipline is set to htb (in this case), and then in the call to __dev_xmit_skb(), it calls into htb_enqueue() which grabs a leaf node for a class and then calls qdisc_enqueue() by passing in a queue discipline which assumes ->enqueue() is not set to NULL. Fix this by not allowing classes to be assigned to the noqueue discipline. Linux TC Notes states that classes cannot be set to the noqueue discipline. [1] Let's enforce that here. Links: 1. https://linux-tc-notes.sourceforge.net/tc/doc/sch_noqueue.txt Fixes: d66d6c3152e8 ("net: sched: register noqueue qdisc") Cc: stable@vger.kernel.org Signed-off-by: Frederick Lawler Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20230109163906.706000-1-fred@cloudflare.com Signed-off-by: Jakub Kicinski commit 9c7417b5ec440242bb5b64521acd53d4e19130c1 Author: Geert Uytterhoeven Date: Mon Oct 3 11:06:57 2022 +0200 coredump: Move dump_emit_page() to kill unused warning If CONFIG_ELF_CORE is not set: fs/coredump.c:835:12: error: ‘dump_emit_page’ defined but not used [-Werror=unused-function] 835 | static int dump_emit_page(struct coredump_params *cprm, struct page *page) | ^~~~~~~~~~~~~~ Fix this by moving dump_emit_page() inside the existing section protected by #ifdef CONFIG_ELF_CORE. Fixes: 06bbaa6dc53cb720 ("[coredump] don't use __kernel_write() on kmap_local_page()") Signed-off-by: Geert Uytterhoeven Signed-off-by: Al Viro commit a6941f89d7c6a6ba49316bbd7da2fb2f719119a7 Author: Eric Huang Date: Thu Jan 5 14:01:18 2023 -0500 drm/amdkfd: Fix NULL pointer error for GC 11.0.1 on mGPU The point bo->kfd_bo is NULL for queue's write pointer BO when creating queue on mGPU. To avoid using the pointer fixes the error. Signed-off-by: Eric Huang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 972fb53d3605eb6cdf0d6ae9a52e910626a91ff7 Author: Guchun Chen Date: Tue Jan 10 11:33:44 2023 +0800 drm/amd/pm/smu13: BACO is supported when it's in BACO state This leverages the logic in smu11. No need to talk to SMU to check BACO enablement as it's in BACO state already. Signed-off-by: Guchun Chen Reviewed-by: Kenneth Feng Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0, 6.1 commit ba029e9991d9be90a28b6a0ceb25e9a6fb348829 Author: Eric Huang Date: Mon Jan 9 14:16:42 2023 -0500 drm/amdkfd: Add sync after creating vram bo There will be data corruption on vram allocated by svm if the initialization is not complete and application is writting on the memory. Adding sync to wait for the initialization completion is to resolve this issue. Signed-off-by: Eric Huang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 45c734817847e580163d85635fb4ea442056d489 Merge: 42c18d13623d8 a1904fa4dfc92 Author: Arnd Bergmann Date: Tue Jan 10 23:09:43 2023 +0100 Merge tag 'arm-soc/for-6.2/drivers-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM/ARM64/MIPS SoCs drivers fixes for 6.2, please pull the following: - Maxime fixes a sparse annotation for one of the Raspberry Pi firmware clock request message * tag 'arm-soc/for-6.2/drivers-fixes' of https://github.com/Broadcom/stblinux: firmware: raspberrypi: Fix type assignment Link: https://lore.kernel.org/r/20230110215025.1008437-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 42c18d13623d863e1cea018042546b0bd5a5dd11 Merge: 23d39547655e9 6049aae523925 Author: Arnd Bergmann Date: Tue Jan 10 23:09:09 2023 +0100 Merge tag 'qcom-driver-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v6.2 Updated error handling in the async packer router driver made an optional property required, fix this. Also improve error handling in the probe function of the CPR driver. * tag 'qcom-driver-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() soc: qcom: apr: Make qcom,protection-domain optional again dt-bindings: soc: qcom: apr: Make qcom,protection-domain optional again Link: https://lore.kernel.org/r/20230110213946.2183982-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 23d39547655e9d4144fce073ee2e9b112e8aedc5 Merge: 985d7fef11212 69876bc6fd4de Author: Arnd Bergmann Date: Tue Jan 10 23:08:59 2023 +0100 Merge tag 'qcom-arm64-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DTS fixes for 6.2 The cluster idle issue was resolved on SM8250, so the change disabling the cluster state is being reverted. Issues where identified with the QMP PHY binding, that would prevent enablement of Displayport and it was decided not to support the old binding for the recently introduced SC8280XP, which broke USB. This adjusts the USB PHY nodes to the new binding. The reset signal for the first QMP PHY is corrected as well. The reserved memory map is updated on Xiaomi Mi 4C and Huawei Nexus 6P, to avoid instabilities caused by use of protected memory regions. The compatible for the MSM8992 TCSR mutex is corrected as well. Lastly SDHCI interconnects on SM8350 are corrected to match the providers #interconnect-cells. * tag 'qcom-arm64-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: msm8992-libra: Fix the memory map arm64: dts: qcom: msm8992: Don't use sfpb mutex arm64: dts: msm8994-angler: fix the memory map arm64: dts: qcom: sm8350: correct SDHCI interconnect arguments Revert "arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state" arm64: dts: msm8992-bullhead: add memory hole region arm64: dts: qcom: sc8280xp: fix USB-DP PHY nodes arm64: dts: qcom: sc8280xp: fix primary USB-DP PHY reset Link: https://lore.kernel.org/r/20230110213724.2183668-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 985d7fef112120f4101ff1bf70ed89496b69a91b Merge: 6437c02912372 0154252a3b87f Author: Arnd Bergmann Date: Tue Jan 10 23:08:49 2023 +0100 Merge tag 'qcom-dts-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM32 DTS fix for 6.2 This fixes a regression on Inforce 6540, as the sdhci nodes no longer overrides the platform's mmc nodes. * tag 'qcom-dts-fixes-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI Link: https://lore.kernel.org/r/20230110212750.2182904-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 6437c0291237227ed36f61ddd71e66ff983b4fe4 Merge: daec8b54e9445 9d46ce57f4d1c Author: Arnd Bergmann Date: Tue Jan 10 23:08:10 2023 +0100 Merge branch 'armsoc-build-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc into arm/fixes ARM: SoC fixes These are three fixes for mistakes I discovered during the preparation of the boardfile removal. Robert noticed the accidental removal of PXA310 and PXA320 support because of a misplaced Kconfig statement, and the two OMAP patches were build failures that got introduced earlier but that I found while testing the removal. * 'armsoc-build-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: omap1: fix building gpio15xx ARM: omap1: fix !ARCH_OMAP1_ANY link failures ARM: pxa: enable PXA310/PXA320 for DT-only build commit 9d46ce57f4d1c626bb48170226ea5e35deb5877c Author: Arnd Bergmann Date: Tue Dec 13 22:06:49 2022 +0100 ARM: omap1: fix building gpio15xx In some randconfig builds, the asm/irq.h header is not included in gpio15xx.c, so add an explicit include to avoid a build fialure: In file included from arch/arm/mach-omap1/gpio15xx.c:15: arch/arm/mach-omap1/irqs.h:99:34: error: 'NR_IRQS_LEGACY' undeclared here (not in a function) 99 | #define IH2_BASE (NR_IRQS_LEGACY + 32) | ^~~~~~~~~~~~~~ arch/arm/mach-omap1/irqs.h:105:38: note: in expansion of macro 'IH2_BASE' 105 | #define INT_MPUIO (5 + IH2_BASE) | ^~~~~~~~ arch/arm/mach-omap1/gpio15xx.c:28:27: note: in expansion of macro 'INT_MPUIO' 28 | .start = INT_MPUIO, | ^~~~~~~~~ Acked-by: Aaro Koskinen Signed-off-by: Arnd Bergmann commit 980a637d11fe8dfc734f508a422185c2de55e669 Author: Arnd Bergmann Date: Wed Jan 4 09:35:09 2023 +0100 ARM: omap1: fix !ARCH_OMAP1_ANY link failures While compile-testing randconfig builds for the upcoming boardfile removal, I noticed that an earlier patch of mine was completely broken, and the introduction of CONFIG_ARCH_OMAP1_ANY only replaced one set of build failures with another one, now resulting in link failures like ld: drivers/video/fbdev/omap/omapfb_main.o: in function `omapfb_do_probe': drivers/video/fbdev/omap/omapfb_main.c:1703: undefined reference to `omap_set_dma_priority' ld: drivers/dma/ti/omap-dma.o: in function `omap_dma_free_chan_resources': drivers/dma/ti/omap-dma.c:777: undefined reference to `omap_free_dma' drivers/dma/ti/omap-dma.c:1685: undefined reference to `omap_get_plat_info' ld: drivers/usb/gadget/udc/omap_udc.o: in function `next_in_dma': drivers/usb/gadget/udc/omap_udc.c:820: undefined reference to `omap_get_dma_active_status' I tried reworking it, but the resulting patch ended up much bigger than simply avoiding the original problem of unused-function warnings like arch/arm/mach-omap1/mcbsp.c:76:30: error: unused variable 'omap1_mcbsp_ops' [-Werror,-Wunused-variable] As a result, revert the previous fix, and rearrange the code that produces warnings to hide them. For mcbsp, the #ifdef check can simply be removed as the cpu_is_omapxxx() checks already achieve the same result, while in the io.c the easiest solution appears to be to merge the common map bits into each soc specific portion. This gets cleaned in a nicer way after omap7xx support gets dropped, as the remaining SoCs all have the exact same I/O map. Fixes: 615dce5bf736 ("ARM: omap1: fix build with no SoC selected") Cc: stable@vger.kernel.org Acked-by: Aaro Koskinen Signed-off-by: Arnd Bergmann commit a1904fa4dfc929e5ea36bd409cf0d800df56fb8b Author: Maxime Ripard Date: Mon Jan 2 12:52:55 2023 +0100 firmware: raspberrypi: Fix type assignment We silently cast an unsigned int into a __le32 which makes sparse complain. Moreover, we never actually convert endianness between the CPU's and the expected little-endian value. Fix both at once by calling cpu_to_le32(). Fixes: 40c31955e4e9 ("firmware: raspberrypi: Provide a helper to query a clock max rate") Reported-by: kernel test robot Link: https://lore.kernel.org/r/20221116091712.1309651-3-maxime@cerno.tech Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20230102115255.17802-1-maxime@cerno.tech Signed-off-by: Florian Fainelli commit 39e8db3c860e2678ce5a7d74193925876507c9eb Author: Paulo Alcantara Date: Tue Jan 10 17:55:20 2023 -0300 cifs: fix double free on failed kerberos auth If session setup failed with kerberos auth, we ended up freeing cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and sesInfoFree(). Fix this by zeroing out cifs_ses::auth_key.response after freeing it in SMB2_auth_kerberos(). Fixes: a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data") Signed-off-by: Paulo Alcantara (SUSE) Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 2f57e4464cddfceda850ae4224779d11b6eb171f Author: Colin Ian King Date: Thu Jan 5 13:41:11 2023 +0000 cifs: remove redundant assignment to the variable match The variable match is being assigned a value that is never read, it is being re-assigned a new value later on. The assignment is redundant and can be removed. Cleans up clang scan-build warning: fs/cifs/dfs_cache.c:1302:2: warning: Value stored to 'match' is never read Signed-off-by: Colin Ian King Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7dd4b804e08041ff56c88bdd8da742d14b17ed25 Merge: 092f6239108d3 5304930dbae82 Author: Linus Torvalds Date: Tue Jan 10 15:03:06 2023 -0600 Merge tag 'nfsd-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix a race when creating NFSv4 files - Revert the use of relaxed bitops * tag 'nfsd-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Use set_bit(RQ_DROPME) Revert "SUNRPC: Use RMW bitops in single-threaded hot paths" nfsd: fix handling of cached open files in nfsd4_open codepath commit 092f6239108d3c612f5e1c67d9cd0cc80461fc91 Merge: 40c18f363a080 4414c1f5c7a37 Author: Linus Torvalds Date: Tue Jan 10 14:48:12 2023 -0600 Merge tag 'xtensa-20230110' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix xtensa allmodconfig build broken by the kcsan test - drop unused members of struct thread_struct * tag 'xtensa-20230110' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: drop unused members of struct thread_struct kcsan: test: don't put the expect array on the stack commit 6650c8e906ce58404bfdfceceeba7bd10d397d40 Author: Daniil Tatianin Date: Tue Dec 20 09:32:46 2022 +0300 iavf/iavf_main: actually log ->src mask when talking about it This fixes a copy-paste issue where dev_err would log the dst mask even though it is clearly talking about src. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 0075fa0fadd0 ("i40evf: Add support to apply cloud filters") Signed-off-by: Daniil Tatianin Reviewed-by: Michal Swiatkowski Signed-off-by: Tony Nguyen commit 5e91c72e560cc85f7163bbe3d14197268de31383 Author: Christopher S Hall Date: Wed Dec 14 16:10:38 2022 +0800 igc: Fix PPS delta between two synchronized end-points This patch fix the pulse per second output delta between two synchronized end-points. Based on Intel Discrete I225 Software User Manual Section 4.2.15 TimeSync Auxiliary Control Register, ST0[Bit 4] and ST1[Bit 7] must be set to ensure that clock output will be toggles based on frequency value defined. This is to ensure that output of the PPS is aligned with the clock. How to test: 1) Running time synchronization on both end points. Ex: ptp4l --step_threshold=1 -m -f gPTP.cfg -i 2) Configure PPS output using below command for both end-points Ex: SDP0 on I225 REV4 SKU variant ./testptp -d /dev/ptp0 -L 0,2 ./testptp -d /dev/ptp0 -p 1000000000 3) Measure the output using analyzer for both end-points Fixes: 87938851b6ef ("igc: enable auxiliary PHC functions for the i225") Signed-off-by: Christopher S Hall Signed-off-by: Muhammad Husaini Zulkifli Acked-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit b93fb4405fcb5112c5739c5349afb52ec7f15c07 Author: Yang Yingliang Date: Tue Nov 29 09:57:48 2022 +0800 ixgbe: fix pci device refcount leak As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak. Fixes: 8fa10ef01260 ("ixgbe: register a mdiobus") Signed-off-by: Yang Yingliang Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 4f3085f87b51a551a0647f218d4f324796ecb703 Author: Perry Yuan Date: Tue Jan 10 23:10:29 2023 +0800 cpufreq: amd-pstate: fix kernel hang issue while amd-pstate unregistering In the amd_pstate_adjust_perf(), there is one cpufreq_cpu_get() call to increase increments the kobject reference count of policy and make it as busy. Therefore, a corresponding call to cpufreq_cpu_put() is needed to decrement the kobject reference count back, it will resolve the kernel hang issue when unregistering the amd-pstate driver and register the `amd_pstate_epp` driver instance. Fixes: 1d215f0319 ("cpufreq: amd-pstate: Add fast switch function for AMD P-State") Acked-by: Huang Rui Reviewed-by: Mario Limonciello Tested-by: Wyes Karny Signed-off-by: Perry Yuan Cc: 5.17+ # 5.17+ Signed-off-by: Rafael J. Wysocki commit 7e834ff13c4fcdf2bbd0eaf740781445d9c45d2e Merge: b7bfaa761d760 08f0adb193c00 Author: Rafael J. Wysocki Date: Tue Jan 10 20:27:13 2023 +0100 Merge tag 'cpufreq/arm/fixes-6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq ARM fixes for 6.2-rc4 from Viresh Kumar: "- Fix double initialization and set suspend-freq for Apple's cpufreq driver (Arnd Bergmann and Hector Martin). - Fix reading of "reg" property, update cpufreq-dt's blocklist and update DT documentation for Qualcomm's cpufreq driver (Konrad Dybcio and Krzysztof Kozlowski). - Replace 0 with NULL for Armada driver (Miles Chen). - Fix potential overflows in CPPC driver (Pierre Gondois). - Update blocklist for Tegra234 Soc (Sumit Gupta)." commit f64e4275ef7407d5c3eca20436519bbd1f796e40 Author: Hans de Goede Date: Tue Jan 10 16:30:28 2023 +0100 ACPI: Fix selecting wrong ACPI fwnode for the iGPU on some Dell laptops The Dell Latitude E6430 both with and without the optional NVidia dGPU has a bug in its ACPI tables which is causing Linux to assign the wrong ACPI fwnode / companion to the pci_device for the i915 iGPU. Specifically under the PCI root bridge there are these 2 ACPI Device()s : Scope (_SB.PCI0) { Device (GFX0) { Name (_ADR, 0x00020000) // _ADR: Address } ... Device (VID) { Name (_ADR, 0x00020000) // _ADR: Address ... Method (_DOS, 1, NotSerialized) // _DOS: Disable Output Switching { VDP8 = Arg0 VDP1 (One, VDP8) } Method (_DOD, 0, NotSerialized) // _DOD: Display Output Devices { ... } ... } } The non-functional GFX0 ACPI device is a problem, because this gets returned as ACPI companion-device by acpi_find_child_device() for the iGPU. This is a long standing problem and the i915 driver does use the ACPI companion for some things, but works fine without it. However since commit 63f534b8bad9 ("ACPI: PCI: Rework acpi_get_pci_dev()") acpi_get_pci_dev() relies on the physical-node pointer in the acpi_device and that is set on the wrong acpi_device because of the wrong acpi_find_child_device() return. This breaks the ACPI video code, leading to non working backlight control in some cases. Add a type.backlight flag, mark ACPI video bus devices with this and make find_child_checks() return a higher score for children with this flag set, so that it picks the right companion-device. Fixes: 63f534b8bad9 ("ACPI: PCI: Rework acpi_get_pci_dev()") Co-developed-by: Rafael J. Wysocki Signed-off-by: Hans de Goede Cc: 6.1+ # 6.1+ Signed-off-by: Rafael J. Wysocki commit 74d3320f6f7cf72de88a7e8df573821f6db90239 Author: Masahiro Yamada Date: Tue Jan 10 14:48:00 2023 +0900 kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y When CONFIG_DEBUG_INFO_BTF_MODULES=y, running 'make modules' in the clean kernel tree will get the following error. $ grep CONFIG_DEBUG_INFO_BTF_MODULES .config CONFIG_DEBUG_INFO_BTF_MODULES=y $ make -s clean $ make modules [snip] AR vmlinux.a ar: ./built-in.a: No such file or directory make: *** [Makefile:1241: vmlinux.a] Error 1 'modules' depends on 'vmlinux', but builtin objects are not built. Define KBUILD_BUILTIN. Fixes: f73edc8951b2 ("kbuild: unify two modpost invocations") Signed-off-by: Masahiro Yamada commit 8debed3efe3a731451ad9a91a7a74eeb18a7f7eb Author: Masahiro Yamada Date: Mon Jan 9 04:23:17 2023 +0900 kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux Nathan Chancellor reports that $(NM) emits an error message when GNU Make 4.4 is used to build the ARM zImage. $ make-4.4 ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- O=build defconfig zImage [snip] LD vmlinux NM System.map SORTTAB vmlinux OBJCOPY arch/arm/boot/Image Kernel: arch/arm/boot/Image is ready arm-linux-gnueabi-nm: 'arch/arm/boot/compressed/../../../../vmlinux': No such file /bin/sh: 1: arithmetic expression: expecting primary: " " LDS arch/arm/boot/compressed/vmlinux.lds AS arch/arm/boot/compressed/head.o GZIP arch/arm/boot/compressed/piggy_data AS arch/arm/boot/compressed/piggy.o CC arch/arm/boot/compressed/misc.o This occurs since GNU Make commit 98da874c4303 ("[SV 10593] Export variables to $(shell ...) commands"), and the O= option is needed to reproduce it. The generated zImage is correct despite the error message. As the commit description of 98da874c4303 [1] says, exported variables are passed down to $(shell ) functions, which means exported recursive variables might be expanded earlier than before, in the parse stage. The following test code demonstrates the change for GNU Make 4.4. [Test Makefile] $(shell echo hello > foo) export foo = $(shell cat bar/../foo) $(shell mkdir bar) all: @echo $(foo) [GNU Make 4.3] $ rm -rf bar; make-4.3 hello [GNU Make 4.4] $ rm -rf bar; make-4.4 cat: bar/../foo: No such file or directory hello The 'foo' is a resursively expanded (i.e. lazily expanded) variable. GNU Make 4.3 expands 'foo' just before running the recipe '@echo $(foo)', at this point, the directory 'bar' exists. GNU Make 4.4 expands 'foo' to evaluate $(shell mkdir bar) because it is exported. At this point, the directory 'bar' does not exit yet. The cat command cannot resolve the bar/../foo path, hence the error message. Let's get back to the kernel Makefile. In arch/arm/boot/compressed/Makefile, KBSS_SZ is referenced by LDFLAGS_vmlinux, which is recursive and also exported by the top Makefile. GNU Make 4.3 expands KBSS_SZ just before running the recipes, so no error message. GNU Make 4.4 expands KBSS_SZ in the parse stage, where the directory arm/arm/boot/compressed does not exit yet. When compiled with O=, the output directory is created by $(shell mkdir -p $(obj-dirs)) in scripts/Makefile.build. There are two ways to fix this particular issue: - change "$(obj)/../../../../vmlinux" in KBSS_SZ to "vmlinux" - unexport LDFLAGS_vmlinux This commit takes the latter course because it is what I originally intended. Commit 3ec8a5b33dea ("kbuild: do not export LDFLAGS_vmlinux") unexported LDFLAGS_vmlinux. Commit 5d4aeffbf709 ("kbuild: rebuild .vmlinux.export.o when its prerequisite is updated") accidentally exported it again. We can clean up arch/arm/boot/compressed/Makefile later. [1]: https://git.savannah.gnu.org/cgit/make.git/commit/?id=98da874c43035a490cdca81331724f233a3d0c9a Link: https://lore.kernel.org/all/Y7i8+EjwdnhHtlrr@dev-arch.thelio-3990X/ Fixes: 5d4aeffbf709 ("kbuild: rebuild .vmlinux.export.o when its prerequisite is updated") Reported-by: Nathan Chancellor Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor commit 420a1116aef0e8e12c305508f45ce73e5ae30a09 Author: Hans de Goede Date: Mon Jan 9 20:18:11 2023 +0100 ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from the cmdline The patches adding NVidia-WMI-EC and Apple GMUX backlight detection support to acpi_video_get_backlight_type(), forgot to update acpi_video_parse_cmdline() to allow manually selecting these from the commandline. Add support for these to acpi_video_parse_cmdline(). Fixes: fe7aebb40d42 ("ACPI: video: Add Nvidia WMI EC brightness control detection (v3)") Fixes: 21245df307cb ("ACPI: video: Add Apple GMUX brightness control detection") Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 77c7248882385397cd7dffe9e1437f59f32ce2de Author: Tamim Khan Date: Fri Dec 30 00:58:39 2022 -0500 ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops, the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1 as ActiveLow while the kernel overrides it to Edge_High. This prevents the keyboard from working. To fix this issue, add this laptop to the skip_override_table so that the kernel does not override IRQ 1. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864 Tested-by: zelenat Signed-off-by: Tamim Khan Signed-off-by: Rafael J. Wysocki commit 2a81160d29d65b5876ab3f824fda99ae0219f05e Author: Peter Newman Date: Tue Dec 20 17:41:31 2022 +0100 x86/resctrl: Fix event counts regression in reused RMIDs When creating a new monitoring group, the RMID allocated for it may have been used by a group which was previously removed. In this case, the hardware counters will have non-zero values which should be deducted from what is reported in the new group's counts. resctrl_arch_reset_rmid() initializes the prev_msr value for counters to 0, causing the initial count to be charged to the new group. Resurrect __rmid_read() and use it to initialize prev_msr correctly. Unlike before, __rmid_read() checks for error bits in the MSR read so that callers don't need to. Fixes: 1d81d15db39c ("x86/resctrl: Move mbm_overflow_count() into resctrl_arch_rmid_read()") Signed-off-by: Peter Newman Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Tested-by: Babu Moger Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221220164132.443083-1-peternewman@google.com commit fe1f0714385fbcf76b0cbceb02b7277d842014fc Author: Peter Newman Date: Tue Dec 20 17:11:23 2022 +0100 x86/resctrl: Fix task CLOSID/RMID update race When the user moves a running task to a new rdtgroup using the task's file interface or by deleting its rdtgroup, the resulting change in CLOSID/RMID must be immediately propagated to the PQR_ASSOC MSR on the task(s) CPUs. x86 allows reordering loads with prior stores, so if the task starts running between a task_curr() check that the CPU hoisted before the stores in the CLOSID/RMID update then it can start running with the old CLOSID/RMID until it is switched again because __rdtgroup_move_task() failed to determine that it needs to be interrupted to obtain the new CLOSID/RMID. Refer to the diagram below: CPU 0 CPU 1 ----- ----- __rdtgroup_move_task(): curr <- t1->cpu->rq->curr __schedule(): rq->curr <- t1 resctrl_sched_in(): t1->{closid,rmid} -> {1,1} t1->{closid,rmid} <- {2,2} if (curr == t1) // false IPI(t1->cpu) A similar race impacts rdt_move_group_tasks(), which updates tasks in a deleted rdtgroup. In both cases, use smp_mb() to order the task_struct::{closid,rmid} stores before the loads in task_curr(). In particular, in the rdt_move_group_tasks() case, simply execute an smp_mb() on every iteration with a matching task. It is possible to use a single smp_mb() in rdt_move_group_tasks(), but this would require two passes and a means of remembering which task_structs were updated in the first loop. However, benchmarking results below showed too little performance impact in the simple approach to justify implementing the two-pass approach. Times below were collected using `perf stat` to measure the time to remove a group containing a 1600-task, parallel workload. CPU: Intel(R) Xeon(R) Platinum P-8136 CPU @ 2.00GHz (112 threads) # mkdir /sys/fs/resctrl/test # echo $$ > /sys/fs/resctrl/test/tasks # perf bench sched messaging -g 40 -l 100000 task-clock time ranges collected using: # perf stat rmdir /sys/fs/resctrl/test Baseline: 1.54 - 1.60 ms smp_mb() every matching task: 1.57 - 1.67 ms [ bp: Massage commit message. ] Fixes: ae28d1aae48a ("x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR") Fixes: 0efc89be9471 ("x86/intel_rdt: Update task closid immediately on CPU in rmdir and unmount") Signed-off-by: Peter Newman Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Reviewed-by: Babu Moger Cc: Link: https://lore.kernel.org/r/20221220161123.432120-1-peternewman@google.com commit 895c0747f726bb50c9b7a805613a61d1b6f9fa06 Author: Niklas Schnelle Date: Tue Jan 10 17:44:27 2023 +0100 vfio/type1: Respect IOMMU reserved regions in vfio_test_domain_fgsp() Since commit cbf7827bc5dc ("iommu/s390: Fix potential s390_domain aperture shrinking") the s390 IOMMU driver uses reserved regions for the system provided DMA ranges of PCI devices. Previously it reduced the size of the IOMMU aperture and checked it on each mapping operation. On current machines the system denies use of DMA addresses below 2^32 for all PCI devices. Usually mapping IOVAs in a reserved regions is harmless until a DMA actually tries to utilize the mapping. However on s390 there is a virtual PCI device called ISM which is implemented in firmware and used for cross LPAR communication. Unlike real PCI devices this device does not use the hardware IOMMU but inspects IOMMU translation tables directly on IOTLB flush (s390 RPCIT instruction). If it detects IOVA mappings outside the allowed ranges it goes into an error state. This error state then causes the device to be unavailable to the KVM guest. Analysing this we found that vfio_test_domain_fgsp() maps 2 pages at DMA address 0 irrespective of the IOMMUs reserved regions. Even if usually harmless this seems wrong in the general case so instead go through the freshly updated IOVA list and try to find a range that isn't reserved, and fits 2 pages, is PAGE_SIZE * 2 aligned. If found use that for testing for fine grained super pages. Fixes: af029169b8fd ("vfio/type1: Check reserved region conflict and update iova list") Signed-off-by: Niklas Schnelle Reviewed-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20230110164427.4051938-2-schnelle@linux.ibm.com Signed-off-by: Alex Williamson commit ea97cbebaf861d99c3e892275147e6fca6d2c1ca Author: Jens Axboe Date: Tue Jan 10 10:24:52 2023 -0700 io_uring/fdinfo: include locked hash table in fdinfo output A previous commit split the hash table for polled requests into two parts, but didn't get the fdinfo output updated. This means that it's less useful for debugging, as we may think a given request is not pending poll. Fix this up by dumping the locked hash table contents too. Fixes: 9ca9fb24d5fe ("io_uring: mutex locked poll hashing") Signed-off-by: Jens Axboe commit 90b926e68f500844dff16b5bcea178dc55cf580a Author: Juergen Gross Date: Tue Jan 10 07:54:27 2023 +0100 x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case Since 72cbc8f04fe2 ("x86/PAT: Have pat_enabled() properly reflect state when running on Xen") PAT can be enabled without MTRR. This has resulted in problems e.g. for a SEV-SNP guest running under Hyper-V, when trying to establish a new mapping via memremap() with WB caching mode, as pat_x_mtrr_type() will call mtrr_type_lookup(), which in turn is returning MTRR_TYPE_INVALID due to MTRR being disabled in this configuration. The result is a mapping with UC- caching, leading to severe performance degradation. Fix that by handling MTRR_TYPE_INVALID the same way as MTRR_TYPE_WRBACK in pat_x_mtrr_type() because MTRR_TYPE_INVALID means MTRRs are disabled. [ bp: Massage commit message. ] Fixes: 72cbc8f04fe2 ("x86/PAT: Have pat_enabled() properly reflect state when running on Xen") Reported-by: Michael Kelley (LINUX) Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Michael Kelley Tested-by: Michael Kelley Cc: Link: https://lore.kernel.org/r/20230110065427.20767-1-jgross@suse.com commit d3de5616d36462a646f5b360ba82d3b09ff668eb Author: Chris Wilson Date: Mon Dec 12 17:13:38 2022 +0100 drm/i915/gt: Reset twice After applying an engine reset, on some platforms like Jasperlake, we occasionally detect that the engine state is not cleared until shortly after the resume. As we try to resume the engine with volatile internal state, the first request fails with a spurious CS event (it looks like it reports a lite-restore to the hung context, instead of the expected idle->active context switch). Signed-off-by: Chris Wilson Cc: stable@vger.kernel.org Cc: Mika Kuoppala Signed-off-by: Andi Shyti Reviewed-by: Gwan-gyeong Mun Link: https://patchwork.freedesktop.org/patch/msgid/20221212161338.1007659-1-andi.shyti@linux.intel.com (cherry picked from commit 3db9d590557da3aa2c952f2fecd3e9b703dad790) Signed-off-by: Rodrigo Vivi commit 69876bc6fd4de3ad2dc7826fe269e91fa2c1807f Author: Konrad Dybcio Date: Mon Dec 19 14:19:18 2022 +0100 arm64: dts: qcom: msm8992-libra: Fix the memory map The memory map was wrong. Fix it to prevent the device from randomly rebooting. Fixes: 0f5cdb31e850 ("arm64: dts: qcom: Add Xiaomi Libra (Mi 4C) device tree") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221219131918.446587-2-konrad.dybcio@linaro.org commit 2bd5ab93335bf2c4d22c8db427822ae637ed8dc3 Author: Konrad Dybcio Date: Mon Dec 19 14:19:17 2022 +0100 arm64: dts: qcom: msm8992: Don't use sfpb mutex MSM8992 uses the same mutex hardware as MSM8994. This was wrong from the start, but never presented as an issue until the sfpb compatible was given different driver data. Fixes: 6a6d1978f9c0 ("arm64: dts: msm8992 SoC and LG Bullhead (Nexus 5X) support") Reported-by: Eugene Lepshy Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221219131918.446587-1-konrad.dybcio@linaro.org commit 6049aae52392539e505bfb8ccbcff3c26f1d2f0b Author: Christophe JAILLET Date: Sat Dec 17 17:05:41 2022 +0100 PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() If an error occurs after a successful pm_genpd_init() call, it should be undone by a corresponding pm_genpd_remove(). Add the missing call in the error handling path, as already done in the remove function. Fixes: bf6910abf548 ("power: avs: Add support for CPR (Core Power Reduction)") Signed-off-by: Christophe JAILLET Reviewed-by: Ulf Hansson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/0f520597dbad89ab99c217c8986912fa53eaf5f9.1671293108.git.christophe.jaillet@wanadoo.fr commit 380cd3a34b7f9825a60ccb045611af9cb4533b70 Author: Dominik Kobinski Date: Fri Dec 30 20:48:45 2022 +0100 arm64: dts: msm8994-angler: fix the memory map Add reserved regions for memory hole and tz app mem to prevent rebooting. Also enable cont_splash_mem, it is the same as the generic 8994 one. Reported-by: Petr Vorel Signed-off-by: Dominik Kobinski Reviewed-by: Petr Vorel Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221230194845.57780-1-dominikkobinski314@gmail.com commit 0b693c8f8b88d50114caaa4d2337932d4d172631 Author: Chukun Pan Date: Mon Dec 19 18:10:52 2022 +0800 arm64: dts: rockchip: remove unsupported property from sdmmc2 for rock-3a 'supports-sdio' is not part of the DT binding and not supported by the Linux driver. Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20221219101052.7899-1-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 14292a4ae1a37a7c97fda59b85cd625c77165ddf Author: Arnaldo Carvalho de Melo Date: Tue Jan 10 11:46:37 2023 -0300 perf bpf: Avoid build breakage with libbpf < 0.8.0 + LIBBPF_DYNAMIC=1 In 746bd29e348f99b4 ("perf build: Use tools/lib headers from install path") we stopped having the tools/lib/ directory from the kernel sources in the header include path unconditionally, which breaks the build on systems with older versions of libbpf-devel, in this case 0.7.0 as some of the structures and function declarations present in the newer version of libbpf included in the kernel sources (tools/lib/bpf) are not anymore used, just the ones in the system libbpf. So instead of trying to provide alternative functions when the libbpf-bpf_program__set_insns feature test fails, fail a LIBBPF_DYNAMIC=1 build (requesting the use of the system's libbpf) and emit this build error message: $ make LIBBPF_DYNAMIC=1 -C tools/perf Makefile.config:593: *** Error: libbpf devel library needs to be >= 0.8.0 to build with LIBBPF_DYNAMIC, update or build statically with the version that comes with the kernel sources. Stop. $ For v6.3 these tests will be revamped and we'll require libbpf 1.0 as a minimal version for using LIBBPF_DYNAMIC=1, most distros should have it by now or at v6.3 time. Fixes: 746bd29e348f99b4 ("perf build: Use tools/lib headers from install path") Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/CAP-5=fVa51_URGsdDFVTzpyGmdDRj_Dj2EKPuDHNQ0BYgMSzUA@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 1692bffec674551163a7a4be32f59fdde04ecd27 Author: Krzysztof Kozlowski Date: Fri Nov 25 15:41:34 2022 +0100 arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc GPIO LEDs do not have a 'mode' property: rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected) Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit eef034ac6690118c88f357b00e2b3239c9d8575d Author: Alexander Potapenko Date: Tue Jan 10 13:49:30 2023 +0100 affs: initialize fsdata in affs_truncate() When aops->write_begin() does not initialize fsdata, KMSAN may report an error passing the latter to aops->write_end(). Fix this by unconditionally initializing fsdata. Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops") Suggested-by: Eric Biggers Signed-off-by: Alexander Potapenko Reviewed-by: David Sterba Signed-off-by: David Sterba commit f00eccb447762c99675f3f5b0311a1216135af95 Author: Ian Rogers Date: Fri Jan 6 07:13:20 2023 -0800 perf build: Fix build error when NO_LIBBPF=1 The $(LIBBPF) target should only be a dependency of prepare if the static version of libbpf is needed. Add a new LIBBPF_STATIC variable that is set by Makefile.config. Use LIBBPF_STATIC to determine whether the CFLAGS, etc. need updating and for adding $(LIBBPF) as a prepare dependency. As Makefile.config isn't loaded for "clean" as a target, always set LIBBPF_OUTPUT regardless of whether it is needed for $(LIBBPF). This is done to minimize conditional logic for $(LIBBPF)-clean. This issue and an original fix was reported by Mike Leach in: https://lore.kernel.org/lkml/20230105172243.7238-1-mike.leach@linaro.org/ Fixes: 746bd29e348f99b4 ("perf build: Use tools/lib headers from install path") Reported-by: Mike Leach Signed-off-by: Ian Rogers Tested-by: Jiri Olsa Cc: Alexander Shishkin Cc: bpf@vger.kernel.org Cc: Ian Rogers Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20230106151320.619514-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 213b760fbc69f2d6aed8f64f006a17869f0d8da4 Author: Arnaldo Carvalho de Melo Date: Mon Jan 9 11:59:30 2023 -0300 perf tools: Don't install libtraceevent plugins as its not anymore in the kernel sources While doing 'make -C tools/perf build-test' one can notice error messages while trying to install libtraceevent plugins, stop doing that as libtraceevent isn't anymore a homie. These are the warnings dealt with: make_install_prefix_slash_O: make install prefix=/tmp/krava/ failed to find: /tmp/krava/etc/bash_completion.d/perf failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_cfg80211.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_scsi.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_xen.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_function.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_sched_switch.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_mac80211.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_kvm.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_kmem.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_hrtimer.so failed to find: /tmp/krava/lib64/traceevent/plugins/plugin_jbd2.so Fixes: 4171925aa9f3f7bf ("tools lib traceevent: Remove libtraceevent") Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Steven Rostedt Link: http://lore.kernel.org/lkml/Y7xXz+TSpiCbQGjw@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit dce088ab0d51ae3b14fb2bd608e9c649aadfe5dc Author: Leo Yan Date: Sun Jan 8 14:24:00 2023 +0800 perf kmem: Support field "node" in evsel__process_alloc_event() coping with recent tracepoint restructuring Commit 11e9734bcb6a7361 ("mm/slab_common: unify NUMA and UMA version of tracepoints") adds the field "node" into the tracepoints 'kmalloc' and 'kmem_cache_alloc', so this patch modifies the event process function to support the field "node". If field "node" is detected by checking function evsel__field(), it stats the cross allocation. When the "node" value is NUMA_NO_NODE (-1), it means the memory can be allocated from any memory node, in this case, we don't account it as a cross allocation. Fixes: 11e9734bcb6a7361 ("mm/slab_common: unify NUMA and UMA version of tracepoints") Reported-by: Ravi Bangoria Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Alexander Shishkin Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Vlastimil Babka Link: https://lore.kernel.org/r/20230108062400.250690-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit b3719108ae60169eda5c941ca5e1be1faa371c57 Author: Leo Yan Date: Sun Jan 8 14:23:59 2023 +0800 perf kmem: Support legacy tracepoints Commit 11e9734bcb6a7361 ("mm/slab_common: unify NUMA and UMA version of tracepoints") removed tracepoints 'kmalloc_node' and 'kmem_cache_alloc_node', we need to consider the tool should be backward compatible. If it detect the tracepoint "kmem:kmalloc_node", this patch enables the legacy tracepoints, otherwise, it will ignore them. Fixes: 11e9734bcb6a7361 ("mm/slab_common: unify NUMA and UMA version of tracepoints") Reported-by: Ravi Bangoria Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Alexander Shishkin Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Vlastimil Babka Link: https://lore.kernel.org/r/20230108062400.250690-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit d891f2b724b39a2a41e3ad7b57110193993242ff Author: Ian Rogers Date: Fri Jan 6 07:13:19 2023 -0800 perf build: Properly guard libbpf includes Including libbpf header files should be guarded by HAVE_LIBBPF_SUPPORT. In bpf_counter.h, move the skeleton utilities under HAVE_BPF_SKEL. Fixes: d6a735ef3277c45f ("perf bpf_counter: Move common functions to bpf_counter.h") Reported-by: Mike Leach Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Tested-by: Jiri Olsa Tested-by: Mike Leach Cc: Alexander Shishkin Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20230105172243.7238-1-mike.leach@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 33e24f0738b922b6f5f4118dbdc26cac8400d7b9 Author: Jarrah Gosbell Date: Wed Dec 7 11:32:13 2022 +0000 arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro While this device uses the rk3399 it is also enclosed in a tight package and cooled through the screen and back case. The default rk3399 thermal limits can result in a burnt screen. These lower limits have resulted in the existing burn not expanding and will hopefully result in future devices not experiencing the issue. Signed-off-by: Jarrah Gosbell Link: https://lore.kernel.org/r/20221207113212.8216-1-kernel@undef.tools Signed-off-by: Heiko Stuebner commit c2337a40e04dde1692b5b0a46ecc59f89aaba8a1 Author: Alexander Egorenkov Date: Mon Nov 14 11:40:08 2022 +0100 s390/kexec: fix ipl report address for kdump This commit addresses the following erroneous situation with file-based kdump executed on a system with a valid IPL report. On s390, a kdump kernel, its initrd and IPL report if present are loaded into a special and reserved on boot memory region - crashkernel. When a system crashes and kdump was activated before, the purgatory code is entered first which swaps the crashkernel and [0 - crashkernel size] memory regions. Only after that the kdump kernel is entered. For this reason, the pointer to an IPL report in lowcore must point to the IPL report after the swap and not to the address of the IPL report that was located in crashkernel memory region before the swap. Failing to do so, makes the kdump's decompressor try to read memory from the crashkernel memory region which already contains the production's kernel memory. The situation described above caused spontaneous kdump failures/hangs on systems where the Secure IPL is activated because on such systems an IPL report is always present. In that case kdump's decompressor tried to parse an IPL report which frequently lead to illegal memory accesses because an IPL report contains addresses to various data. Cc: Fixes: 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel") Reviewed-by: Vasily Gorbik Signed-off-by: Alexander Egorenkov Signed-off-by: Heiko Carstens commit 242fc66ae6e1e2b8519daacc7590a73cd0e8a6e4 Author: Mark Brown Date: Fri Jan 6 23:15:07 2023 +0000 ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets The fsl-asoc-card AC'97 support currently tries to route to Playback and Capture widgets provided by the AC'97 CODEC. This doesn't work since the generic AC'97 driver registers with an "AC97" at the front of the stream and hence widget names, update to reflect reality. It's not clear to me if or how this ever worked. Acked-by: Shengjiu Wang Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-2-a5d7469d4f67@kernel.org Signed-off-by: Mark Brown commit 8c6a42b5b0ed6f96624f56954e93eeae107440a6 Author: Mark Brown Date: Fri Jan 6 23:15:06 2023 +0000 ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC The SSI driver calls the AC'97 playback and transmit streams "AC97 Playback" and "AC97 Capture" respectively. This is the same name used by the generic AC'97 CODEC driver in ASoC, creating confusion for the Freescale ASoC card when it attempts to use these widgets in routing. Add a "CPU" in the name like the regular DAIs registered by the driver to disambiguate. Acked-by: Shengjiu Wang Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-1-a5d7469d4f67@kernel.org Signed-off-by: Mark Brown commit f216033d770f7ca0eda491fe01a9f02e7af59576 Author: Felix Fietkau Date: Wed Dec 14 14:03:26 2022 +0100 wifi: mac80211: fix MLO + AP_VLAN check Instead of preventing adding AP_VLAN to MLO enabled APs, this check was preventing adding more than one 4-addr AP_VLAN regardless of the MLO status. Fix this by adding missing extra checks. Fixes: ae960ee90bb1 ("wifi: mac80211: prevent VLANs on MLDs") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20221214130326.37756-1-nbd@nbd.name Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit fa22b51ace8aa106267636f36170e940e676809c Author: Sriram R Date: Thu Dec 8 09:30:50 2022 +0530 mac80211: Fix MLO address translation for multiple bss case When multiple interfaces are present in the local interface list, new skb copy is taken before rx processing except for the first interface. The address translation happens each time only on the original skb since the hdr pointer is not updated properly to the newly created skb. As a result frames start to drop in userspace when address based checks or search fails. Signed-off-by: Sriram R Link: https://lore.kernel.org/r/20221208040050.25922-1-quic_srirrama@quicinc.com Signed-off-by: Johannes Berg commit 0eb38842ada035d71bb06fb9116f26f24ee0f998 Author: Aloka Dixit Date: Wed Dec 21 10:56:16 2022 -0800 wifi: mac80211: reset multiple BSSID options in stop_ap() Reset multiple BSSID options when all AP related configurations are reset in ieee80211_stop_ap(). Stale values result in HWSIM test failures (e.g. p2p_group_cli_invalid), if run after 'he_ap_ema'. Reported-by: Jouni Malinen Signed-off-by: Aloka Dixit Link: https://lore.kernel.org/r/20221221185616.11514-1-quic_alokad@quicinc.com Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit 592234e941f1addaa598601c9227e3b72d608625 Author: Alexander Wetzel Date: Fri Jan 6 23:31:41 2023 +0100 wifi: mac80211: Fix iTXQ AMPDU fragmentation handling mac80211 must not enable aggregation wile transmitting a fragmented MPDU. Enforce that for mac80211 internal TX queues (iTXQs). Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202301021738.7cd3e6ae-oliver.sang@intel.com Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit 69403bad97aa0162e3d7911b27e25abe774093df Author: Alexander Wetzel Date: Fri Dec 30 13:18:50 2022 +0100 wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 might_sleep(); 394 395 sdata = get_bss_sdata(sdata); 396 if (!check_sdata_in_driver(sdata)) 397 return -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: moving STA 02:00:00:00:03:00 to state 3 wlan0: associated wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) wlan0: moving STA 02:00:00:00:03:00 to state 2 wlan0: moving STA 02:00:00:00:03:00 to state 1 wlan0: Removed STA 02:00:00:00:03:00 wlan0: Destroyed STA 02:00:00:00:03:00 BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace: ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] process_one_work+0x29f/0x620 worker_thread+0x4d/0x3d0 ? process_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20221230121850.218810-2-alexander@wetzel-home.de Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit 4444bc2116aecdcde87dce80373540adc8bd478b Author: Alexander Wetzel Date: Fri Dec 30 13:18:49 2022 +0100 wifi: mac80211: Proper mark iTXQs for resumption When a running wake_tx_queue() call is aborted due to a hw queue stop the corresponding iTXQ is not always correctly marked for resumption: wake_tx_push_queue() can stops the queue run without setting @IEEE80211_TXQ_STOP_NETIF_TX. Without the @IEEE80211_TXQ_STOP_NETIF_TX flag __ieee80211_wake_txqs() will not schedule a new queue run and remaining frames in the queue get stuck till another frame is queued to it. Fix the issue for all drivers - also the ones with custom wake_tx_queue callbacks - by moving the logic into ieee80211_tx_dequeue() and drop the redundant @txqs_stopped. @IEEE80211_TXQ_STOP_NETIF_TX is also renamed to @IEEE80211_TXQ_DIRTY to better describe the flag. Fixes: c850e31f79f0 ("wifi: mac80211: add internal handler for wake_tx_queue") Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20221230121850.218810-1-alexander@wetzel-home.de Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit e66b7920aa5ac5b1a1997a454004ba9246a3c005 Author: Felix Fietkau Date: Fri Dec 30 21:07:47 2022 +0100 wifi: mac80211: fix initialization of rx->link and rx->link_sta There are some codepaths that do not initialize rx->link_sta properly. This causes a crash in places which assume that rx->link_sta is valid if rx->sta is valid. One known instance is triggered by __ieee80211_rx_h_amsdu being called from fast-rx. It results in a crash like this one: BUG: kernel NULL pointer dereference, address: 00000000000000a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3 Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014 RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211] Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48 83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0 11 00 00 8d 50 fd 83 fa 01 RSP: 0018:ffff999040803b10 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900 R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000 FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0 Call Trace: __ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211] ? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ? __local_bh_enable_ip+0x3b/0xa0 ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ? prepare_transfer+0x109/0x1a0 [xhci_hcd] ieee80211_rx_list+0xa80/0xda0 [mac80211] mt76_rx_complete+0x207/0x2e0 [mt76] mt76_rx_poll_complete+0x357/0x5a0 [mt76] mt76u_rx_worker+0x4f5/0x600 [mt76_usb] ? mt76_get_min_avg_rssi+0x140/0x140 [mt76] __mt76_worker_fn+0x50/0x80 [mt76] kthread+0xed/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Since the initialization of rx->link and rx->link_sta is rather convoluted and duplicated in many places, clean it up by using a helper function to set it. Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling") Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20221230200747.19040-1-nbd@nbd.name [remove unnecessary rx->sta->sta.mlo check] Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg commit 7c6dd961d0c8e7e8f9fdc65071fb09ece702e18d Author: Peter Zijlstra Date: Tue Jan 10 12:15:40 2023 +0100 x86/boot: Avoid using Intel mnemonics in AT&T syntax asm With 'GNU assembler (GNU Binutils for Debian) 2.39.90.20221231' the build now reports: arch/x86/realmode/rm/../../boot/bioscall.S: Assembler messages: arch/x86/realmode/rm/../../boot/bioscall.S:35: Warning: found `movsd'; assuming `movsl' was meant arch/x86/realmode/rm/../../boot/bioscall.S:70: Warning: found `movsd'; assuming `movsl' was meant arch/x86/boot/bioscall.S: Assembler messages: arch/x86/boot/bioscall.S:35: Warning: found `movsd'; assuming `movsl' was meant arch/x86/boot/bioscall.S:70: Warning: found `movsd'; assuming `movsl' was meant Which is due to: PR gas/29525 Note that with the dropped CMPSD and MOVSD Intel Syntax string insn templates taking operands, mixed IsString/non-IsString template groups (with memory operands) cannot occur anymore. With that maybe_adjust_templates() becomes unnecessary (and is hence being removed). More details: https://sourceware.org/bugzilla/show_bug.cgi?id=29525 Borislav Petkov further explains: " the particular problem here is is that the 'd' suffix is "conflicting" in the sense that you can have SSE mnemonics like movsD %xmm... and the same thing also for string ops (which is the case here) so apparently the agreement in binutils land is to use the always accepted suffixes 'l' or 'q' and phase out 'd' slowly... " Fixes: 7a734e7dd93b ("x86, setup: "glove box" BIOS calls -- infrastructure") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/Y71I3Ex2pvIxMpsP@hirez.programming.kicks-ass.net commit 40c18f363a0806d4f566e8a9a9bd2d7766a72cf5 Merge: 526970be53d5d 83dcedd5540d4 Author: Linus Torvalds Date: Tue Jan 10 05:34:13 2023 -0600 Merge tag '6.2-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmb server fixes from Steve French: - fix possible infinite loop in socket handler - fix possible panic in ntlmv2 authentication - fix error handling on tree connect * tag '6.2-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix infinite loop in ksmbd_conn_handler_loop() ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob ksmbd: send proper error response in smb2_tree_connect() commit 526970be53d5dd60122141540142fb0eeb0b22d8 Author: Peter Zijlstra Date: Tue Jan 10 11:44:51 2023 +0100 sh/mm: Fix pmd_t for real Because typing is hard... Fixes: 0862ff059c9e ("sh/mm: Make pmd_t similar to pte_t") Reported-by: Guenter Roeck Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Linus Torvalds commit 3bd68b32c911a3a610ad782bb04d1a7bfc440638 Author: Christian König Date: Mon Jan 9 09:06:03 2023 +0100 drm/amdgpu: fix pipeline sync v2 This fixes a potential memory leak of dma_fence objects in the CS code as well as glitches in firefox because of missing pipeline sync. v2: use the scheduler instead of the fence context Signed-off-by: Christian König Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2323 Tested-by: Michal Kubecek mkubecek@suse.cz Tested-by: Vlastimil Babka Acked-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230109130120.73389-1-christian.koenig@amd.com commit b3deec25847bda34e34d5d7be02f633caf000bd8 Author: Dean Luick Date: Mon Jan 9 12:31:31 2023 -0500 IB/hfi1: Remove user expected buffer invalidate race During setup, there is a possible race between a page invalidate and hardware programming. Add a covering invalidate over the user target range during setup. If anything within that range is invalidated during setup, fail the setup. Once set up, each TID will have its own invalidate callback and invalidate. Fixes: 3889551db212 ("RDMA/hfi1: Use mmu_interval_notifier_insert for user_exp_rcv") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167328549178.1472310.9867497376936699488.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 1c7edde1b5720ddb0aff5ca8c7f605a0f92526eb Author: Dean Luick Date: Mon Jan 9 12:31:26 2023 -0500 IB/hfi1: Immediately remove invalid memory from hardware When a user expected receive page is unmapped, it should be immediately removed from hardware rather than depend on a reaction from user space. Fixes: 2677a7680e77 ("IB/hfi1: Fix memory leak during unexpected shutdown") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167328548663.1472310.7871808081861622659.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit e0c4a422f5246abefbf7c178ef99a1f2dc3c5f62 Author: Dean Luick Date: Mon Jan 9 12:31:21 2023 -0500 IB/hfi1: Fix expected receive setup error exit issues Fix three error exit issues in expected receive setup. Re-arrange error exits to increase readability. Issues and fixes: 1. Possible missed page unpin if tidlist copyout fails and not all pinned pages where made part of a TID. Fix: Unpin the unused pages. 2. Return success with unset return values tidcnt and length when no pages were pinned. Fix: Return -ENOSPC if no pages were pinned. 3. Return success with unset return values tidcnt and length when no rcvarray entries available. Fix: Return -ENOSPC if no rcvarray entries are available. Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167328548150.1472310.1492305874804187634.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit ecf91551cdd2925ed6d9a9d99074fa5f67b90596 Author: Dean Luick Date: Mon Jan 9 12:31:16 2023 -0500 IB/hfi1: Reserve user expected TIDs To avoid a race, reserve the number of user expected TIDs before setup. Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167328547636.1472310.7419712824785353905.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 0a0a6e80472c98947d73c3d13bcd7d101895f55d Author: Dean Luick Date: Mon Jan 9 12:31:11 2023 -0500 IB/hfi1: Reject a zero-length user expected buffer A zero length user buffer makes no sense and the code does not handle it correctly. Instead, reject a zero length as invalid. Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/167328547120.1472310.6362802432127399257.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 0afec5e9cea732cb47014655685a2a47fb180c31 Author: Yonatan Nachum Date: Mon Jan 9 13:37:11 2023 +0000 RDMA/core: Fix ib block iterator counter overflow When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry to smaller, aligned to the selected page size, DMA blocks. In given circumstances where the sg entry and page size fit certain sizes and the sg entry is not aligned to the selected page size, the total size of the aligned pages we need to cover the sg entry is >= 4GB. Under this circumstances, while iterating page aligned blocks, the counter responsible for counting how much we advanced from the start of the sg entry is overflowed because its type is u32 and we pass 4GB in size. This can lead to an infinite loop inside the iterator function because the overflow prevents the counter to be larger than the size of the sg entry. Fix the presented problem by changing the advancement condition to eliminate overflow. Backtrace: [ 192.374329] efa_reg_user_mr_dmabuf [ 192.376783] efa_register_mr [ 192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000 [ 192.386423] pg_sz [0x80000000] umem_length[0xc0000000] [ 192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3 [ 192.399559] hp_cnt[3], pages_in_hp[524288] [ 192.403690] umem->sgt_append.sgt.nents[1] [ 192.407905] number entries: [1], pg_bit: [31] [ 192.411397] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.415601] biter->__sg_advance [665837568] sg_dma_len[3221225472] [ 192.419823] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.423976] biter->__sg_advance [2813321216] sg_dma_len[3221225472] [ 192.428243] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.432397] biter->__sg_advance [665837568] sg_dma_len[3221225472] Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") Signed-off-by: Yonatan Nachum Link: https://lore.kernel.org/r/20230109133711.13678-1-ynachum@amazon.com Signed-off-by: Leon Romanovsky commit 53da7aec32982f5ee775b69dce06d63992ce4af3 Author: Hariprasad Kelam Date: Mon Jan 9 11:43:25 2023 +0530 octeontx2-pf: Fix resource leakage in VF driver unbind resources allocated like mcam entries to support the Ntuple feature and hash tables for the tc feature are not getting freed in driver unbind. This patch fixes the issue. Fixes: 2da489432747 ("octeontx2-pf: devlink params support to set mcam entry count") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Link: https://lore.kernel.org/r/20230109061325.21395-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 80502ffab2fa92ba9777e381efea2efddc348d13 Author: Chris Packham Date: Thu Dec 15 15:54:02 2022 +1300 arm64: dts: marvell: AC5/AC5X: Fix address for UART1 The correct address offset is 0x12100. Fixes: 31be791e26cf ("arm64: dts: marvell: Add UART1-3 for AC5/AC5X") Signed-off-by: Chris Packham Signed-off-by: Gregory CLEMENT commit 74cf679547d6b735666f2ab41ea7c62b447c9692 Merge: 2ea26b4de6f42 d68ff8ad3351b Author: Paolo Abeni Date: Tue Jan 10 10:13:52 2023 +0100 Merge branch 'selftests-net-isolate-l2_tos_ttl_inherit-sh-in-its-own-netns' Guillaume Nault says: ==================== selftests/net: Isolate l2_tos_ttl_inherit.sh in its own netns. l2_tos_ttl_inherit.sh uses a veth pair to run its tests, but only one of the veth interfaces runs in a dedicated netns. The other one remains in the initial namespace where the existing network configuration can interfere with the setup used for the tests. Isolate both veth devices in their own netns and ensure everything gets cleaned up when the script exits. Link: https://lore.kernel.org/netdev/924f1062-ab59-9b88-3b43-c44e73a30387@alu.unizg.hr/ ==================== Link: https://lore.kernel.org/r/cover.1673191942.git.gnault@redhat.com Signed-off-by: Paolo Abeni commit d68ff8ad3351b8fc8d6f14b9a4f5cc8ba3e8bd13 Author: Guillaume Nault Date: Sun Jan 8 16:45:50 2023 +0100 selftests/net: l2_tos_ttl_inherit.sh: Ensure environment cleanup on failure. Use 'set -e' and an exit handler to stop the script if a command fails and ensure the test environment is cleaned up in any case. Also, handle the case where the script is interrupted by SIGINT. The only command that's expected to fail is 'wait $ping_pid', since it's killed by the script. Handle this case with '|| true' to make it play well with 'set -e'. Finally, return the Kselftest SKIP code (4) when the script breaks because of an environment problem or a command line failure. The 0 and 1 return codes should now reliably indicate that all tests have been run (0: all tests run and passed, 1: all tests run but at least one failed, 4: test script didn't run completely). Fixes: b690842d12fd ("selftests/net: test l2 tunnel TOS/TTL inheriting") Reported-by: Mirsad Goran Todorovac Tested-by: Mirsad Goran Todorovac Signed-off-by: Guillaume Nault Signed-off-by: Paolo Abeni commit c53cb00f7983a5474f2d36967f84908b85af9159 Author: Guillaume Nault Date: Sun Jan 8 16:45:46 2023 +0100 selftests/net: l2_tos_ttl_inherit.sh: Run tests in their own netns. This selftest currently runs half in the current namespace and half in a netns of its own. Therefore, the test can fail if the current namespace is already configured with incompatible parameters (for example if it already has a veth0 interface). Adapt the script to put both ends of the veth pair in their own netns. Now veth0 is created in NS0 instead of the current namespace, while veth1 is set up in NS1 (instead of the 'testing' netns). The user visible netns names are randomised to minimise the risk of conflicts with already existing namespaces. The cleanup() function doesn't need to remove the virtual interface anymore: deleting NS0 and NS1 automatically removes the virtual interfaces they contained. We can remove $ns, which was only used to run ip commands in the 'testing' netns (let's use the builtin "-netns" option instead). However, we still need a similar functionality as ping and tcpdump now need to run in NS0. So we now have $RUN_NS0 for that. Fixes: b690842d12fd ("selftests/net: test l2 tunnel TOS/TTL inheriting") Reported-by: Mirsad Goran Todorovac Tested-by: Mirsad Goran Todorovac Signed-off-by: Guillaume Nault Signed-off-by: Paolo Abeni commit e59370b2e96eb8e7e057a2a16e999ff385a3f2fb Author: Guillaume Nault Date: Sun Jan 8 16:45:41 2023 +0100 selftests/net: l2_tos_ttl_inherit.sh: Set IPv6 addresses with "nodad". The ping command can run before DAD completes. In that case, ping may fail and break the selftest. We don't need DAD here since we're working on isolated device pairs. Fixes: b690842d12fd ("selftests/net: test l2 tunnel TOS/TTL inheriting") Signed-off-by: Guillaume Nault Signed-off-by: Paolo Abeni commit 12724ba38992bd045e92a9a88a868a530f89d13e Author: Gao Xiang Date: Tue Jan 10 15:49:27 2023 +0800 erofs: fix kvcalloc() misuse with __GFP_NOFAIL As reported by syzbot [1], kvcalloc() cannot work with __GFP_NOFAIL. Let's use kcalloc() instead. [1] https://lore.kernel.org/r/0000000000007796bd05f1852ec2@google.com Reported-by: syzbot+c3729cda01706a04fb98@syzkaller.appspotmail.com Fixes: fe3e5914e6dc ("erofs: try to leave (de)compressed_pages on stack if possible") Fixes: 4f05687fd703 ("erofs: introduce struct z_erofs_decompress_backend") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230110074927.41651-1-hsiangkao@linux.alibaba.com commit 6acd87d50998ef0afafc441613aeaf5a8f5c9eff Author: Siddh Raman Pant Date: Fri Dec 9 15:51:51 2022 +0530 erofs/zmap.c: Fix incorrect offset calculation Effective offset to add to length was being incorrectly calculated, which resulted in iomap->length being set to 0, triggering a WARN_ON in iomap_iter_done(). Fix that, and describe it in comments. This was reported as a crash by syzbot under an issue about a warning encountered in iomap_iter_done(), but unrelated to erofs. C reproducer: https://syzkaller.appspot.com/text?tag=ReproC&x=1037a6b2880000 Kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e2021a61197ebe02 Dashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6 Reported-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com Suggested-by: Gao Xiang Signed-off-by: Siddh Raman Pant Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20221209102151.311049-1-code@siddh.me Signed-off-by: Gao Xiang commit de1ccb9e61728dd941fe0e955a7a129418657267 Author: Adrian Chan Date: Mon Jan 9 16:05:20 2023 -0500 ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list Add the 'HP Engage Flex Mini' device to the force connect list to enable audio through HDMI. Signed-off-by: Adrian Chan Cc: Link: https://lore.kernel.org/r/20230109210520.16060-1-adchan@google.com Signed-off-by: Takashi Iwai commit c7c0644ead24c59cc5e0f2ff0ade89b21783614a Author: Russell King (Oracle) Date: Tue Jan 3 17:02:05 2023 +0000 MAINTAINERS: stop nvme matching for nvmem files The nvme patterns detect all include files starting with nvme, which also picks up the nvmem subsystem header files. Fix this by using a more specific pattern. Signed-off-by: Russell King (Oracle) [hch: switched to a purely inclusive pattern instead of excluding nvmem*] Signed-off-by: Christoph Hellwig commit 313c08c72ee7f87c54e34baec5cc4f4005e8800d Author: Christoph Hellwig Date: Sun Jan 8 07:56:54 2023 +0100 nvme: don't allow unprivileged passthrough on partitions Passthrough commands can always access the entire device, and thus submitting them on partitions is an privelege escalation. In hindsight we should have never allowed any passthrough commands on partitions, but it's probably too late to change that decision now. Fixes: e4fbcf32c860 ("nvme: identify-namespace without CAP_SYS_ADMIN") Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni commit 7b7fdb8e2dbc15ad4e81a328f1c60d1691c6d6be Author: Christoph Hellwig Date: Sun Jan 8 07:53:03 2023 +0100 nvme: replace the "bool vec" arguments with flags in the ioctl path To prepare for passing down more information, replace the boolean vec argument with a more extensible flags one. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni commit 2fa1dc8637b5f3397f22b2771f8a4fb8712c10dc Author: Christoph Hellwig Date: Sun Jan 8 07:45:30 2023 +0100 nvme: remove __nvme_ioctl Open code __nvme_ioctl in the two callers to make future changes that pass down additional paramters in the ioctl path easier. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni commit 09113abfb6ba981cb7cb4960b230251afd8966dc Author: Tong Zhang Date: Thu Dec 29 10:37:31 2022 -0800 nvme-pci: fix error handling in nvme_pci_enable() There are two issues in nvme_pci_enable(): 1) If pci_alloc_irq_vectors() fails, device is left enabled. Fix this by adding a goto disable statement. 2) nvme_pci_configure_admin_queue could return -ENODEV, in this case, we will need to free IRQ properly. Otherwise the following warning could be triggered: [ 5.286752] WARNING: CPU: 0 PID: 33 at kernel/irq/irqdomain.c:253 irq_domain_remove+0x12d/0x140 [ 5.290547] Call Trace: [ 5.290626] [ 5.290695] msi_remove_device_irq_domain+0xc9/0xf0 [ 5.290843] msi_device_data_release+0x15/0x80 [ 5.290978] release_nodes+0x58/0x90 [ 5.293788] WARNING: CPU: 0 PID: 33 at kernel/irq/msi.c:276 msi_device_data_release+0x76/0x80 [ 5.297573] Call Trace: [ 5.297651] [ 5.297719] release_nodes+0x58/0x90 [ 5.297831] devres_release_all+0xef/0x140 [ 5.298339] device_unbind_cleanup+0x11/0xc0 [ 5.298479] really_probe+0x296/0x320 Fixes: a6ee7f19ebfd ("nvme-pci: call nvme_pci_configure_admin_queue from nvme_pci_enable") Co-developed-by: Keith Busch Signed-off-by: Tong Zhang Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 453116a441f0e556fe8900c99a632529e48f18c9 Author: Hector Martin Date: Wed Jan 4 19:16:42 2023 +0900 nvme-pci: add NVME_QUIRK_IDENTIFY_CNS quirk to Apple T2 controllers This mirrors the quirk added to Apple Silicon controllers in apple.c. These controllers do not support the Active NS ID List command and behave identically to the SoC version judging by existing user reports/syslogs, so will need the same fix. This quirk reverts back to NVMe 1.0 behavior and disables the broken commands. Fixes: 811f4de0344d ("nvme: avoid fallback to sequential scan due to transient issues") Signed-off-by: Hector Martin Tested-by: Orlando Chamberlain Signed-off-by: Christoph Hellwig commit aa96d6aa7563ec2948195d1f5892cb7a2caa88e3 Author: Hector Martin Date: Wed Jan 4 18:21:49 2023 +0900 nvme-apple: add NVME_QUIRK_IDENTIFY_CNS quirk to fix regression From the get-go, this driver and the ANS syslog have been complaining about namespace identification. In 6.2-rc1, commit 811f4de0344d ("nvme: avoid fallback to sequential scan due to transient issues") regressed the driver by no longer allowing fallback to sequential namespace scans, leaving us with no namespaces. It turns out that the real problem is that this controller claiming NVMe 1.1 compat is treating the CNS field as a binary field, as in NVMe 1.0. This already has a quirk, NVME_QUIRK_IDENTIFY_CNS, so set it for the controller to fix all this nonsense (including other errors triggered by other CNS commands). Fixes: 811f4de0344d ("nvme: avoid fallback to sequential scan due to transient issues") Fixes: 5bd2927aceba ("nvme-apple: Add initial Apple SoC NVMe driver") Signed-off-by: Hector Martin Reviewed-by: Sven Peter Signed-off-by: Christoph Hellwig commit 9828994ac492e8e7de47fe66097b7e665328f348 Author: Emeel Hakim Date: Sun Dec 11 13:22:23 2022 +0200 net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY) Upon updating MAC security entity (SecY) in hw offload path, the macsec security association (SA) initialization routine is called. In case of extended packet number (epn) is enabled the salt and ssci attributes are retrieved using the MACsec driver rx_sa context which is unavailable when updating a SecY property such as encoding-sa hence the null dereference. Fix by using the provided SA to set those attributes. Fixes: 4411a6c0abd3 ("net/mlx5e: Support MACsec offload extended packet number (EPN)") Signed-off-by: Emeel Hakim Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit f5e1ed04aa2ea665a796f0109091ca3f2b01024a Author: Emeel Hakim Date: Wed Dec 14 16:34:13 2022 +0200 net/mlx5e: Fix macsec ssci attribute handling in offload path Currently when macsec offload is set with extended packet number (epn) enabled, the driver wrongly deduce the short secure channel identifier (ssci) from the salt instead of the stand alone ssci attribute as it should, consequently creating a mismatch between the kernel and driver's ssci values. Fix by using the ssci value from the relevant attribute. Fixes: 4411a6c0abd3 ("net/mlx5e: Support MACsec offload extended packet number (EPN)") Signed-off-by: Emeel Hakim Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit cd4f186dc110a0f0b3484048b8ecd42ee006ca6d Author: Shay Drory Date: Thu Dec 15 15:33:38 2022 +0200 net/mlx5: E-switch, Coverity: overlapping copy When a capability is set via port function caps callbacks, a memcpy() is performed in which the source and the target are the same address, e.g.: the copy is redundant. Hence, Remove it. Discovered by Coverity. Fixes: 7db98396ef45 ("net/mlx5: E-Switch, Implement devlink port function cmds to control RoCE") Fixes: e5b9642a33be ("net/mlx5: E-Switch, Implement devlink port function cmds to control migratable") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit d515d63cae2cd186acf40deaa8ef33067bb7f637 Author: Gavin Li Date: Tue Dec 27 04:54:09 2022 +0200 net/mlx5e: Don't support encap rules with gbp option Previously, encap rules with gbp option would be offloaded by mistake but driver does not support gbp option offload. To fix this issue, check if the encap rule has gbp option and don't offload the rule Fixes: d8f9dfae49ce ("net: sched: allow flower to match vxlan options") Signed-off-by: Gavin Li Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit fe91d57277eef8bb4aca05acfa337b4a51d0bba4 Author: Rahul Rameshbabu Date: Mon Dec 5 14:26:09 2022 -0800 net/mlx5: Fix ptp max frequency adjustment range .max_adj of ptp_clock_info acts as an absolute value for the amount in ppb that can be set for a single call of .adjfine. This means that a single call to .getfine cannot be greater than .max_adj or less than -(.max_adj). Provides correct value for max frequency adjustment value supported by devices. Fixes: 3d8c38af1493 ("net/mlx5e: Add PTP Hardware Clock (PHC) support") Signed-off-by: Rahul Rameshbabu Reviewed-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 3099d2e62f9061ed57798e68e285d35837be686f Author: Aya Levin Date: Sun Jan 8 12:53:02 2023 +0200 net/mlx5e: Fix memory leak on updating vport counters When updating statistics driver queries the vport's counters. On fail, add error path releasing the allocated buffer avoiding memory leak. Fixes: 64b68e369649 ("net/mlx5: Refactor and expand rep vport stat group") Signed-off-by: Aya Levin Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit c09502d54dc109530ccb9a8910ab286d0745f119 Author: Oz Shlomo Date: Thu Dec 8 08:31:48 2022 +0000 net/mlx5e: TC, Restore pkt rate policing support The offending commit removed the support for all packet rate metering. Restore the pkt rate metering support by removing the restriction. Fixes: 3603f26633e7 ("net/mlx5e: TC, allow meter jump control action") Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 2414c9b7a29d237c9c40abd62853dbc08b4ba7df Author: Oz Shlomo Date: Wed Dec 7 11:05:02 2022 +0000 net/mlx5e: TC, ignore match level for post meter rules The post meter table only matches on reg_c5. As such, the inner/outer match levels are irrelevant for the match critieria. The cited patch only sets the outer criteria to none, thus setting the inner match level for encapsulated packets. This caused rules with police action on tunnel devices to not find an existing flow group for the match criteria, thus failing to offload the rule. Set both the inner and outer match levels to none for post_meter rules. Fixes: 0d8c38d44f33 ("net/mlx5e: TC, init post meter rules with branching attributes") Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit b5e23931c45a2f99f60a2f2b98a9e4d5a62a5b13 Author: Dragos Tatulea Date: Wed Nov 23 16:59:13 2022 +0200 net/mlx5e: IPoIB, Fix child PKEY interface stats on rx path The current code always does the accounting using the stats from the parent interface (linked in the rq). This doesn't work when there are child interfaces configured. Fix this behavior by always using the stats from the child interface priv. This will also work for parent only interfaces: the child (netdev) and parent netdev (rq->netdev) will point to the same thing. Fixes: be98737a4faa ("net/mlx5e: Use dynamic per-channel allocations in stats") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 31c70bfe58ef09fe36327ddcced9143a16e9e83d Author: Dragos Tatulea Date: Fri Nov 25 17:51:19 2022 +0200 net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child interface uses the parent receive channels. Although the child shares the parent's receive channels, the number of rx queues is important for the channel_stats array: the parent's rx channel index is used to access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size for the counting to work correctly and to prevent out of bound accesses. This patch checks for the mentioned scenario and returns an error when trying to create the interface. The error is propagated to the user. Fixes: be98737a4faa ("net/mlx5e: Use dynamic per-channel allocations in stats") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 806a8df7126a8c05d60411eeb81057c2a8bbe7a7 Author: Dragos Tatulea Date: Thu Dec 15 13:02:38 2022 +0200 net/mlx5e: IPoIB, Block queue count configuration when sub interfaces are present PKEY sub interfaces share the receive queues with the parent interface. While setting the sub interface queue count is not supported, it is currently possible to change the number of queues of the parent interface. Thus we can end up with inconsistent queue sizes between the parent and its sub interfaces. This change disallows setting the queue count on the parent interface when sub interfaces are present. This is achieved by introducing an explicit reference to the parent netdev in the mlx5i_priv of the child interface. An additional counter is also required on the parent side to detect when sub interfaces are attached and for proper cleanup. The rtnl lock is taken during the ethtool op and the sub interface ndo_init/uninit ops. There is no race here around counting the sub interfaces, reading the sub interfaces and setting the number of channels. The ASSERT_RTNL was added to document that. Fixes: be98737a4faa ("net/mlx5e: Use dynamic per-channel allocations in stats") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit ab4b01bfdaa69492fb36484026b0a0f0af02d75a Author: Roy Novich Date: Wed Jan 4 11:16:21 2023 +0200 net/mlx5e: Verify dev is present for fix features ndo The native NIC port net device instance is being used as Uplink representor. While changing profiles private resources are not available, fix features ndo does not check if the netdev is present. Add driver protection to verify private resources are ready. Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Roy Novich Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit da2e552b469a0cd130ff70a88ccc4139da428a65 Author: Moshe Shemesh Date: Mon Nov 28 19:05:47 2022 +0200 net/mlx5: Fix command stats access after free Command may fail while driver is reloading and can't accept FW commands till command interface is reinitialized. Such command failure is being logged to command stats. This results in NULL pointer access as command stats structure is being freed and reallocated during mlx5 devlink reload (see kernel log below). Fix it by making command stats statically allocated on driver probe. Kernel log: [ 2394.808802] BUG: unable to handle kernel paging request at 000000000002a9c0 [ 2394.810610] PGD 0 P4D 0 [ 2394.811811] Oops: 0002 [#1] SMP NOPTI ... [ 2394.815482] RIP: 0010:native_queued_spin_lock_slowpath+0x183/0x1d0 ... [ 2394.829505] Call Trace: [ 2394.830667] _raw_spin_lock_irq+0x23/0x26 [ 2394.831858] cmd_status_err+0x55/0x110 [mlx5_core] [ 2394.833020] mlx5_access_reg+0xe7/0x150 [mlx5_core] [ 2394.834175] mlx5_query_port_ptys+0x78/0xa0 [mlx5_core] [ 2394.835337] mlx5e_ethtool_get_link_ksettings+0x74/0x590 [mlx5_core] [ 2394.836454] ? kmem_cache_alloc_trace+0x140/0x1c0 [ 2394.837562] __rh_call_get_link_ksettings+0x33/0x100 [ 2394.838663] ? __rtnl_unlock+0x25/0x50 [ 2394.839755] __ethtool_get_link_ksettings+0x72/0x150 [ 2394.840862] duplex_show+0x6e/0xc0 [ 2394.841963] dev_attr_show+0x1c/0x40 [ 2394.843048] sysfs_kf_seq_show+0x9b/0x100 [ 2394.844123] seq_read+0x153/0x410 [ 2394.845187] vfs_read+0x91/0x140 [ 2394.846226] ksys_read+0x4f/0xb0 [ 2394.847234] do_syscall_64+0x5b/0x1a0 [ 2394.848228] entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: 34f46ae0d4b3 ("net/mlx5: Add command failures data to debugfs") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 5e72f3f1c558019082cfeedeed73748f35d780c6 Author: Ariel Levkovich Date: Tue Aug 30 00:32:30 2022 +0300 net/mlx5e: TC, Keep mod hdr actions after mod hdr alloc When offloading TC NIC rule which has mod_hdr action, the mod_hdr actions list is freed upon mod_hdr allocation. In the new format of handling multi table actions and CT in particular, the mod_hdr actions list is still relevant when setting the pre and post rules and therefore, freeing the list may cause adding rules which don't set the FTE_ID. Therefore, the mod_hdr actions list needs to be kept for the pre/post flows as well and should be left for these handler to be freed. Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Ariel Levkovich Signed-off-by: Saeed Mahameed commit e0bf81bf0d3d4747c146e0bf44774d3d881d7137 Author: Ariel Levkovich Date: Tue Aug 16 23:19:11 2022 +0300 net/mlx5: check attr pointer validity before dereferencing it Fix attr pointer validity checks after it was already dereferenced. Fixes: cb0d54cbf948 ("net/mlx5e: Fix wrong source vport matching on tunnel rule") Signed-off-by: Ariel Levkovich Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Saeed Mahameed commit 17b3222e943701c408d6e03357967829aaea0550 Author: Yevgeny Kliteynik Date: Sun Nov 13 00:04:17 2022 +0200 net/mlx5: DR, Fix 'stack frame size exceeds limit' error in dr_rule If the kernel configuration asks the compiler to check frame limit of 1K, dr_rule_create_rule_nic exceed this limit: "stack frame size (1184) exceeds limit (1024)" Fixing this issue by checking configured frame limit and using the optimization STE array only for cases with the usual 2K (or larger) stack size warning. Fixes: b9b81e1e9382 ("net/mlx5: DR, For short chains of STEs, avoid allocating ste_arr dynamically") Reported-by: kernel test robot Signed-off-by: Yevgeny Kliteynik commit 2ea26b4de6f42b74a5f1701de41efa6bc9f12666 Author: Heiner Kallweit Date: Sun Jan 8 20:37:53 2023 +0100 Revert "r8169: disable detection of chip version 36" This reverts commit 42666b2c452ce87894786aae05e3fad3cfc6cb59. This chip version seems to be very rare, but it exits in consumer devices, see linked report. Link: https://stackoverflow.com/questions/75049473/cant-setup-a-wired-network-in-archlinux-fresh-install Fixes: 42666b2c452c ("r8169: disable detection of chip version 36") Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/42e9674c-d5d0-a65a-f578-e5c74f244739@gmail.com Signed-off-by: Jakub Kicinski commit 08f0adb193c008de640fde34a2e00a666c01d77c Author: Miles Chen Date: Tue Jan 10 11:12:52 2023 +0800 cpufreq: armada-37xx: stop using 0 as NULL pointer Use NULL for NULL pointer to fix the following sparse warning: drivers/cpufreq/armada-37xx-cpufreq.c:448:32: sparse: warning: Using plain integer as NULL pointer Signed-off-by: Miles Chen Signed-off-by: Viresh Kumar commit e7895f017b79410bf4591396a733b876dc1e0e9d Author: Paul Moore Date: Fri Jan 6 10:44:00 2023 -0500 bpf: remove the do_idr_lock parameter from bpf_prog_free_id() It was determined that the do_idr_lock parameter to bpf_prog_free_id() was not necessary as it should always be true. Suggested-by: Stanislav Fomichev Signed-off-by: Paul Moore Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230106154400.74211-2-paul@paul-moore.com Signed-off-by: Alexei Starovoitov commit ef01f4e25c1760920e2c94f1c232350277ace69b Author: Paul Moore Date: Fri Jan 6 10:43:59 2023 -0500 bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD When changing the ebpf program put() routines to support being called from within IRQ context the program ID was reset to zero prior to calling the perf event and audit UNLOAD record generators, which resulted in problems as the ebpf program ID was bogus (always zero). This patch addresses this problem by removing an unnecessary call to bpf_prog_free_id() in __bpf_prog_offload_destroy() and adjusting __bpf_prog_put() to only call bpf_prog_free_id() after audit and perf have finished their bpf program unload tasks in bpf_prog_put_deferred(). For the record, no one can determine, or remember, why it was necessary to free the program ID, and remove it from the IDR, prior to executing bpf_prog_put_deferred(); regardless, both Stanislav and Alexei agree that the approach in this patch should be safe. It is worth noting that when moving the bpf_prog_free_id() call, the do_idr_lock parameter was forced to true as the ebpf devs determined this was the correct as the do_idr_lock should always be true. The do_idr_lock parameter will be removed in a follow-up patch, but it was kept here to keep the patch small in an effort to ease any stable backports. I also modified the bpf_audit_prog() logic used to associate the AUDIT_BPF record with other associated records, e.g. @ctx != NULL. Instead of keying off the operation, it now keys off the execution context, e.g. '!in_irg && !irqs_disabled()', which is much more appropriate and should help better connect the UNLOAD operations with the associated audit state (other audit records). Cc: stable@vger.kernel.org Fixes: d809e134be7a ("bpf: Prepare bpf_prog_put() to be called from irq context.") Reported-by: Burn Alting Reported-by: Jiri Olsa Suggested-by: Stanislav Fomichev Suggested-by: Alexei Starovoitov Signed-off-by: Paul Moore Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230106154400.74211-1-paul@paul-moore.com Signed-off-by: Alexei Starovoitov commit 9e17f99220d111ea031b44153fdfe364b0024ff2 Author: Ido Schimmel Date: Sat Jan 7 19:10:04 2023 +0200 net/sched: act_mpls: Fix warning during failed attribute validation The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above 'struct nla_policy': " Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN: NLA_BINARY Validation function called for the attribute. All other Unused - but note that it's a union " This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32' type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate' field. Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function. No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0 [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace: __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Link: https://lore.kernel.org/netdev/CAO4mrfdmjvRUNbDyP0R03_DrD_eFCLCguz6OxZ2TYRSv0K9gxA@mail.gmail.com/ Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC") Reported-by: Wei Chen Tested-by: Wei Chen Signed-off-by: Ido Schimmel Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230107171004.608436-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit a309c7194e8a2f8bd4539b9449917913f6c2cd50 Author: Zack Rusin Date: Wed Dec 7 12:29:07 2022 -0500 drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources. Fixes: e14c02e6b699 ("drm/vmwgfx: Look up objects without taking a reference") Signed-off-by: Zack Rusin Reviewed-by: Martin Krastev Reviewed-by: Maaz Mombasawala Link: https://patchwork.freedesktop.org/patch/msgid/20221207172907.959037-1-zack@kde.org commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e Author: Rob Clark Date: Fri Dec 16 15:33:55 2022 -0800 drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object. Signed-off-by: Rob Clark Reviewed-by: Chia-I Wu Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20221216233355.542197-2-robdclark@gmail.com commit 5a41237ad1d4b62008f93163af1d9b1da90729d8 Author: Linus Torvalds Date: Mon Jan 9 17:04:49 2023 -0600 gcc: disable -Warray-bounds for gcc-11 too We had already disabled this warning for gcc-12 due to bugs in the value range analysis, but it turns out we end up having some similar problems with gcc-11.3 too, so let's disable it there too. Older gcc versions end up being increasingly less relevant, and hopefully clang and newer version of gcc (ie gcc-13) end up working reliably enough that we still get the build coverage even when we disable this for some versions. Link: https://lore.kernel.org/all/20221227002941.GA2691687@roeck-us.net/ Link: https://lore.kernel.org/all/D8BDBF66-E44C-45D4-9758-BAAA4F0C1998@kernel.org/ Cc: Kees Cook Cc: Vlastimil Babka Cc: Guenter Roeck Signed-off-by: Linus Torvalds commit febb985c06cb6f5fac63598c0bffd4fd823d110d Author: Jens Axboe Date: Mon Jan 9 14:46:10 2023 -0700 io_uring/poll: add hash if ready poll request can't complete inline If we don't, then we may lose access to it completely, leading to a request leak. This will eventually stall the ring exit process as well. Cc: stable@vger.kernel.org Fixes: 49f1c68e048f ("io_uring: optimise submission side poll_refs") Reported-and-tested-by: syzbot+6c95df01470a47fc3af4@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/0000000000009f829805f1ce87b2@google.com/ Suggested-by: Pavel Begunkov Signed-off-by: Jens Axboe commit daec8b54e9445566d003ac46e267e73755b5f55a Author: Alexandre Belloni Date: Mon Dec 12 14:59:52 2022 +0100 ARM: footbridge: drop unnecessary inclusion isa-rtc.c doesn't use any definition from bcd.h, remove its inclusion Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20221212135953.212303-1-alexandre.belloni@bootlin.com Signed-off-by: Arnd Bergmann commit 33abcaef9888080af73a803d52199c4f45990948 Merge: 97bcdf24e0007 490748874ebf1 Author: Arnd Bergmann Date: Mon Jan 9 23:16:38 2023 +0100 Merge tag 'imx-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.2: - Fix i.MX8MP DT for missing GPC Interrupt, power-domain typo and USB clock error. - Fix mach-imx cpu code to add missing of_node_put() call. - A couple of verdin-imx8mm DT fixes for audio playback support. - Fix pca9547 i2c-mux node name for i.MX and Vybrid device trees. - Fix an imx93-11x11-evk uSDHC pad setting problem that causes Micron eMMC CMD8 CRC error in HS400ES/HS400 mode. - A couple of imx8mp-blk-ctrl driver fixes from Lucas Stach, enabling pixclk with HDMI_TX_PHY PD, dropping power device name setting. - Fix the error check for of_clk_get_by_name() in soc-imx8m driver. - Other various DT fixes and cleanups. * tag 'imx-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (22 commits) soc: imx8m: Fix incorrect check for of_clk_get_by_name() arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity arm64: dts: imx8mp-evk: pcie0-refclk cosmetic cleanup arm64: dts: imx8mp: Fix power-domain typo arm64: dts: imx8mp: Fix missing GPC Interrupt soc: imx: imx8mp-blk-ctrl: don't set power device name arm64: dts: imx8mm: Drop xtal clock specifier from eDM SBC ARM: imx: add missing of_node_put() arm64: dts: imx93-11x11-evk: correct clock and strobe pad setting arm64: dts: verdin-imx8mm: fix dev board audio playback arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux arm64: dts: freescale: Fix pca954x i2c-mux node names ARM: dts: vf610: Fix pca9548 i2c-mux node names ARM: dts: imx: Fix pca9547 i2c-mux node name arm64: dts: verdin-imx8mm: fix dahlia audio playback ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property ... Link: https://lore.kernel.org/r/20230102132016.GA10699@T480 Signed-off-by: Arnd Bergmann commit 97bcdf24e00075cf37ee4cbd63f07f54e25c5265 Merge: 13d159553ef2c 3a2390c6777e3 Author: Arnd Bergmann Date: Mon Jan 9 23:16:08 2023 +0100 Merge tag 'reset-fixes-for-v6.2' of git://git.pengutronix.de/pza/linux into arm/fixes Reset controller fixes for v6.2 Avoid a build error by disabling the invalid combination of building reset-ti-sci built-in but ti-sci as a module. Fix a possible NULL pointer dereference in reset-uniphier-glue in case platform_get_resource() fails. * tag 'reset-fixes-for-v6.2' of git://git.pengutronix.de/pza/linux: reset: uniphier-glue: Fix possible null-ptr-deref reset: ti-sci: honor TI_SCI_PROTOCOL setting when not COMPILE_TEST Link: https://lore.kernel.org/r/20230104095855.3809733-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 13d159553ef2c2b68d5c643db4491999f8b6bbb1 Merge: a316877372f4f c45219cba101f Author: Arnd Bergmann Date: Mon Jan 9 23:15:44 2023 +0100 Merge tag 'amlogic-fixes-v6.2-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes Amlogic fixes for v6.2-rc: - Revert "arm64: dts: meson-sm1-odroid-hc4: disable unused USB PHY0" which breaks whole USB on Odroid-HC4 * tag 'amlogic-fixes-v6.2-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: Revert "arm64: dts: meson-sm1-odroid-hc4: disable unused USB PHY0" Link: https://lore.kernel.org/r/7915c3f8-57bc-25e2-0314-c78af7a79d6a@linaro.org Signed-off-by: Arnd Bergmann commit a316877372f4f3062b132437cbc16f2fab8cc4c5 Merge: dc43354cb7689 e325285de2cd8 Author: Arnd Bergmann Date: Mon Jan 9 23:15:08 2023 +0100 Merge tag 'scmi-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v6.2 Few fixes addressing: 1. Possible compromise with the shorter message size from a misbheaving SCMI platform firmware. The shmem accesses are now hardened to handle the same in fetch_notification and fetch_response. 2. Possible unsafe locking scenario which is solved by calling virtio_break_device() before getting hold of vioch->lock. 3. Possible stale error status reported from a previous message being used again as it is not cleared. * tag 'scmi-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix virtio channels cleanup on shutdown firmware: arm_scmi: Harden shared memory access in fetch_notification firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Clear stale xfer->hdr.status Link: https://lore.kernel.org/r/20230106093909.652657-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit dc43354cb7689642f53a044e76509fa7e9a028d4 Merge: 88603b6dc4194 cb8fd6f757751 Author: Arnd Bergmann Date: Mon Jan 9 23:14:09 2023 +0100 Merge tag 'memory-controller-drv-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v6.2 Broken in v6.2: 1. OMAP GPMC: do not fail if "gpmc,wait-pin" optional property (introduced for v6.2) is missing. Broken earlier: 1. Tegra MC: Drop SID override programming as it is handled by bootloader and doing it in the kernel can cause unexpected results. 2. Atmel SDRAMC, MVEBU devbus: Add missing clock unprepare/disable in exit and error paths. * tag 'memory-controller-drv-fixes-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: tegra: Remove clients SID override programming memory: omap-gpmc: fix wait pin validation Link: https://lore.kernel.org/r/20230109150322.329614-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 40543b3d9d2c13227ecd3aa90a713c201d1d7f09 Author: Jiasheng Jiang Date: Thu Dec 8 21:35:52 2022 +0800 ice: Add check for kzalloc Add the check for the return value of kzalloc in order to avoid NULL pointer dereference. Moreover, use the goto-label to share the clean code. Fixes: d6b98c8d242a ("ice: add write functionality for GNSS TTY") Signed-off-by: Jiasheng Jiang Reviewed-by: Jiri Pirko Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f58985620f55580a07d40062c4115d8c9cf6ae27 Author: Yuan Can Date: Wed Dec 7 08:55:02 2022 +0000 ice: Fix potential memory leak in ice_gnss_tty_write() The ice_gnss_tty_write() return directly if the write_buf alloc failed, leaking the cmd_buf. Fix by free cmd_buf if write_buf alloc failed. Fixes: d6b98c8d242a ("ice: add write functionality for GNSS TTY") Signed-off-by: Yuan Can Reviewed-by: Leon Romanovsky Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 99f1a36c90a7524972be5a028424c57fa17753ee Author: YiPeng Chai Date: Fri Jan 6 14:04:15 2023 +0800 drm/amdgpu: Fixed bug on error when unloading amdgpu Fixed bug on error when unloading amdgpu. The error message is as follows: [ 377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278! [ 377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G IOE 6.0.0-thomas #1 [ 377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021 [ 377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy] [ 377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53 [ 377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287 [ 377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000 [ 377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70 [ 377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001 [ 377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70 [ 377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70 [ 377.706325] FS: 00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000 [ 377.706334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0 [ 377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 377.706361] Call Trace: [ 377.706365] [ 377.706369] drm_buddy_free_list+0x2a/0x60 [drm_buddy] [ 377.706376] amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu] [ 377.706572] amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu] [ 377.706650] amdgpu_bo_fini+0x22/0x90 [amdgpu] [ 377.706727] gmc_v11_0_sw_fini+0x26/0x30 [amdgpu] [ 377.706821] amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu] [ 377.706897] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] [ 377.706975] drm_dev_release+0x20/0x40 [drm] [ 377.707006] release_nodes+0x35/0xb0 [ 377.707014] devres_release_all+0x8b/0xc0 [ 377.707020] device_unbind_cleanup+0xe/0x70 [ 377.707027] device_release_driver_internal+0xee/0x160 [ 377.707033] driver_detach+0x44/0x90 [ 377.707039] bus_remove_driver+0x55/0xe0 [ 377.707045] pci_unregister_driver+0x3b/0x90 [ 377.707052] amdgpu_exit+0x11/0x6c [amdgpu] [ 377.707194] __x64_sys_delete_module+0x142/0x2b0 [ 377.707201] ? fpregs_assert_state_consistent+0x22/0x50 [ 377.707208] ? exit_to_user_mode_prepare+0x3e/0x190 [ 377.707215] do_syscall_64+0x38/0x90 [ 377.707221] entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: YiPeng Chai Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1923bc5a56daeeabd7e9093bad2febcd6af2416a Author: Mario Limonciello Date: Tue Dec 27 15:49:17 2022 -0600 drm/amd: Delay removal of the firmware framebuffer Removing the firmware framebuffer from the driver means that even if the driver doesn't support the IP blocks in a GPU it will no longer be functional after the driver fails to initialize. This change will ensure that unsupported IP blocks at least cause the driver to work with the EFI framebuffer. Cc: stable@vger.kernel.org Suggested-by: Alex Deucher Reviewed-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 0be7ed8e7eb15282b5d0f6fdfea884db594ea9bf Author: Luben Tuikov Date: Wed Jan 4 17:09:02 2023 -0500 drm/amdgpu: Fix potential NULL dereference Fix potential NULL dereference, in the case when "man", the resource manager might be NULL, when/if we print debug information. Cc: Alex Deucher Cc: Christian König Cc: AMD Graphics Cc: Dan Carpenter Cc: kernel test robot Fixes: 7554886daa31ea ("drm/amdgpu: Fix size validation for non-exclusive domains (v4)") Signed-off-by: Luben Tuikov Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 51b3802e79606b2326f4a8cac0f2766a2e15338b Author: Johan Hovold Date: Wed Jan 4 10:56:12 2023 +0100 dt-bindings: rtc: qcom-pm8xxx: allow 'wakeup-source' property The RTC can be used as a wakeup source on at least some platforms so allow it to be described as such. Signed-off-by: Johan Hovold Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230104095612.6756-1-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 101ca8d05913b7d1e6e8b9dd792193d4082fff86 Author: Shanker Donthineni Date: Mon Jan 2 17:06:30 2023 -0600 rtc: efi: Enable SET/GET WAKEUP services as optional The current implementation of rtc-efi is expecting all the 4 time services GET{SET}_TIME{WAKEUP} must be supported by UEFI firmware. As per the EFI_RT_PROPERTIES_TABLE, the platform specific implementations can choose to enable selective time services based on the RTC device capabilities. This patch does the following changes to provide GET/SET RTC services on platforms that do not support the WAKEUP feature. 1) Relax time services cap check when creating a platform device. 2) Clear RTC_FEATURE_ALARM bit in the absence of WAKEUP services. 3) Conditional alarm entries in '/proc/driver/rtc'. Cc: # v6.0+ Signed-off-by: Shanker Donthineni Link: https://lore.kernel.org/r/20230102230630.192911-1-sdonthineni@nvidia.com Signed-off-by: Alexandre Belloni commit 2ec1b17f745b08526220f3c169d2eb9799a9be39 Author: Dave Jiang Date: Fri Jan 6 09:39:49 2023 -0700 cxl: fix cxl_report_and_clear() RAS UE addr mis-assignment 'addr' that contains RAS UE register address is re-assigned to RAS_CAP_CONTROL offset if there are multiple UE errors. Use different addr variable to avoid the reassignment mistake. Fixes: 2905cb5236cb ("cxl/pci: Add (hopeful) error handling support") Reported-by: Jonathan Cameron Signed-off-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167302318779.580155.15233596744650706167.stgit@djiang5-mobl3.local Signed-off-by: Dan Williams commit ee4202db16e59e792f570092ad1f440f2d31ea03 Author: Stephen Kitt Date: Mon Jan 9 21:02:38 2023 +0100 fbdev: atmel_lcdfb: Rework backlight status updates Instead of checking the state of various backlight_properties fields against the memorised state in atmel_lcdfb_info.bl_power, atmel_bl_update_status() should retrieve the desired state using backlight_get_brightness (which takes into account the power state, blanking etc.). This means the explicit checks using props.fb_blank and props.power can be dropped. The backlight framework ensures that backlight is never negative, so the test before reading the brightness from the hardware always ends up false and the whole block can be removed. The framework retrieves the brightness from the hardware through atmel_bl_get_brightness() when necessary. As a result, bl_power in struct atmel_lcdfb_info is no longer necessary, so remove that while we're at it. Since we only ever care about reading the current state in backlight_properties, drop the updates at the end of the function. Signed-off-by: Stephen Kitt Acked-by: Sam Ravnborg Signed-off-by: Helge Deller commit a4d5d2ef5b1f6cddee0fec35d86404df148b9074 Author: Klaus Kudielka Date: Sat Jan 7 15:41:49 2023 +0100 Revert "ARM: dts: armada-39x: Fix compatible string for gpios" This reverts commit d10886a4e6f85ee18d47a1066a52168461370ded. If compatible = "marvell,armadaxp-gpio", the reg property requires a second (address, size) pair, which points to the per-CPU interrupt registers <0x18800 0x30> / <0x18840 0x30>. Furthermore: Commit 5f79c651e81e explains very well, why the gpio-mvebu driver does not work reliably with per-CPU interrupts. Commit 988c8c0cd04d deprecates compatible = marvell,armadaxp-gpio for this reason. Signed-off-by: Klaus Kudielka Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit 75b58cf5ce21650c1b3b88d8310f3415ce905018 Author: Klaus Kudielka Date: Sat Jan 7 15:41:48 2023 +0100 Revert "ARM: dts: armada-38x: Fix compatible string for gpios" This reverts commit c4de4667f15d04ef5920bacf41e514ec7d1ef03d, which causes a regression on Turris Omnia (Armada 385): GPIO interrupts cease to work, ending up in the DSA switch being non-functional. The blamed commit is incorrect in the first place: If compatible = "marvell,armadaxp-gpio", the second (address, size) pair of the reg property must to point to the per-CPU interrupt registers <0x18800 0x30> / <0x18840 0x30>, and not to the blink enable registers <0x181c0 0x08> / <0x181c8 0x08>. But even fixing that leaves the GPIO interrupts broken on the Omnia. Furthermore: Commit 5f79c651e81e explains very well, why the gpio-mvebu driver does not work reliably with per-CPU interrupts. Commit 988c8c0cd04d deprecates compatible = marvell,armadaxp-gpio for this reason. Fixes: c4de4667f15d ("ARM: dts: armada-38x: Fix compatible string for gpios") Reported-by: Klaus Kudielka Link: https://lore.kernel.org/r/f24474e70c1a4e9692bd596ef6d97ceda9511245.camel@gmail.com/ Signed-off-by: Klaus Kudielka Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit ba5d4c1596cada37793d405dd18d695cd3508902 Author: Paulo Alcantara Date: Fri Jan 6 13:34:36 2023 -0300 cifs: fix file info setting in cifs_open_file() In cifs_open_file(), @buf must hold a pointer to a cifs_open_info_data structure which is passed by cifs_nt_open(), so assigning @buf directly to @fi was obviously wrong. Fix this by passing a valid FILE_ALL_INFO structure to SMBLegacyOpen() and CIFS_open(), and then copy the set structure to the corresponding cifs_open_info_data::fi field with move_cifs_info_to_smb2() helper. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216889 Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 29cf28235e3e57e0af01ae29db57a75f87a2ada8 Author: Paulo Alcantara Date: Fri Jan 6 20:28:30 2023 -0300 cifs: fix file info setting in cifs_query_path_info() We missed to set file info when CIFSSMBQPathInfo() returned 0, thus leaving cifs_open_info_data::fi unset. Fix this by setting cifs_open_info_data::fi when either CIFSSMBQPathInfo() or SMBQueryInformation() succeed. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216881 Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 00b18da4089330196906b9fe075c581c17eb726c Author: Willy Tarreau Date: Mon Jan 9 08:54:42 2023 +0100 tools/nolibc: fix the O_* fcntl/open macro definitions for riscv When RISCV port was imported in 5.2, the O_* macros were taken with their octal value and written as-is in hex, resulting in the getdents64() to fail in nolibc-test. Fixes: 582e84f7b779 ("tool headers nolibc: add RISCV support") #5.2 Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit 1bfbe1f3e96720daf185f03d101f072d69753f88 Author: Willy Tarreau Date: Mon Jan 9 08:54:41 2023 +0100 tools/nolibc: prevent gcc from making memset() loop over itself When building on ARM in thumb mode with gcc-11.3 at -O2 or -O3, nolibc-test segfaults during the select() tests. It turns out that at this level, gcc recognizes an opportunity for using memset() to zero the fd_set, but it miscompiles it because it also recognizes a memset pattern as well, and decides to call memset() from the memset() code: 000122bc : 122bc: b510 push {r4, lr} 122be: 0004 movs r4, r0 122c0: 2a00 cmp r2, #0 122c2: d003 beq.n 122cc 122c4: 23ff movs r3, #255 ; 0xff 122c6: 4019 ands r1, r3 122c8: f7ff fff8 bl 122bc 122cc: 0020 movs r0, r4 122ce: bd10 pop {r4, pc} Simply placing an empty asm() statement inside the loop suffices to avoid this. Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit 55abdd1f5e1e07418bf4a46c233a92f83cb5ae97 Author: Willy Tarreau Date: Mon Jan 9 08:54:40 2023 +0100 tools/nolibc: fix missing includes causing build issues at -O0 After the nolibc includes were split to facilitate portability from standard libcs, programs that include only what they need may miss some symbols which are needed by libgcc. This is the case for raise() which is needed by the divide by zero code in some architectures for example. Regardless, being able to include only the apparently needed files is convenient. Instead of trying to move all exported definitions to a single file, since this can change over time, this patch takes another approach consisting in including the nolibc header at the end of all standard include files. This way their types and functions are already known at the moment of inclusion, and including any single one of them is sufficient to bring all the required ones. Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit 184177c3d6e023da934761e198c281344d7dd65b Author: Willy Tarreau Date: Mon Jan 9 08:54:39 2023 +0100 tools/nolibc: restore mips branch ordering in the _start block Depending on the compiler used and the optimization options, the sbrk() test was crashing, both on real hardware (mips-24kc) and in qemu. One such example is kernel.org toolchain in version 11.3 optimizing at -Os. Inspecting the sys_brk() call shows the following code: 0040047c : 40047c: 24020fcd li v0,4045 400480: 27bdffe0 addiu sp,sp,-32 400484: 0000000c syscall 400488: 27bd0020 addiu sp,sp,32 40048c: 10e00001 beqz a3,400494 400490: 00021023 negu v0,v0 400494: 03e00008 jr ra It is obviously wrong, the "negu" instruction is placed in beqz's delayed slot, and worse, there's no nop nor instruction after the return, so the next function's first instruction (addiu sip,sip,-32) will also be executed as part of the delayed slot that follows the return. This is caused by the ".set noreorder" directive in the _start block, that applies to the whole program. The compiler emits code without the delayed slots and relies on the compiler to swap instructions when this option is not set. Removing the option would require to change the startup code in a way that wouldn't make it look like the resulting code, which would not be easy to debug. Instead let's just save the default ordering before changing it, and restore it at the end of the _start block. Now the code is correct: 0040047c : 40047c: 24020fcd li v0,4045 400480: 27bdffe0 addiu sp,sp,-32 400484: 0000000c syscall 400488: 10e00002 beqz a3,400494 40048c: 27bd0020 addiu sp,sp,32 400490: 00021023 negu v0,v0 400494: 03e00008 jr ra 400498: 00000000 nop Fixes: 66b6f755ad45 ("rcutorture: Import a copy of nolibc") #5.0 Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit 16f5cea74179b5795af7ce359971f5128d10f80e Author: Warner Losh Date: Mon Jan 9 08:54:38 2023 +0100 tools/nolibc: Fix S_ISxxx macros The mode field has the type encoded as an value in a field, not as a bit mask. Mask the mode with S_IFMT instead of each type to test. Otherwise, false positives are possible: eg S_ISDIR will return true for block devices because S_IFDIR = 0040000 and S_IFBLK = 0060000 since mode is masked with S_IFDIR instead of S_IFMT. These macros now match the similar definitions in tools/include/uapi/linux/stat.h. Signed-off-by: Warner Losh Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit feaf75658783a919410f8c2039dbc24b6a29603d Author: Sven Schnelle Date: Mon Jan 9 08:54:37 2023 +0100 nolibc: fix fd_set type The kernel uses unsigned long for the fd_set bitmap, but nolibc use u32. This works fine on little endian machines, but fails on big endian. Convert to unsigned long to fix this. Signed-off-by: Sven Schnelle Signed-off-by: Willy Tarreau Signed-off-by: Paul E. McKenney commit cad90e5381d840cf2296aaac9b3eff71a30b7c5b Author: Nicholas Piggin Date: Tue Dec 20 20:13:23 2022 +1000 objtool: Tolerate STT_NOTYPE symbols at end of section Hand-written asm often contains non-function symbols in executable sections. _end symbols for finding the size of instruction blocks for runtime processing is one such usage. optprobe_template_end is one example that causes the warning: objtool: optprobe_template_end(): can't find starting instruction This is because the symbol happens to be at the end of the file (and therefore end of a section in the object file). So ignore end-of-section STT_NOTYPE symbols instead of bailing out because an instruction can't be found. While we're here, add a more descriptive warning for STT_FUNC symbols found at the end of a section. [ This also solves a PowerPC regression reported by Sathvika Vasireddy. ] Reported-by: Naveen N. Rao Reported-by: Sathvika Vasireddy Signed-off-by: Nicholas Piggin Signed-off-by: Ingo Molnar Acked-by: Sathvika Vasireddy Link: https://lore.kernel.org/r/20221220101323.3119939-1-npiggin@gmail.com commit 70051cffb31b5ee09096351c3b41fcae6f89de31 Author: Jaroslav Kysela Date: Mon Jan 9 16:12:49 2023 +0100 ALSA: control-led: use strscpy in set_led_id() The use of strncpy() in the set_led_id() was incorrect. The len variable should use 'min(sizeof(buf2) - 1, count)' expression. Use strscpy() function to simplify things and handle the error gracefully. Fixes: a135dfb5de15 ("ALSA: led control - add sysfs kcontrol LED marking layer") Reported-by: yang.yang29@zte.com.cn Link: https://lore.kernel.org/alsa-devel/202301091945513559977@zte.com.cn/ Cc: Signed-off-by: Jaroslav Kysela Signed-off-by: Takashi Iwai commit cd2d0d45a3d2c199344305a1e8fed42347cf4bec Author: Arnd Bergmann Date: Mon Jan 9 09:30:53 2023 +0100 ARM: pxa: enable PXA310/PXA320 for DT-only build After commit b5aaaa666a85 ("ARM: pxa: add Kconfig dependencies for ATAGS based boards"), the default PXA build no longer includes support for the board files that are considered unused. As a side-effect of this, the PXA310 and PXA320 support is not built into the kernel any more, even though it should work in principle as long as the symbols are enabled. As Robert points out, there are dts files for zylonite and cm-x300, though those have not made it into the mainline kernel. Link: https://lore.kernel.org/linux-arm-kernel/m2sfglh02h.fsf@free.fr/ Reported-by: Robert Jarzmik Signed-off-by: Arnd Bergmann commit 68a63a412d18bd2e2577c8928139f92541afa7a6 Author: James Clark Date: Mon Jan 9 12:27:43 2023 +0000 arm64: Fix build with CC=clang, CONFIG_FTRACE=y and CONFIG_STACK_TRACER=y commit 45bd8951806e ("arm64: Improve HAVE_DYNAMIC_FTRACE_WITH_REGS selection for clang") fixed the build with the above combination by splitting HAVE_DYNAMIC_FTRACE_WITH_REGS into separate checks for Clang and GCC. commit 26299b3f6ba2 ("ftrace: arm64: move from REGS to ARGS") added the GCC only check "-fpatchable-function-entry=2" back in unconditionally which breaks the build. Remove the unconditional check, because the conditional ones were also updated to _ARGS in the above commit, so they work correctly on their own. Fixes: 26299b3f6ba2 ("ftrace: arm64: move from REGS to ARGS") Signed-off-by: James Clark Link: https://lore.kernel.org/r/20230109122744.1904852-1-james.clark@arm.com Signed-off-by: Will Deacon commit 4e4ff23a35ee3a145fbc8378ecfeaab2d235cddd Author: Will Deacon Date: Mon Jan 9 15:47:25 2023 +0000 arm64/mm: Define dummy pud_user_exec() when using 2-level page-table With only two levels of page-table, the generic 'pud_*' macros are implemented using dummy operations in pgtable-nopmd.h. Since commit 730a11f982e6 ("arm64/mm: add pud_user_exec() check in pud_user_accessible_page()"), pud_user_accessible_page() unconditionally calls pud_user_exec(), which is an arm64-specific helper and therefore isn't defined by pgtable-nopmd.h. This results in a build failure for configurations with only two levels of page table: arch/arm64/include/asm/pgtable.h: In function 'pud_user_accessible_page': >> arch/arm64/include/asm/pgtable.h:870:51: error: implicit declaration of function 'pud_user_exec'; did you mean 'pmd_user_exec'? [-Werror=implicit-function-declaration] 870 | return pud_leaf(pud) && (pud_user(pud) || pud_user_exec(pud)); | ^~~~~~~~~~~~~ | pmd_user_exec Fix the problem by defining pud_user_exec() as pud_user() in this case. Link: https://lore.kernel.org/r/202301080515.z6zEksU4-lkp@intel.com Reported-by: kernel test robot Signed-off-by: Will Deacon commit afce71ff6daa9c0f852df0727fe32c6fb107f0fa Author: Rob Clark Date: Tue Jan 3 15:49:46 2023 -0800 drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer. Signed-off-by: Rob Clark Fixes: eb4dedae920a ("drm/i915/gem: Delay tracking the GEM context until it is registered") Fixes: a4c1cdd34e2c ("drm/i915/gem: Delay context creation (v3)") Fixes: 49bd54b390c2 ("drm/i915: Track all user contexts per client") Cc: # v5.10+ Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti [tursulin: Stable and fixes tags add/tidy.] Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230103234948.1218393-1-robdclark@gmail.com (cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c) Signed-off-by: Rodrigo Vivi commit 476fdcdaaae7b06c780cdfc234c704107f16c529 Author: Nirmoy Das Date: Fri Dec 23 10:20:11 2022 +0100 drm/i915: Reserve enough fence slot for i915_vma_unbind_async A nested dma_resv_reserve_fences(1) will not reserve slot from the 2nd call onwards and folowing dma_resv_add_fence() might hit the "BUG_ON(fobj->num_fences >= fobj->max_fences)" check. I915 hit above nested dma_resv case in ttm_bo_handle_move_mem() with async unbind: dma_resv_reserve_fences() from --> ttm_bo_handle_move_mem() dma_resv_reserve_fences() from --> i915_vma_unbind_async() dma_resv_add_fence() from --> i915_vma_unbind_async() dma_resv_add_fence() from -->ttm_bo_move_accel_cleanup() Resolve this by adding an extra fence in i915_vma_unbind_async(). Suggested-by: Thomas Hellström Fixes: 2f6b90da9192 ("drm/i915: Use vma resources for async unbinding") Cc: # v5.18+ Signed-off-by: Nirmoy Das Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20221223092011.11657-1-nirmoy.das@intel.com (cherry picked from commit 4f0755c2faf7388616109717facc5bbde6850e60) Signed-off-by: Rodrigo Vivi commit 78a4471fa1a76a8bef4919105de67660a89a1e9b Author: Stefan Wahren Date: Sat Jan 7 13:32:29 2023 +0100 i2c: mxs: suppress probe-deferral error message During boot of I2SE Duckbill the kernel log contains a confusing error: Failed to request dma This is caused by i2c-mxs tries to request a not yet available DMA channel (-EPROBE_DEFER). So suppress this message by using dev_err_probe(). Signed-off-by: Stefan Wahren Reviewed-by: Fabio Estevam Signed-off-by: Wolfram Sang commit 2ece0930ac5662bccce0ba4c59b84c98d2437200 Author: Basavaraj Natikar Date: Mon Jan 2 22:39:55 2023 +0530 i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU Add additional supported PCI IDs for latest AMD NAVI GPU card which has an integrated Type-C controller and designware I2C with PCI interface. Signed-off-by: Basavaraj Natikar Tested-by: Sanath S Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 291e9da91403e0e628d7692b5ed505100e7b7706 Author: Jaroslav Kysela Date: Mon Jan 9 15:11:33 2023 +0100 ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format() Handle the fallback code path, too. Fixes: fd28941cff1c ("ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless") BugLink: https://lore.kernel.org/alsa-devel/Y7frf3N%2FxzvESEsN@kili/ Reported-by: Dan Carpenter Cc: Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230109141133.335543-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 6f9aba7f0d74e8dd085f9ac11fe8f3fdd7fde4ca Author: Athira Rajeev Date: Thu Jan 5 17:34:36 2023 +0530 perf tests bpf prologue: Fix bpf-script-test-prologue test compile issue with clang While running 'perf test' for bpf, observed that "BPF prologue generation" test case fails to compile with clang. Logs below from powerpc: :33:2: error: use of undeclared identifier 'fmode_t' fmode_t f_mode = (fmode_t)_f_mode; ^ :37:6: error: use of undeclared identifier 'f_mode'; did you mean '_f_mode'? if (f_mode & FMODE_WRITE) ^~~~~~ _f_mode :30:60: note: '_f_mode' declared here int bpf_func__null_lseek(void *ctx, int err, unsigned long _f_mode, ^ 2 errors generated. The test code tests/bpf-script-test-prologue.c uses fmode_t. And the error above is for "fmode_t" which is defined in include/linux/types.h as part of kernel build directory: "/lib/modules//build" that comes from kernel devel [ soft link to /usr/src/ ]. Clang picks this header file from "-working-directory" build option that specifies this build folder. But the commit 14e4b9f4289aed2c ("perf trace: Raw augmented syscalls fix libbpf 1.0+ compatibility") changed the include directory to use: "/usr/include". Post this change, types.h from /usr/include/ is getting picked upwhich doesn’t contain definition of "fmode_t" and hence fails to compile. Compilation command before this commit: /usr/bin/clang -D__KERNEL__ -D__NR_CPUS__=72 -DLINUX_VERSION_CODE=0x50e00 -xc -I/root/lib/perf/include/bpf -nostdinc -I./arch/powerpc/include -I./arch/powerpc/include/generated -I./include -I./arch/powerpc/include/uapi -I./arch/powerpc/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules//build -c - -target bpf -g -O2 -o - Compilation command after this commit: /usr/bin/clang -D__KERNEL__ -D__NR_CPUS__=72 -DLINUX_VERSION_CODE=0x50e00 -xc -I/usr/include/ -nostdinc -I./arch/powerpc/include -I./arch/powerpc/include/generated -I./include -I./arch/powerpc/include/uapi -I./arch/powerpc/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules//build -c - -target bpf -g -O2 -o - The difference is addition of -I/usr/include/ in the first line which is causing the error. Fix this by adding typedef for "fmode_t" in the testcase to solve the compile issue. Fixes: 14e4b9f4289aed2c ("perf trace: Raw augmented syscalls fix libbpf 1.0+ compatibility") Signed-off-by: Athira Jajeev Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Disha Goel Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: linuxppc-dev@lists.ozlabs.org Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Link: https://lore.kernel.org/linux-perf-users/20230105120436.92051-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 1aefe5c177c1922119afb4ee443ddd6ac3140b37 Author: Daisuke Matsuda Date: Tue Dec 20 17:08:48 2022 +0900 RDMA/rxe: Prevent faulty rkey generation If you create MRs more than 0x10000 times after loading the module, responder starts to reply NAKs for RDMA/Atomic operations because of rkey violation detected in check_rkey(). The root cause is that rkeys are incremented each time a new MR is created and the value overflows into the range reserved for MWs. This commit also increases the value of RXE_MAX_MW that has been limited unlike other parameters. Fixes: 0994a1bcd5f7 ("RDMA/rxe: Bump up default maximum values used via uverbs") Link: https://lore.kernel.org/r/20221220080848.253785-2-matsuda-daisuke@fujitsu.com Signed-off-by: Daisuke Matsuda Tested-by: Li Zhijian Reviewed-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 3a73746b267e5c6a87c9ad26f8c6a48e44da609c Author: Daisuke Matsuda Date: Tue Dec 20 17:08:47 2022 +0900 RDMA/rxe: Fix inaccurate constants in rxe_type_info ibv_query_device() has reported incorrect device attributes, which are actually not used by the device. Make the constants correspond with the attributes shown to users. Fixes: 3ccffe8abf2f ("RDMA/rxe: Move max_elem into rxe_type_info") Fixes: 3225717f6dfa ("RDMA/rxe: Replace red-black trees by xarrays") Link: https://lore.kernel.org/r/20221220080848.253785-1-matsuda-daisuke@fujitsu.com Signed-off-by: Daisuke Matsuda Reviewed-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit f993d24a948d22710148dae2c48b8a87155f6cb9 Author: Masahiro Yamada Date: Sat Jan 7 01:10:23 2023 +0900 s390: fix -Wundef warning for CONFIG_KERNEL_ZSTD Since commit 80b6093b55e3 ("kbuild: add -Wundef to KBUILD_CPPFLAGS for W=1 builds"), building with W=1 detects misuse of #(el)if. $ make W=1 ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- [snip] arch/s390/boot/decompressor.c:28:7: warning: "CONFIG_KERNEL_ZSTD" is not defined, evaluates to 0 [-Wundef] 28 | #elif CONFIG_KERNEL_ZSTD | ^~~~~~~~~~~~~~~~~~ This issue has been hidden because arch/s390/boot/Makefile overwrites KBUILD_CFLAGS, dropping -Wundef. CONFIG_KERNEL_ZSTD is a bool option. #elif defined() should be used. The line #ifdef CONFIG_KERNEL_BZIP2 is fine, but I changed it for consistency. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20230106161024.2373602-1-masahiroy@kernel.org Signed-off-by: Heiko Carstens commit c9fb35f685b2f8a2ead98e3f1b249a1d4e9c040e Author: Krzysztof Kozlowski Date: Sun Dec 25 12:59:07 2022 +0100 ASoC: dt-bindings: qcom,lpass-tx-macro: correct clocks on SC7280 On SC7280 ADSP bypassed platform, there are only three clocks for TX macro. This is already reflected in "clock-names" but not in "clocks" property: sc7280-herobrine-zombie-lte.dtb: codec@3220000: clocks: [[219, 8], [219, 7], [220]] is too short Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221225115907.55250-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 69568267c5b624eaa86afcafbca1c4765f63e112 Author: Krzysztof Kozlowski Date: Sun Dec 25 12:59:06 2022 +0100 ASoC: dt-bindings: qcom,lpass-wsa-macro: correct clocks on SM8250 SM8250 DTS uses additional "va" clock in WSA macro device node: sm8250-sony-xperia-edo-pdx203.dtb: codec@3240000: clock-names: ['mclk', 'npl', 'macro', 'dcodec', 'va', 'fsgen'] is too long Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221225115907.55250-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 0cbf1ecd8c4801ec7566231491f7ad9cec31098b Author: Stephan Gerhold Date: Sat Dec 31 12:55:06 2022 +0100 ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE Older Qualcomm platforms like APQ8016 do not have hardware support for SoundWire, so kernel configurations made specifically for those platforms will usually not have CONFIG_SOUNDWIRE enabled. Unfortunately commit 8d89cf6ff229 ("ASoC: qcom: cleanup and fix dependency of QCOM_COMMON") breaks those kernel configurations, because SOUNDWIRE is now a required dependency for SND_SOC_QCOM_COMMON (and in turn also SND_SOC_APQ8016_SBC). Trying to migrate such a kernel config silently disables SND_SOC_APQ8016_SBC and breaks audio functionality. The soundwire helpers in common.c are only used by two of the Qualcomm audio machine drivers, so building and requiring CONFIG_SOUNDWIRE for all platforms is unnecessary. There is no need to stuff all common code into a single module. Fix the issue by moving the soundwire helpers to a separate SND_SOC_QCOM_SDW module/option that is selected only by the machine drivers that make use of them. This also allows reverting the imply/depends changes from the previous fix because both SM8250 and SC8280XP already depend on SOUNDWIRE, so the soundwire helpers will be only built if SOUNDWIRE is really enabled. Cc: Srinivas Kandagatla Fixes: 8d89cf6ff229 ("ASoC: qcom: cleanup and fix dependency of QCOM_COMMON") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20221231115506.82991-1-stephan@gerhold.net Signed-off-by: Mark Brown commit 80f8be7af03ffe90dc4df998b16bfa212afbdde9 Author: Masahiro Yamada Date: Sun Jan 8 22:47:26 2023 +0900 tomoyo: Omit use of bin2c bin2c was, as its name implies, introduced to convert a binary file to C code. However, I did not see any good reason ever for using this tool because using the .incbin directive is much faster, and often results in simpler code. Most of the uses of bin2c have been killed, for example: - 13610aa908dc ("kernel/configs: use .incbin directive to embed config_data.gz") - 4c0f032d4963 ("s390/purgatory: Omit use of bin2c") security/tomoyo/Makefile has even less reason for using bin2c because the policy files are text data. So, sed is enough for converting them to C string literals, and what is nicer, generates human-readable builtin-policy.h. This is the last user of bin2c. After this commit lands, bin2c will be removed. Signed-off-by: Masahiro Yamada [penguin-kernel: Update sed script to also escape backslash and quote ] Signed-off-by: Tetsuo Handa commit 75507a319876aba88932e2c7dab58b6c22d89f6b Author: Richard Fitzgerald Date: Mon Dec 19 13:01:45 2022 +0000 i2c: designware: Fix unbalanced suspended flag Ensure that i2c_mark_adapter_suspended() is always balanced by a call to i2c_mark_adapter_resumed(). dw_i2c_plat_resume() must always be called, so that i2c_mark_adapter_resumed() is called. This is not compatible with DPM_FLAG_MAY_SKIP_RESUME, so remove the flag. Since the controller is always resumed on system resume the dw_i2c_plat_complete() callback is redundant and has been removed. The unbalanced suspended flag was introduced by commit c57813b8b288 ("i2c: designware: Lock the adapter while setting the suspended flag") Before that commit, the system and runtime PM used the same functions. The DPM_FLAG_MAY_SKIP_RESUME was used to skip the system resume if the driver had been in runtime-suspend. If system resume was skipped, the suspended flag would be cleared by the next runtime resume. The check of the suspended flag was _after_ the call to pm_runtime_get_sync() in i2c_dw_xfer(). So either a system resume or a runtime resume would clear the flag before it was checked. Having introduced the unbalanced suspended flag with that commit, a further commit 80704a84a9f8 ("i2c: designware: Use the i2c_mark_adapter_suspended/resumed() helpers") changed from using a local suspended flag to using the i2c_mark_adapter_suspended/resumed() functions. These use a flag that is checked by I2C core code before issuing the transfer to the bus driver, so there was no opportunity for the bus driver to runtime resume itself before the flag check. Signed-off-by: Richard Fitzgerald Fixes: c57813b8b288 ("i2c: designware: Lock the adapter while setting the suspended flag") Reviewed-by: Hans de Goede Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit c8c37bc514514999e62a17e95160ed9ebf75ca8d Author: Lareine Khawaly Date: Wed Dec 21 19:59:00 2022 +0000 i2c: designware: use casting of u64 in clock multiplication to avoid overflow In functions i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt() may have overflow by depending on the values of the given parameters including the ic_clk. For example in our use case where ic_clk is larger than one million, multiplication of ic_clk * 4700 will result in 32 bit overflow. Add cast of u64 to the calculation to avoid multiplication overflow, and use the corresponding define for divide. Fixes: 2373f6b9744d ("i2c-designware: split of i2c-designware.c into core and bus specific parts") Signed-off-by: Lareine Khawaly Signed-off-by: Hanna Hawa Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 18bba1843fc7f264f58c9345d00827d082f9c558 Author: Ard Biesheuvel Date: Mon Jan 9 12:41:46 2023 +0100 efi: rt-wrapper: Add missing include Add the missing #include of asm/assembler.h, which is where the ldr_l macro is defined. Fixes: ff7a167961d1b97e ("arm64: efi: Execute runtime services from a dedicated stack") Signed-off-by: Ard Biesheuvel commit 5268a2842066c227e6ccd94bac562f1e1000244f Author: Kan Liang Date: Fri Jan 6 08:04:49 2023 -0800 perf/x86/intel/uncore: Add Emerald Rapids From the perspective of the uncore PMU, the new Emerald Rapids is the same as the Sapphire Rapids. The only difference is the event list, which will be supported in the perf tool later. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230106160449.3566477-4-kan.liang@linux.intel.com commit 69ced4160969025821f2999ff92163ed26568f1c Author: Kan Liang Date: Fri Jan 6 08:04:48 2023 -0800 perf/x86/msr: Add Emerald Rapids The same as Sapphire Rapids, the SMI_COUNT MSR is also supported on Emerald Rapids. Add Emerald Rapids model. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230106160449.3566477-3-kan.liang@linux.intel.com commit 6887a4d3aede084bf08b70fbc9736c69fce05d7f Author: Kan Liang Date: Wed Jan 4 12:13:47 2023 -0800 perf/x86/msr: Add Meteor Lake support Meteor Lake is Intel's successor to Raptor lake. PPERF and SMI_COUNT MSRs are also supported. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Reviewed-by: Andi Kleen Link: https://lore.kernel.org/r/20230104201349.1451191-7-kan.liang@linux.intel.com commit 01f2ea5bcf89dbd7a6530dbce7f2fb4e327e7006 Author: Kan Liang Date: Wed Jan 4 12:13:46 2023 -0800 perf/x86/cstate: Add Meteor Lake support Meteor Lake is Intel's successor to Raptor lake. From the perspective of Intel cstate residency counters, there is nothing changed compared with Raptor lake. Share adl_cstates with Raptor lake. Update the comments for Meteor Lake. Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Reviewed-by: Andi Kleen Link: https://lore.kernel.org/r/20230104201349.1451191-6-kan.liang@linux.intel.com commit 9a5418bc48babb313d2a62df29ebe21ce8c06c59 Author: Waiman Long Date: Fri Dec 30 23:11:20 2022 -0500 sched/core: Use kfree_rcu() in do_set_cpus_allowed() Commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") may call kfree() if user_cpus_ptr was previously set. Unfortunately, some of the callers of do_set_cpus_allowed() may have pi_lock held when calling it. So the following splats may be printed especially when running with a PREEMPT_RT kernel: WARNING: possible circular locking dependency detected BUG: sleeping function called from invalid context To avoid these problems, kfree_rcu() is used instead. An internal cpumask_rcuhead union is created for the sole purpose of facilitating the use of kfree_rcu() to free the cpumask. Since user_cpus_ptr is not being used in non-SMP configs, the newly introduced alloc_user_cpus_ptr() helper will return NULL in this case and sched_setaffinity() is modified to handle this special case. Fixes: 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") Suggested-by: Peter Zijlstra Signed-off-by: Waiman Long Signed-off-by: Ingo Molnar Reviewed-by: Peter Zijlstra Link: https://lore.kernel.org/r/20221231041120.440785-3-longman@redhat.com commit 87ca4f9efbd7cc649ff43b87970888f2812945b8 Author: Waiman Long Date: Fri Dec 30 23:11:19 2022 -0500 sched/core: Fix use-after-free bug in dup_user_cpus_ptr() Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the setting and clearing of user_cpus_ptr are done under pi_lock for arm64 architecture. However, dup_user_cpus_ptr() accesses user_cpus_ptr without any lock protection. Since sched_setaffinity() can be invoked from another process, the process being modified may be undergoing fork() at the same time. When racing with the clearing of user_cpus_ptr in __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and possibly double-free in arm64 kernel. Commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") fixes this problem as user_cpus_ptr, once set, will never be cleared in a task's lifetime. However, this bug was re-introduced in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in do_set_cpus_allowed(). This time, it will affect all arches. Fix this bug by always clearing the user_cpus_ptr of the newly cloned/forked task before the copying process starts and check the user_cpus_ptr state of the source task under pi_lock. Note to stable, this patch won't be applicable to stable releases. Just copy the new dup_user_cpus_ptr() function over. Fixes: 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems") Fixes: 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") Reported-by: David Wang 王标 Signed-off-by: Waiman Long Signed-off-by: Ingo Molnar Reviewed-by: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221231041120.440785-2-longman@redhat.com commit 45e966fcca03ecdcccac7cb236e16eea38cc18af Author: Paolo Bonzini Date: Sat Oct 22 04:17:53 2022 -0400 KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID Passing the host topology to the guest is almost certainly wrong and will confuse the scheduler. In addition, several fields of these CPUID leaves vary on each processor; it is simply impossible to return the right values from KVM_GET_SUPPORTED_CPUID in such a way that they can be passed to KVM_SET_CPUID2. The values that will most likely prevent confusion are all zeroes. Userspace will have to override it anyway if it wishes to present a specific topology to the guest. Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 74905e3de8adf0e6b5d7f455dcd32cdec13dfb6c Author: Paolo Bonzini Date: Wed Nov 9 06:03:03 2022 -0500 KVM: nSVM: clarify recalc_intercepts() wrt CR8 The mysterious comment "We only want the cr8 intercept bits of L1" dates back to basically the introduction of nested SVM, back when the handling of "less typical" hypervisors was very haphazard. With the development of kvm-unit-tests for interrupt handling, the same code grew another vmcb_clr_intercept for the interrupt window (VINTR) vmexit, this time with a comment that is at least decent. It turns out however that the same comment applies to the CR8 write intercept, which is also a "recheck if an interrupt should be injected" intercept. The CR8 read intercept instead has not been used by KVM for 14 years (commit 649d68643ebf, "KVM: SVM: sync TPR value to V_TPR field in the VMCB"), so do not bother clearing it and let one comment describe both CR8 write and VINTR handling. Signed-off-by: Paolo Bonzini commit cfb47bf5a470bdd80e8ac2f7b2f3a34563ecd4ea Author: Frank Li Date: Wed Jan 4 16:07:40 2023 -0500 arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode linux,keycode should be "linux,keycodes" according binding-doc Documentation/devicetree/bindings/input/fsl,scu-key.yaml Fixes: f537ee7f1e76 ("arm64: dts: freescale: add i.MX8DXL SoC support") Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 8791906e667e44eddd62b341196f93911da8a578 Author: Stephen Kitt Date: Tue Jun 7 21:23:35 2022 +0200 fbdev: riva: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Antonino Daplas Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 450afd92d9cb177e0337c9ac26677765aeeff81a Author: Stephen Kitt Date: Tue Jun 7 21:23:34 2022 +0200 fbdev: omapfb: panel-dsi-cm: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Helge Deller Cc: linux-omap@vger.kernel.org Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 1cc17590ddfec590d7301f5e4cf6183ea19afa25 Author: Stephen Kitt Date: Tue Jun 7 21:23:33 2022 +0200 fbdev: nvidia: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Antonino Daplas Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 973fcf37c267f937fbec656f4643571d7bd09a37 Author: Stephen Kitt Date: Tue Jun 7 21:23:32 2022 +0200 fbdev: mx3fb: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit c28509ef9c221378a586e72643fc43102f5512e9 Author: Stephen Kitt Date: Tue Jun 7 21:23:31 2022 +0200 fbdev: radeon: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Benjamin Herrenschmidt Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 1535ec976414d2ea8d29d40da6b5b99c91e0f2bf Author: Stephen Kitt Date: Tue Jun 7 21:23:30 2022 +0200 fbdev: atyfb: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 5b3fc9988d1e4be268d834c2aaae85c75fa34253 Author: Stephen Kitt Date: Tue Jun 7 21:23:29 2022 +0200 fbdev: aty128fb: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Cc: Paul Mackerras Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Sam Ravnborg Reviewed-by: Daniel Thompson Signed-off-by: Helge Deller commit 5d1335dabb3c493a3d6d5b233953b6ac7b6c1ff2 Author: Helge Deller Date: Mon Dec 19 20:56:36 2022 +0100 parisc: Fix return code of pdc_iodc_print() There is an off-by-one if the printed string includes a new-line char. Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit f2193bb2ee6e21d9c2da10ea3ce63b94aea69341 Author: Xu Panda Date: Fri Dec 23 10:40:56 2022 +0800 parisc: pdc_stable: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL-terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Signed-off-by: Helge Deller commit 84ee211c83212f4d35b56e0603acdcc41f860f1b Author: Mika Westerberg Date: Thu Sep 8 09:45:22 2022 +0300 thunderbolt: Disable XDomain lane 1 only in software connection manager When firmware connection manager is in use we should not touch the lane adapter (well or any) configuration space so do this only when we know that the software connection manager is active. Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Cc: stable@vger.kernel.org Acked-by: Yehezkel Bernat Signed-off-by: Mika Westerberg commit e8ff07fb33026c5c1bb5b81293496faba5d68059 Author: Mika Westerberg Date: Fri May 20 13:35:19 2022 +0300 thunderbolt: Use correct function to calculate maximum USB3 link rate We need to take minimum of both sides of the USB3 link into consideration, not just the downstream port. Fix this by calling tb_usb3_max_link_rate() instead. Fixes: 0bd680cd900c ("thunderbolt: Add USB3 bandwidth management") Cc: stable@vger.kernel.org Acked-by: Yehezkel Bernat Signed-off-by: Mika Westerberg commit 23257cfc1cb7202fd0065e9f4a6a0aac1c04c4a9 Author: Mika Westerberg Date: Thu Dec 29 14:10:30 2022 +0200 thunderbolt: Do not call PM runtime functions in tb_retimer_scan() We cannot call PM runtime functions in tb_retimer_scan() because it will also be called when retimers are scanned from userspace (happens when there is no device connected on ChromeOS for instance) and at the same USB4 port runtime resume hook. This leads to hang because neither can proceed. Fix this by runtime resuming USB4 ports in tb_scan_port() instead. This makes sure the ports are runtime PM active when retimers are added under it while avoiding the reported hang as well. Reported-by: Utkarsh Patel Fixes: 1e56c88adecc ("thunderbolt: Runtime resume USB4 port when retimers are scanned") Cc: stable@vger.kernel.org Acked-by: Yehezkel Bernat Signed-off-by: Mika Westerberg commit 7d6ceeb1875cc08dc3d1e558e191434d94840cd5 Author: Mirsad Goran Todorovac Date: Sat Jan 7 04:40:20 2023 +0100 af_unix: selftest: Fix the size of the parameter to connect() Adjust size parameter in connect() to match the type of the parameter, to fix "No such file or directory" error in selftests/net/af_unix/ test_oob_unix.c:127. The existing code happens to work provided that the autogenerated pathname is shorter than sizeof (struct sockaddr), which is why it hasn't been noticed earlier. Visible from the trace excerpt: bind(3, {sa_family=AF_UNIX, sun_path="unix_oob_453059"}, 110) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa6a6577a10) = 453060 [pid ] connect(6, {sa_family=AF_UNIX, sun_path="unix_oob_45305"}, 16) = -1 ENOENT (No such file or directory) BUG: The filename is trimmed to sizeof (struct sockaddr). Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Shuah Khan Cc: Kuniyuki Iwashima Cc: Florian Westphal Reviewed-by: Florian Westphal Fixes: 314001f0bf92 ("af_unix: Add OOB support") Signed-off-by: Mirsad Goran Todorovac Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 76761babaa984fce8ecd87d87a68d920f24df438 Author: Horatiu Vultur Date: Fri Jan 6 21:15:07 2023 +0100 net: lan966x: Allow to add rules in TCAM even if not enabled The blamed commit implemented the vcap_operations to allow to add an entry in the TCAM. One of the callbacks is to validate the supported keysets. If the TCAM lookup was not enabled, then this will return failure so no entries could be added. This doesn't make much sense, as you can enable at a later point the TCAM. Therefore change it such to allow entries in TCAM even it is not enabled. Fixes: 4426b78c626d ("net: lan966x: Add port keyset config and callback interface") Signed-off-by: Horatiu Vultur Signed-off-by: David S. Miller commit 7871f54e3deed68a27111dda162c4fe9b9c65f8f Author: Eric Dumazet Date: Fri Jan 6 14:25:23 2023 +0000 gro: take care of DODGY packets Jaroslav reported a recent throughput regression with virtio_net caused by blamed commit. It is unclear if DODGY GSO packets coming from user space can be accepted by GRO engine in the future with minimal changes, and if there is any expected gain from it. In the meantime, make sure to detect and flush DODGY packets. Fixes: 5eddb24901ee ("gro: add support of (hw)gro packets to gro stack") Signed-off-by: Eric Dumazet Reported-and-bisected-by: Jaroslav Pulchart Cc: Coco Li Cc: Paolo Abeni Signed-off-by: David S. Miller commit 9dab880d675b9d0dd56c6428e4e8352a3339371d Author: Minsuk Kang Date: Fri Jan 6 17:23:44 2023 +0900 nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in dummy_timer Call Trace: memcpy (mm/kasan/shadow.c:65) dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352) transfer (drivers/usb/gadget/udc/dummy_hcd.c:1453) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972) arch_static_branch (arch/x86/include/asm/jump_label.h:27) static_key_false (include/linux/jump_label.h:207) timer_expire_exit (include/trace/events/timer.h:127) call_timer_fn (kernel/time/timer.c:1475) expire_timers (kernel/time/timer.c:1519) __run_timers (kernel/time/timer.c:1790) run_timer_softirq (kernel/time/timer.c:1803) Fixes: c46ee38620a2 ("NFC: pn533: add NXP pn533 nfc device driver") Signed-off-by: Minsuk Kang Signed-off-by: David S. Miller commit 2ab6478d1266b522a0a6ce3697914d63529f9e7a Author: Kees Cook Date: Thu Jan 5 15:22:29 2023 -0800 mlxsw: spectrum_router: Replace 0-length array with flexible array Zero-length arrays are deprecated[1]. Replace struct mlxsw_sp_nexthop_group_info's "nexthops" 0-length array with a flexible array. Detected with GCC 13, using -fstrict-flex-arrays=3: drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c: In function 'mlxsw_sp_nexthop_group_hash_obj': drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3278:38: warning: array subscript i is outside array bounds of 'struct mlxsw_sp_nexthop[0]' [-Warray-bounds=] 3278 | val ^= jhash(&nh->ifindex, sizeof(nh->ifindex), seed); | ^~~~~~~~~~~~ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:2954:33: note: while referencing 'nexthops' 2954 | struct mlxsw_sp_nexthop nexthops[0]; | ^~~~~~~~ [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays Cc: Ido Schimmel Cc: Petr Machata Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: "Gustavo A. R. Silva" Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Ido Schimmel Reviewed-by: Gustavo A. R. Silva Tested-by: Petr Machata Signed-off-by: David S. Miller commit 60ea6f00c57dae5e7ba2c52ed407cb24fdb11ebe Author: Alex Elder Date: Fri Jan 6 07:25:01 2023 -0600 net: ipa: correct IPA v4.7 IMEM offset Commit b310de784bacd ("net: ipa: add IPA v4.7 support") was merged despite an unresolved comment made by Konrad Dybcio. Konrad observed that the IMEM region specified for IPA v4.7 did not match that used downstream for the SM7225 SoC. In "lagoon.dtsi" present in a Sony Xperia source tree, a ipa_smmu_ap node was defined with a "qcom,additional-mapping" property that defined the IPA IMEM area starting at offset 0x146a8000 (not 0x146a9000 that was committed). The IPA v4.7 target system used for testing uses the SM7225 SoC, so we'll adhere what the downstream code specifies is the address of the IMEM region used for IPA. Link: https://lore.kernel.org/linux-arm-msm/20221208211529.757669-1-elder@linaro.org Fixes: b310de784bac ("net: ipa: add IPA v4.7 support") Tested-by: Luca Weiss Signed-off-by: Alex Elder Reviewed-by: Konrad Dybcio Signed-off-by: David S. Miller commit fca053893e8d5be8173c92876c6329cbee78b880 Author: Fabio Estevam Date: Mon Jan 2 11:04:02 2023 -0300 arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' The following build warnings are seen when running: make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: cts-gpios: False schema does not allow [[33, 3, 1]] From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: rts-gpios: False schema does not allow [[33, 5, 1]] From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml ... The imx8m Venice Gateworks boards do not expose the UART RTS and CTS as native UART pins, so 'uart-has-rtscts' should not be used. Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination detected by serial.yaml. Fix the problem by removing the incorrect 'uart-has-rtscts' property. Fixes: 27c8f4ccc1b9 ("arm64: dts: imx8mm-venice-gw72xx-0x: add dt overlays for serial modes") Fixes: d9a9a7cf32c9 ("arm64: dts: imx8m{m,n}-venice-*: add missing uart-has-rtscts property to UARTs") Fixes: 870f645b396b ("arm64: dts: imx8mp-venice-gw74xx: add WiFi/BT module support") Signed-off-by: Fabio Estevam Acked-by: Tim Harvey Signed-off-by: Shawn Guo commit a5a36720c3f650f859f5e9535dd62d06f13f4f3b Author: Ivan T. Ivanov Date: Fri Jan 6 15:19:05 2023 +0200 brcmfmac: Prefer DT board type over DMI board type The introduction of support for Apple board types inadvertently changed the precedence order, causing hybrid SMBIOS+DT platforms to look up the firmware using the DMI information instead of the device tree compatible to generate the board type. Revert back to the old behavior, as affected platforms use firmwares named after the DT compatible. Fixes: 7682de8b3351 ("wifi: brcmfmac: of: Fetch Apple properties") [1] https://bugzilla.opensuse.org/show_bug.cgi?id=1206697#c13 Cc: stable@vger.kernel.org Signed-off-by: Ivan T. Ivanov Reviewed-by: Hector Martin Reviewed-by: Arend van Spriel Tested-by: Peter Robinson Signed-off-by: David S. Miller commit 2f440c4f04ca28e3ddf4bb6f3d25f7613abe2873 Author: Marek Vasut Date: Fri Dec 16 01:05:52 2022 +0100 arm64: dts: imx8mm: Reinstate GPIO watchdog always-running property on eDM SBC The GPIO watchdog property name is 'always-running', not 'always-enabled'. Use the correct property name and reinstate it into the DT. Fixes: eff6b33c9ce9 ("arm64: dts: imx8mm: Remove watchdog always-enabled property from eDM SBC") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit f57034cedeb6e00256313a2a6ee67f974d709b0b Author: Oleksii Moisieiev Date: Tue Dec 20 14:50:13 2022 +0000 xen/pvcalls: free active map buffer on pvcalls_front_free_map Data buffer for active map is allocated in alloc_active_ring and freed in free_active_ring function, which is used only for the error cleanup. pvcalls_front_release is calling pvcalls_front_free_map which ends foreign access for this buffer, but doesn't free allocated pages. Call free_active_ring to clean all allocated resources. Signed-off-by: Oleksii Moisieiev Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/6a762ee32dd655cbb09a4aa0e2307e8919761311.1671531297.git.oleksii_moisieiev@epam.com Signed-off-by: Juergen Gross commit c0dccad87cf68fc6012aec7567e354353097ec1a Author: Roger Pau Monne Date: Wed Nov 30 17:36:02 2022 +0100 hvc/xen: lock console list traversal The currently lockless access to the xen console list in vtermno_to_xencons() is incorrect, as additions and removals from the list can happen anytime, and as such the traversal of the list to get the private console data for a given termno needs to happen with the lock held. Note users that modify the list already do so with the lock taken. Adjust current lock takers to use the _irq{save,restore} helpers, since the context in which vtermno_to_xencons() is called can have interrupts disabled. Use the _irq{save,restore} set of helpers to switch the current callers to disable interrupts in the locked region. I haven't checked if existing users could instead use the _irq variant, as I think it's safer to use _irq{save,restore} upfront. While there switch from using list_for_each_entry_safe to list_for_each_entry: the current entry cursor won't be removed as part of the code in the loop body, so using the _safe variant is pointless. Fixes: 02e19f9c7cac ('hvc_xen: implement multiconsole support') Signed-off-by: Roger Pau Monné Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20221130163611.14686-1-roger.pau@citrix.com Signed-off-by: Juergen Gross commit 37c1785609833e626d344047a84e272b7879b2c3 Author: Jiapeng Chong Date: Thu Jan 5 17:01:41 2023 +0800 x86/xen: Remove the unused function p2m_index() The function p2m_index is defined in the p2m.c file, but not called elsewhere, so remove this unused function. arch/x86/xen/p2m.c:137:24: warning: unused function 'p2m_index'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3557 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230105090141.36248-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Juergen Gross commit b0355dbbf13c0052931dd14c38c789efed64d3de Author: Benedict Wong Date: Thu Jan 5 21:28:12 2023 +0000 Fix XFRM-I support for nested ESP tunnels This change adds support for nested IPsec tunnels by ensuring that XFRM-I verifies existing policies before decapsulating a subsequent policies. Addtionally, this clears the secpath entries after policies are verified, ensuring that previous tunnels with no-longer-valid do not pollute subsequent policy checks. This is necessary especially for nested tunnels, as the IP addresses, protocol and ports may all change, thus not matching the previous policies. In order to ensure that packets match the relevant inbound templates, the xfrm_policy_check should be done before handing off to the inner XFRM protocol to decrypt and decapsulate. Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer. Test: Verified with additional Android Kernel Unit tests Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert commit 49e4d04f0486117ac57a97890eb1db6d52bf82b3 Author: Tejun Heo Date: Fri Jan 6 10:34:10 2023 -1000 block: Drop spurious might_sleep() from blk_put_queue() Dan reports the following smatch detected the following: block/blk-cgroup.c:1863 blkcg_schedule_throttle() warn: sleeping in atomic context caused by blkcg_schedule_throttle() calling blk_put_queue() in an non-sleepable context. blk_put_queue() acquired might_sleep() in 63f93fd6fa57 ("block: mark blk_put_queue as potentially blocking") which transferred the might_sleep() from blk_free_queue(). blk_free_queue() acquired might_sleep() in e8c7d14ac6c3 ("block: revert back to synchronous request_queue removal") while turning request_queue removal synchronous. However, this isn't necessary as nothing in the free path actually requires sleeping. It's pretty unusual to require a sleeping context in a put operation and it's not needed in the first place. Let's drop it. Signed-off-by: Tejun Heo Reported-by: Dan Carpenter Link: https://lkml.kernel.org/r/Y7g3L6fntnTtOm63@kili Cc: Christoph Hellwig Cc: Luis Chamberlain Fixes: e8c7d14ac6c3 ("block: revert back to synchronous request_queue removal") # v5.9+ Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/Y7iFwjN+XzWvLv3y@slm.duckdns.org Signed-off-by: Jens Axboe commit b409ea4534204d4e6da3017d8713ce338f44b489 Author: Masahiro Yamada Date: Sun Jan 8 21:35:57 2023 +0900 init/version-timestamp.c: remove unneeded #include The kbuild test robot detected this by 'make versioncheck'. Fixes: 2df8220cc511 ("kbuild: build init/built-in.a just once") Reported-by: kernel test robot Signed-off-by: Masahiro Yamada commit e3c9405ec56b6b0a75d993427bfc7f4194f73754 Author: Miguel Ojeda Date: Sat Jan 7 15:37:47 2023 +0100 docs: kbuild: remove mention to dropped $(objtree) feature Commit 8d613a1d048c ("kbuild: drop $(objtree)/ prefix support for clean-files") dropped support for prefixing with $(objtree). Thus update the documentation to match that change. Signed-off-by: Miguel Ojeda Signed-off-by: Masahiro Yamada commit f71eaf2708be7831428eacae7db25d8ec6b8b4c5 Author: Yuan Can Date: Wed Nov 23 09:42:00 2022 +0000 bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() The sunxi_rsb_init() returns the platform_driver_register() directly without checking its return value, if platform_driver_register() failed, the sunxi_rsb_bus is not unregistered. Fix by unregister sunxi_rsb_bus when platform_driver_register() failed. Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus") Signed-off-by: Yuan Can Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20221123094200.12036-1-yuancan@huawei.com Signed-off-by: Jernej Skrabec commit 1fe4fd6f5cad346e598593af36caeadc4f5d4fa9 Merge: b7bfaa761d760 601a27ea09a31 Author: Linus Torvalds Date: Sun Jan 8 12:11:45 2023 -0600 Merge tag 'xfs-6.2-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: - Remove some incorrect assertions - Fix compiler warnings about variables that could be static - Fix an off by one error when computing the maximum btree height that can cause repair failures - Fix the bulkstat-single ioctl not returning the root inode when asked to do that - Convey NOFS state to inodegc workers to avoid recursion in reclaim - Fix unnecessary variable initializations - Fix a bug that could result in corruption of the busy extent tree * tag 'xfs-6.2-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix extent busy updating xfs: xfs_qm: remove unnecessary ‘0’ values from error xfs: Fix deadlock on xfs_inodegc_worker xfs: get root inode correctly at bulkstat xfs: fix off-by-one error in xfs_btree_space_to_height xfs: make xfs_iomap_page_ops static xfs: don't assert if cmap covers imap after cycling lock commit b7bfaa761d760e72a969d116517eaa12e404c262 Author: Linus Torvalds Date: Sun Jan 8 11:49:43 2023 -0600 Linux 6.2-rc3 commit e6db6f9398dadcbc06318a133d4c44a2d3844e61 Author: Jens Axboe Date: Sun Jan 8 10:39:17 2023 -0700 io_uring/io-wq: only free worker if it was allocated for creation We have two types of task_work based creation, one is using an existing worker to setup a new one (eg when going to sleep and we have no free workers), and the other is allocating a new worker. Only the latter should be freed when we cancel task_work creation for a new worker. Fixes: af82425c6a2d ("io_uring/io-wq: free worker if task_work creation is canceled") Reported-by: syzbot+d56ec896af3637bdb7e4@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 115d9d77bb0f9152c60b6e8646369fa7f6167593 Author: Aaron Thompson Date: Fri Jan 6 22:22:44 2023 +0000 mm: Always release pages to the buddy allocator in memblock_free_late(). If CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, memblock_free_pages() only releases pages to the buddy allocator if they are not in the deferred range. This is correct for free pages (as defined by for_each_free_mem_pfn_range_in_zone()) because free pages in the deferred range will be initialized and released as part of the deferred init process. memblock_free_pages() is called by memblock_free_late(), which is used to free reserved ranges after memblock_free_all() has run. All pages in reserved ranges have been initialized at that point, and accordingly, those pages are not touched by the deferred init process. This means that currently, if the pages that memblock_free_late() intends to release are in the deferred range, they will never be released to the buddy allocator. They will forever be reserved. In addition, memblock_free_pages() calls kmsan_memblock_free_pages(), which is also correct for free pages but is not correct for reserved pages. KMSAN metadata for reserved pages is initialized by kmsan_init_shadow(), which runs shortly before memblock_free_all(). For both of these reasons, memblock_free_pages() should only be called for free pages, and memblock_free_late() should call __free_pages_core() directly instead. One case where this issue can occur in the wild is EFI boot on x86_64. The x86 EFI code reserves all EFI boot services memory ranges via memblock_reserve() and frees them later via memblock_free_late() (efi_reserve_boot_services() and efi_free_boot_services(), respectively). If any of those ranges happens to fall within the deferred init range, the pages will not be released and that memory will be unavailable. For example, on an Amazon EC2 t3.micro VM (1 GB) booting via EFI: v6.2-rc2: # grep -E 'Node|spanned|present|managed' /proc/zoneinfo Node 0, zone DMA spanned 4095 present 3999 managed 3840 Node 0, zone DMA32 spanned 246652 present 245868 managed 178867 v6.2-rc2 + patch: # grep -E 'Node|spanned|present|managed' /proc/zoneinfo Node 0, zone DMA spanned 4095 present 3999 managed 3840 Node 0, zone DMA32 spanned 246652 present 245868 managed 222816 # +43,949 pages Fixes: 3a80a7fa7989 ("mm: meminit: initialise a subset of struct pages if CONFIG_DEFERRED_STRUCT_PAGE_INIT is set") Signed-off-by: Aaron Thompson Link: https://lore.kernel.org/r/01010185892de53e-e379acfb-7044-4b24-b30a-e2657c1ba989-000000@us-west-2.amazonses.com Signed-off-by: Mike Rapoport (IBM) commit 93928d485d9df12be724cbdf1caa7d197b65001e Merge: e9ffbf16caa6c be5f95c8779e1 Author: Linus Torvalds Date: Sun Jan 8 06:55:08 2023 -0700 Merge tag 'powerpc-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Three fixes for various bogosity in our linker script, revealed by the recent commit which changed discard behaviour with some toolchains. * tag 'powerpc-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/vmlinux.lds: Don't discard .comment powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT commit c9c1d6d82091f05b4dabf2c624bdaeba19bdf893 Author: Vladimir Oltean Date: Tue Jan 3 15:03:48 2023 +0200 iio: imu: st_lsm6dsx: fix build when CONFIG_IIO_TRIGGERED_BUFFER=m The following kernel linkage error: st_lsm6dsx_core.o: in function `st_lsm6dsx_sw_buffers_setup': st_lsm6dsx_core.c:2578: undefined reference to `devm_iio_triggered_buffer_setup_ext' is caused by the fact that the object owning devm_iio_triggered_buffer_setup_ext() (drivers/iio/buffer/industrialio-triggered-buffer.o) is allowed to be built as module when its user (drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c) is built-in. The st_lsm6dsx driver already has a "select IIO_BUFFER", so add another select for IIO_TRIGGERED_BUFFER, to make that option follow what is set for the st_lsm6dsx driver. This is similar to what other iio drivers do. Fixes: 2cfb2180c3e8 ("iio: imu: st_lsm6dsx: introduce sw trigger support") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230103130348.1733467-1-vladimir.oltean@nxp.com Cc: Signed-off-by: Jonathan Cameron commit e9ffbf16caa6cb596df7fd641bc6063a922c52e6 Merge: 9b43a525db125 fa81ab49bbe4e Author: Linus Torvalds Date: Sun Jan 8 02:54:24 2023 -0800 Merge tag 'fixes-2023-01-08' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fixes from Mike Rapoport: "Small fixes in kernel-doc and tests: - Fix kernel-doc for memblock_phys_free() to use correct names for the counterpart allocation methods - Fix compilation error in memblock tests" * tag 'fixes-2023-01-08' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: Fix doc for memblock_phys_free memblock tests: Fix compilation error. commit 571f3dd0d01b62ec63a4039320dbdbcd54ae8fb0 Merge: b4e9b8763e417 42f229c350f57 Author: David S. Miller Date: Sat Jan 7 23:10:33 2023 +0000 Merge tag 'rxrpc-fixes-20230107' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc: Fix race between call connection, data transmit and call disconnect Here are patches to fix an oops[1] caused by a race between call connection, initial packet transmission and call disconnection which results in something like: kernel BUG at net/rxrpc/peer_object.c:413! when the syzbot test is run. The problem is that the connection procedure is effectively split across two threads and can get expanded by taking an interrupt, thereby adding the call to the peer error distribution list *after* it has been disconnected (say by the rxrpc socket shutting down). The easiest solution is to look at the fourth set of I/O thread conversion/SACK table expansion patches that didn't get applied[2] and take from it those patches that move call connection and disconnection into the I/O thread. Moving these things into the I/O thread means that the sequencing is managed by all being done in the same thread - and the race can no longer happen. This is preferable to introducing an extra lock as adding an extra lock would make the I/O thread have to wait for the app thread in yet another place. The changes can be considered as a number of logical parts: (1) Move all of the call state changes into the I/O thread. (2) Make client connection ID space per-local endpoint so that the I/O thread doesn't need locks to access it. (3) Move actual abort generation into the I/O thread and clean it up. If sendmsg or recvmsg want to cause an abort, they have to delegate it. (4) Offload the setting up of the security context on a connection to the thread of one of the apps that's starting a call. We don't want to be doing any sort of crypto in the I/O thread. (5) Connect calls (ie. assign them to channel slots on connections) in the I/O thread. Calls are set up by sendmsg/kafs and passed to the I/O thread to connect. Connections are allocated in the I/O thread after this. (6) Disconnect calls in the I/O thread. I've also added a patch for an unrelated bug that cropped up during testing, whereby a race can occur between an incoming call and socket shutdown. Note that whilst this fixes the original syzbot bug, another bug may get triggered if this one is fixed: INFO: rcu detected stall in corrupted rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P5792 } 2657 jiffies s: 2825 root: 0x0/T rcu: blocking rcu_node structures (internal RCU debug): It doesn't look this should be anything to do with rxrpc, though, as I've tested an additional patch[3] that removes practically all the RCU usage from rxrpc and it still occurs. It seems likely that it is being caused by something in the tunnelling setup that the syzbot test does, but there's not enough info to go on. It also seems unlikely to be anything to do with the afs driver as the test doesn't use that. ==================== Signed-off-by: David S. Miller commit 43d5f5d63699724d47f0d9e0eae516a260d232b4 Author: Ben Dooks Date: Fri Jan 6 13:44:56 2023 +0000 riscv: dts: sifive: fu740: fix size of pcie 32bit memory The 32-bit memory resource is needed for non-prefetchable memory allocations on the PCIe bus, however with some cards (such as the SM768) the system fails to allocate memory from this. Checking the allocation against the datasheet, it looks like there has been a mis-calcualation of the resource for the first memory region (0x0060090000..0x0070ffffff) which in the data-sheet for the fu740 (v1p2) is from 0x0060000000..0x007fffffff. Changing this to allocate from 0x0060090000..0x007fffffff fixes the probing issues. Fixes: ae80d5148085 ("riscv: dts: Add PCIe support for the SiFive FU740-C000 SoC") Cc: Paul Walmsley Cc: Greentime Hu Signed-off-by: Ben Dooks Cc: stable@vger.kernel.org Tested-by: Ron Economos # from IRC Reviewed-by: Conor Dooley Signed-off-by: Conor Dooley commit 9b43a525db125799df81e6fbef712a2ae50bfc5d Merge: f18fca98ac162 5e9a7b9c2ea18 Author: Linus Torvalds Date: Sat Jan 7 10:38:11 2023 -0800 Merge tag 'nfs-for-6.2-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: - Fix a race in the RPCSEC_GSS upcall code that causes hung RPC calls - Fix a broken coalescing test in the pNFS file layout driver - Ensure that the access cache rcu path also applies the login test - Fix up for a sparse warning * tag 'nfs-for-6.2-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: Fix up a sparse warning NFS: Judge the file access cache's timestamp in rcu path pNFS/filelayout: Fix coalescing test for single DS SUNRPC: ensure the matching upcall is in-flight upon downcall commit f18fca98ac1622220dfdf795fefa91dc52d3707d Merge: 0007c04038e5a cc7d79d4fad6a Author: Linus Torvalds Date: Sat Jan 7 10:26:34 2023 -0800 Merge tag '6.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "cifs/smb3 client fixes: - two multichannel fixes - three reconnect fixes - unmap fix" * tag '6.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix interface count calculation during refresh cifs: refcount only the selected iface during interface update cifs: protect access of TCP_Server_Info::{dstaddr,hostname} cifs: fix race in assemble_neg_contexts() cifs: ignore ipc reconnect failures during dfs failover cifs: Fix kmap_local_page() unmapping commit 0007c04038e5a3111bea1c4588bfb6778a69131d Merge: c28bdeaf5d723 064e32dc5b031 Author: Linus Torvalds Date: Sat Jan 7 10:20:33 2023 -0800 Merge tag 'devicetree-fixes-for-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix DT memory scanning for some MIPS boards when memory is not specified in DT - Redo CONFIG_CMDLINE* handling for missing /chosen node. The first attempt broke PS3 (and possibly other PPC platforms). - Fix constraints in QCom Soundwire schema * tag 'devicetree-fixes-for-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 Revert "of: fdt: Honor CONFIG_CMDLINE* even without /chosen node" dt-bindings: soundwire: qcom,soundwire: correct sizes related to number of ports of/fdt: run soc memory setup when early_init_dt_scan_memory fails commit c28bdeaf5d723b40c8e2901662f4e8acd574e839 Merge: 4a4dcea083139 c4e3ef5685393 Author: Linus Torvalds Date: Sat Jan 7 10:12:42 2023 -0800 Merge tag 'usb-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes for 6.2-rc3 that resolve some reported issues. They include: - of-reported ulpi problem, so the offending commit is reverted - dwc3 driver bugfixes for recent changes - fotg210 fixes Most of these have been in linux-next for a while, the last few were on the mailing list for a long time and passed all the 0-day bot testing so all should be fine with them as well" * tag 'usb-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: dwc3: gadget: Ignore End Transfer delay on teardown usb: dwc3: xilinx: include linux/gpio/consumer.h usb: fotg210-udc: fix error return code in fotg210_udc_probe() usb: fotg210: fix OTG-only build Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" commit 4a4dcea0831394b876ae955ecf49ba072ffbf059 Merge: a7c4127a29ce2 e95d50d74b93a Author: Linus Torvalds Date: Sat Jan 7 10:06:47 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Most noticeable is that Yishai found a big data corruption regression due to a change in the scatterlist: - Do not wrongly combine non-contiguous pages in scatterlist - Fix compilation warnings on gcc 13 - Oops when using some mlx5 stats - Bad enforcement of atomic responder resources in mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: lib/scatterlist: Fix to merge contiguous pages into the last SG properly RDMA/mlx5: Fix validation of max_rd_atomic caps for DC RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device RDMA/srp: Move large values to a new enum for gcc13 commit a7c4127a29ce222c9fa4fb4ae5b15e182a1ee5c9 Merge: 0a71553536d27 735aec59afb18 Author: Linus Torvalds Date: Sat Jan 7 09:49:52 2023 -0800 Merge tag 'kbuild-fixes-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix single *.ko build - Fix module builds when vmlinux.o or Module.symver is missing * tag 'kbuild-fixes-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: readd -w option when vmlinux.o or Module.symver is missing kbuild: fix single *.ko build commit 5304930dbae82d259bcf7e5611db7c81e7a42eff Author: Chuck Lever Date: Sat Jan 7 10:15:35 2023 -0500 NFSD: Use set_bit(RQ_DROPME) The premise that "Once an svc thread is scheduled and executing an RPC, no other processes will touch svc_rqst::rq_flags" is false. svc_xprt_enqueue() examines the RQ_BUSY flag in scheduled nfsd threads when determining which thread to wake up next. Fixes: 9315564747cb ("NFSD: Use only RQ_DROPME to signal the need to drop a reply") Signed-off-by: Chuck Lever commit c0f7ae27539fbac267384a7bfc58296ea7550d52 Author: Tudor Ambarus Date: Mon Dec 26 16:40:43 2022 +0200 MAINTAINERS: Update email of Tudor Ambarus My professional email will change and the microchip one will bounce after mid-november of 2022. Update the MAINTAINERS file, the YAML bindings, MODULE_AUTHOR entries and author mentions, and add an entry in the .mailmap file. Signed-off-by: Tudor Ambarus Acked-by: Rob Herring Acked-by: Pratyush Yadav Acked-by: Mark Brown Acked-by: Nicolas Ferre Acked-by: Herbert Xu Acked-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20221226144043.367706-1-tudor.ambarus@linaro.org commit df4840c1b880136fea97a1d64724995778c2475f Author: Masahiro Yamada Date: Sat Jan 7 16:47:42 2023 +0900 tomoyo: avoid unneeded creation of builtin-policy.h When CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING=y, builtin-policy.h is unneeded. Signed-off-by: Masahiro Yamada Signed-off-by: Tetsuo Handa commit eaf2213ba563b2d74a1f2c13a6b258273f689802 Author: Masahiro Yamada Date: Sat Jan 7 16:47:41 2023 +0900 tomoyo: fix broken dependency on *.conf.default If *.conf.default is updated, builtin-policy.h should be rebuilt, but this does not work when compiled with O= option. [Without this commit] $ touch security/tomoyo/policy/exception_policy.conf.default $ make O=/tmp security/tomoyo/ make[1]: Entering directory '/tmp' GEN Makefile CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh DESCEND objtool make[1]: Leaving directory '/tmp' [With this commit] $ touch security/tomoyo/policy/exception_policy.conf.default $ make O=/tmp security/tomoyo/ make[1]: Entering directory '/tmp' GEN Makefile CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh DESCEND objtool POLICY security/tomoyo/builtin-policy.h CC security/tomoyo/common.o AR security/tomoyo/built-in.a make[1]: Leaving directory '/tmp' $(srctree)/ is essential because $(wildcard ) does not follow VPATH. Fixes: f02dee2d148b ("tomoyo: Do not generate empty policy files") Signed-off-by: Masahiro Yamada Signed-off-by: Tetsuo Handa commit 7fb3ff22ad8772bbf0e3ce1ef3eb7b09f431807f Author: Yair Podemsky Date: Wed Nov 30 14:51:21 2022 +0200 sched/core: Fix arch_scale_freq_tick() on tickless systems In order for the scheduler to be frequency invariant we measure the ratio between the maximum CPU frequency and the actual CPU frequency. During long tickless periods of time the calculations that keep track of that might overflow, in the function scale_freq_tick(): if (check_shl_overflow(acnt, 2*SCHED_CAPACITY_SHIFT, &acnt)) goto error; eventually forcing the kernel to disable the feature for all CPUs, and show the warning message: "Scheduler frequency invariance went wobbly, disabling!". Let's avoid that by limiting the frequency invariant calculations to CPUs with regular tick. Fixes: e2b0d619b400 ("x86, sched: check for counters overflow in frequency invariant accounting") Suggested-by: "Peter Zijlstra (Intel)" Signed-off-by: Yair Podemsky Signed-off-by: Ingo Molnar Reviewed-by: Valentin Schneider Acked-by: Giovanni Gherdovich Link: https://lore.kernel.org/r/20221130125121.34407-1-ypodemsk@redhat.com commit a67aad57d9aee41180aff36e54cb72fe4b8d5a5a Author: Xingui Yang Date: Wed Dec 21 01:52:03 2022 +0000 scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() Grab the ATA port lock in sas_ata_device_link_abort() before calling ata_link_abort() as outlined in this function's locking requirements. Fixes: 44112922674b ("scsi: libsas: Add sas_ata_device_link_abort()") Signed-off-by: Xingui Yang Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit ea44242bbfcde2993fb27ec7c3ad5ab5cc39e438 Author: Jason Yan Date: Thu Dec 15 12:09:25 2022 +0800 scsi: hisi_sas: Fix tag freeing for reserved tags The reserved tags were put in the lower region of the tagset in commit f7d190a94e35 ("scsi: hisi_sas: Put reserved tags in lower region of tagset"). However, only the allocate function was changed, freeing was not handled. This resulted in a failure to boot: [ 33.467345] hisi_sas_v3_hw 0000:b4:02.0: task exec: failed[-132]! [ 33.473413] sas: Executing internal abort failed 5000000000000603 (-132) [ 33.480088] hisi_sas_v3_hw 0000:b4:02.0: I_T nexus reset: internal abort (-132) [ 33.657336] hisi_sas_v3_hw 0000:b4:02.0: task exec: failed[-132]! [ 33.663403] ata7.00: failed to IDENTIFY (I/O error, err_mask=0x40) [ 35.787344] hisi_sas_v3_hw 0000:b4:04.0: task exec: failed[-132]! [ 35.793411] sas: Executing internal abort failed 5000000000000703 (-132) [ 35.800084] hisi_sas_v3_hw 0000:b4:04.0: I_T nexus reset: internal abort (-132) [ 35.977335] hisi_sas_v3_hw 0000:b4:04.0: task exec: failed[-132]! [ 35.983403] ata10.00: failed to IDENTIFY (I/O error, err_mask=0x40) [ 35.989643] ata10.00: revalidation failed (errno=-5) Fixes: f7d190a94e35 ("scsi: hisi_sas: Put reserved tags in lower region of tagset") Cc: John Garry Cc: Xiang Chen Signed-off-by: Jason Yan Reviewed-by: John Garry Acked-by: Xiang Chen Signed-off-by: Martin K. Petersen commit 42f229c350f57a8e825f7591e17cbc5c87e50235 Author: David Howells Date: Fri Jan 6 13:03:18 2023 +0000 rxrpc: Fix incoming call setup race An incoming call can race with rxrpc socket destruction, leading to a leaked call. This may result in an oops when the call timer eventually expires: BUG: kernel NULL pointer dereference, address: 0000000000000874 RIP: 0010:_raw_spin_lock_irqsave+0x2a/0x50 Call Trace: try_to_wake_up+0x59/0x550 ? __local_bh_enable_ip+0x37/0x80 ? rxrpc_poke_call+0x52/0x110 [rxrpc] ? rxrpc_poke_call+0x110/0x110 [rxrpc] ? rxrpc_poke_call+0x110/0x110 [rxrpc] call_timer_fn+0x24/0x120 with a warning in the kernel log looking something like: rxrpc: Call 00000000ba5e571a still in use (1,SvAwtACK,1061d,0)! incurred during rmmod of rxrpc. The 1061d is the call flags: RECVMSG_READ_ALL, RX_HEARD, BEGAN_RX_TIMER, RX_LAST, EXPOSED, IS_SERVICE, RELEASED but no DISCONNECTED flag (0x800), so it's an incoming (service) call and it's still connected. The race appears to be that: (1) rxrpc_new_incoming_call() consults the service struct, checks sk_state and allocates a call - then pauses, possibly for an interrupt. (2) rxrpc_release_sock() sets RXRPC_CLOSE, nulls the service pointer, discards the prealloc and releases all calls attached to the socket. (3) rxrpc_new_incoming_call() resumes, launching the new call, including its timer and attaching it to the socket. Fix this by read-locking local->services_lock to access the AF_RXRPC socket providing the service rather than RCU in rxrpc_new_incoming_call(). There's no real need to use RCU here as local->services_lock is only write-locked by the socket side in two places: when binding and when shutting down. Fixes: 5e6ef4f1017c ("rxrpc: Make the I/O thread take over the call and local processor work") Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org commit ae50e2ab122cef68f46b7799fb9deffe3334f5e2 Author: Takashi Iwai Date: Thu Jan 5 10:35:31 2023 +0100 ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle The runtime PM core checks with runtime_idle callback whether it can goes to the runtime suspend or not, and we can put the boost type check there instead of runtime_suspend and _resume calls. This will reduce the unnecessary runtime_suspend() calls. Fixes: 1873ebd30cc8 ("ALSA: hda: cs35l41: Support Hibernation during Suspend") Cc: Link: https://lore.kernel.org/r/20230105093531.16960-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 15a59cb0a3d6ddf2cb79f8dc3081b3130aad3767 Author: Takashi Iwai Date: Thu Jan 5 10:35:30 2023 +0100 ALSA: hda: cs35l41: Don't return -EINVAL from system suspend/resume The recent commit to support the system suspend for CS35L41 caused a regression on the models with CS35L41_EXT_BOOST_NO_VSPK_SWITC boost type, as the suspend/resume callbacks just return -EINVAL. This is eventually handled as a fatal error and blocks the whole system suspend/resume. For avoiding the problem, this patch corrects the return code from cs35l41_system_suspend() and _resume() to 0, and replace dev_err() with dev_err_once() for stop spamming too much. Fixes: 88672826e2a4 ("ALSA: hda: cs35l41: Support System Suspend") Cc: Link: https://lore.kernel.org/all/e6751ac2-34f3-d13f-13db-8174fade8308@pm.me Link: https://lore.kernel.org/r/20230105093531.16960-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4414c1f5c7a375eaa108676a56e12cc8234eb647 Author: Max Filippov Date: Fri Jan 6 23:30:57 2023 -0800 xtensa: drop unused members of struct thread_struct bad_vaddr, bad_uaddr and error_code fields are set but never read by the xtensa arch-specific code. Drop them. Also drop the commented out info field. Signed-off-by: Max Filippov commit b4e9b8763e417db31c7088103cc557d55cb7a8f5 Author: Angela Czubak Date: Thu Jan 5 21:31:07 2023 +0530 octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable PF netdev can request AF to enable or disable reception and transmission on assigned CGX::LMAC. The current code instead of disabling or enabling 'reception and transmission' also disables/enable the LMAC. This patch fixes this issue. Fixes: 1435f66a28b4 ("octeontx2-af: CGX Rx/Tx enable/disable mbox handlers") Signed-off-by: Angela Czubak Signed-off-by: Hariprasad Kelam Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230105160107.17638-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 0a71553536d270e988580a3daa9fc87535908221 Merge: 1382999aa0548 5193326c4c5a6 Author: Linus Torvalds Date: Fri Jan 6 15:54:25 2023 -0800 Merge tag 'drm-fixes-2023-01-06' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Still not much, but more than last week. Dave should be back next week from the beaching. drivers: - i915-gvt fixes - amdgpu/kfd fixes - panfrost bo refcounting fix - meson afbc corruption fix - imx plane width fix core: - drm/sched fixes - drm/mm kunit test fix - dma-buf export error handling fixes" * tag 'drm-fixes-2023-01-06' of git://anongit.freedesktop.org/drm/drm: Revert "drm/amd/display: Enable Freesync Video Mode by default" drm/i915/gvt: fix double free bug in split_2MB_gtt_entry drm/i915/gvt: use atomic operations to change the vGPU status drm/i915/gvt: fix vgpu debugfs clean in remove drm/i915/gvt: fix gvt debugfs destroy drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at DPM1 and not DPM0 drm/amdkfd: Fix kernel warning during topology setup drm/scheduler: Fix lockup in drm_sched_entity_kill() drm/imx: ipuv3-plane: Fix overlay plane width drm/scheduler: Fix lockup in drm_sched_entity_kill() drm/virtio: Fix memory leak in virtio_gpu_object_create() drm/meson: Reduce the FIFO lines held when AFBC is not used drm/tests: reduce drm_mm_test stack usage drm/panfrost: Fix GEM handle creation ref-counting drm/plane-helper: Add the missing declaration of drm_atomic_state dma-buf: fix dma_buf_export init order v2 commit 1382999aa0548a171a272ca817f6c38e797c458c Author: Jason A. Donenfeld Date: Fri Jan 6 04:01:56 2023 +0100 tpm: Allow system suspend to continue when TPM suspend fails TPM 1 is sometimes broken across system suspends, due to races or locking issues or something else that haven't been diagnosed or fixed yet, most likely having to do with concurrent reads from the TPM's hardware random number generator driver. These issues prevent the system from actually suspending, with errors like: tpm tpm0: A TPM error (28) occurred continue selftest ... tpm tpm0: A TPM error (28) occurred attempting get random ... tpm tpm0: Error (28) sending savestate before suspend tpm_tis 00:08: PM: __pnp_bus_suspend(): tpm_pm_suspend+0x0/0x80 returns 28 tpm_tis 00:08: PM: dpm_run_callback(): pnp_bus_suspend+0x0/0x10 returns 28 tpm_tis 00:08: PM: failed to suspend: error 28 PM: Some devices failed to suspend, or early wake event detected This issue was partially fixed by 23393c646142 ("char: tpm: Protect tpm_pm_suspend with locks"), in a last minute 6.1 commit that Linus took directly because the TPM maintainers weren't available. However, it seems like this just addresses the most common cases of the bug, rather than addressing it entirely. So there are more things to fix still, apparently. In lieu of actually fixing the underlying bug, just allow system suspend to continue, so that laptops still go to sleep fine. Later, this can be reverted when the real bug is fixed. Link: https://lore.kernel.org/lkml/7cbe96cf-e0b5-ba63-d1b4-f63d2e826efa@suse.cz/ Cc: stable@vger.kernel.org # 6.1+ Reported-by: Vlastimil Babka Suggested-by: Linus Torvalds Acked-by: Luigi Semenzato Cc: Peter Huewe Cc: Jarkko Sakkinen Cc: James Bottomley Cc: Johannes Altmanninger Signed-off-by: Jason A. Donenfeld Signed-off-by: Linus Torvalds commit cb7a95af78d29442b8294683eca4897544b8ef46 Author: Linus Torvalds Date: Wed Jan 4 11:06:28 2023 -0800 hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling Commit 55d1cbbbb29e ("hfs/hfsplus: use WARN_ON for sanity check") fixed a build warning by turning a comment into a WARN_ON(), but it turns out that syzbot then complains because it can trigger said warning with a corrupted hfs image. The warning actually does warn about a bad situation, but we are much better off just handling it as the error it is. So rather than warn about us doing bad things, stop doing the bad things and return -EIO. While at it, also fix a memory leak that was introduced by an earlier fix for a similar syzbot warning situation, and add a check for one case that historically wasn't handled at all (ie neither comment nor subsequent WARN_ON). Reported-by: syzbot+7bb7cd3595533513a9e7@syzkaller.appspotmail.com Fixes: 55d1cbbbb29e ("hfs/hfsplus: use WARN_ON for sanity check") Fixes: 8d824e69d9f3 ("hfs: fix OOB Read in __hfs_brec_find") Link: https://lore.kernel.org/lkml/000000000000dbce4e05f170f289@google.com/ Tested-by: Michael Schmitz Cc: Arnd Bergmann Cc: Matthew Wilcox Cc: Viacheslav Dubeyko Signed-off-by: Linus Torvalds commit a3d81bc1eaef48e34dd0b9b48eefed9e02a06451 Author: Hao Sun Date: Fri Jan 6 16:48:38 2023 +0800 bpf: Skip task with pid=1 in send_signal_common() The following kernel panic can be triggered when a task with pid=1 attaches a prog that attempts to send killing signal to itself, also see [1] for more details: Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 3 PID: 1 Comm: systemd Not tainted 6.1.0-09652-g59fe41b5255f #148 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x100/0x178 lib/dump_stack.c:106 panic+0x2c4/0x60f kernel/panic.c:275 do_exit.cold+0x63/0xe4 kernel/exit.c:789 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x2460/0x2600 kernel/signal.c:2858 arch_do_signal_or_restart+0x78/0x5d0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd So skip task with pid=1 in bpf_send_signal_common() to avoid the panic. [1] https://lore.kernel.org/bpf/20221222043507.33037-1-sunhao.th@gmail.com Signed-off-by: Hao Sun Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230106084838.12690-1-sunhao.th@gmail.com commit a689b938df39ab513026c53fb7011fd7cd594943 Merge: ef1a4a770994b b2b50d572135c Author: Linus Torvalds Date: Fri Jan 6 13:12:42 2023 -0800 Merge tag 'block-2023-01-06' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "The big change here is obviously the revert of the pktcdvd driver removal. Outside of that, just minor tweaks. In detail: - Re-instate the pktcdvd driver, which necessitates adding back bio_copy_data_iter() and the fops->devnode() hook for now (me) - Fix for splitting of a bio marked as NOWAIT, causing either nowait reads or writes to error with EAGAIN even if parts of the IO completed (me) - Fix for ublk, punting management commands to io-wq as they can all easily block for extended periods of time (Ming) - Removal of SRCU dependency for the block layer (Paul)" * tag 'block-2023-01-06' of git://git.kernel.dk/linux: block: Remove "select SRCU" Revert "pktcdvd: remove driver." Revert "block: remove devnode callback from struct block_device_operations" Revert "block: bio_copy_data_iter" ublk: honor IO_URING_F_NONBLOCK for handling control command block: don't allow splitting of a REQ_NOWAIT bio block: handle bio_split_to_limits() NULL return commit ef1a4a770994b97a86988fd86f5a2784b87449f7 Merge: 93387d499e494 12521a5d5cb7f Author: Linus Torvalds Date: Fri Jan 6 13:05:13 2023 -0800 Merge tag 'io_uring-2023-01-06' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A few minor fixes that should go into the 6.2 release: - Fix for a memory leak in io-wq worker creation, if we ultimately end up canceling the worker creation before it gets created (me) - lockdep annotations for the CQ locking (Pavel) - A regression fix for CQ timeout handling (Pavel) - Ring pinning around deferred task_work fix (Pavel) - A trivial member move in struct io_ring_ctx, saving us some memory (me)" * tag 'io_uring-2023-01-06' of git://git.kernel.dk/linux: io_uring: fix CQ waiting timeout handling io_uring: move 'poll_multi_queue' bool in io_ring_ctx io_uring: lockdep annotate CQ locking io_uring: pin context while queueing deferred tw io_uring/io-wq: free worker if task_work creation is canceled commit 93387d499e49429eef2c343ab6f9f5d92ec780a2 Merge: 5c1a712f71286 191f8453fc99a Author: Linus Torvalds Date: Fri Jan 6 12:54:51 2023 -0800 Merge tag 'tif-notify-signal-2023-01-06' of git://git.kernel.dk/linux Pull arm TIF_NOTIFY_SIGNAL fixup from Jens Axboe: "Hui Tang reported a performance regressions with _TIF_WORK_MASK in newer kernels, which he tracked to a change that went into 5.11. After this change, we'll call do_work_pending() more often than we need to, because we're now testing bits 0..15 rather than just 0..7. Shuffle the bits around to avoid this" * tag 'tif-notify-signal-2023-01-06' of git://git.kernel.dk/linux: ARM: renumber bits related to _TIF_WORK_MASK commit 5c1a712f71286b8435d48e3be5f8faf39a4cc837 Merge: 7b8c854cfe8c9 8e1858710d9a7 Author: Linus Torvalds Date: Fri Jan 6 12:11:41 2023 -0800 Merge tag 'ceph-for-6.2-rc3' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Two file locking fixes from Xiubo" * tag 'ceph-for-6.2-rc3' of https://github.com/ceph/ceph-client: ceph: avoid use-after-free in ceph_fl_release_lock() ceph: switch to vfs_inode_has_locks() to fix file lock bug commit 7b8c854cfe8c94b2ec382a3632b1bd7c970c80b4 Merge: fc7b76c4a4d13 23970a1c9475b Author: Linus Torvalds Date: Fri Jan 6 12:07:00 2023 -0800 Merge tag 'fixes_for_v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF fixes from Jan Kara: "Two fixups of the UDF changes that went into 6.2-rc1" * tag 'fixes_for_v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: initialize newblock to 0 udf: Fix extension of the last extent in the file commit 31abfdda65279a860b10a98038135501e4fc00a1 Author: Jonathan Corbet Date: Wed Jan 4 13:59:16 2023 -0700 docs: Deprecate use of Sphinx < 2.4.x The Sphinx 2.4 release is three years old, and it is becoming increasingly difficult to even find a system with an sufficiently archaic Python installation that can run versions older than that. I can no longer test changes against anything prior to 2.4.x. Move toward raising our minimum Sphinx requirement to 2.4.x so we can delete some older support code and claim to support a range of versions that we can actually test. In the absence of screams, the actual removal of support can happen later in 2023. Signed-off-by: Jonathan Corbet commit 0283189e8f3d0917e2ac399688df85211f48447b Author: Jonathan Corbet Date: Wed Jan 4 10:47:39 2023 -0700 docs: Fix the docs build with Sphinx 6.0 Sphinx 6.0 removed the execfile_() function, which we use as part of the configuration process. They *did* warn us... Just open-code the functionality as is done in Sphinx itself. Tested (using SPHINX_CONF, since this code is only executed with an alternative config file) on various Sphinx versions from 2.5 through 6.0. Reported-by: Martin Liška Cc: stable@vger.kernel.org Signed-off-by: Jonathan Corbet commit fc7b76c4a4d139ebcae2af3bd75215fc90834e3b Merge: a389e54642a86 2ba48b20049b5 Author: Linus Torvalds Date: Fri Jan 6 12:01:49 2023 -0800 Merge tag 'for-6.2-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more regression and regular fixes: - regressions: - fix assertion condition using = instead of == - fix false alert on bad tree level check - fix off-by-one error in delalloc search during lseek - fix compat ro feature check at read-write remount - handle case when read-repair happens with ongoing device replace - updated error messages" * tag 'for-6.2-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix compat_ro checks against remount btrfs: always report error in run_one_delayed_ref() btrfs: handle case when repair happens with dev-replace btrfs: fix off-by-one in delalloc search during lseek btrfs: fix false alert on bad tree level check btrfs: add error message for metadata level mismatch btrfs: fix ASSERT em->len condition in btrfs_get_extent commit a389e54642a86c91d683b2f0b248f1d2f4e52611 Merge: 56f814583923a b9b916aee6715 Author: Linus Torvalds Date: Fri Jan 6 11:33:42 2023 -0800 Merge tag 'riscv-for-linus-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - use the correct mask for c.jr/c.jalr when decoding instructions - build fix for get_user() to avoid a sparse warning * tag 'riscv-for-linus-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding commit 56f814583923a782f1cec43db32bc6da1d3cf7b5 Merge: d7a0853d650b3 481028dbf1daa Author: Linus Torvalds Date: Fri Jan 6 11:23:58 2023 -0800 Merge tag 'perf-tools-fixes-for-v6.2-1-2023-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix segfault when trying to process tracepoints present in a perf.data file and not linked with libtraceevent. - Fix build on uClibc systems by adding missing sys/types.h include, that was being obtained indirectly which stopped being the case when tools/lib/traceevent was removed. - Don't show commands in 'perf help' that depend on linking with libtraceevent when not building with that library, which is now a possibility since we no longer ship a copy in tools/lib/traceevent. - Fix failure in 'perf test' entry testing the combination of 'perf probe' user space function + 'perf record' + 'perf script' where it expects a backtrace leading to glibc's inet_pton() from 'ping' that now happens more than once with glibc 2.35 for IPv6 addreses. - Fix for the inet_pton perf test on s/390 where 'text_to_binary_address' now appears on the backtrace. - Fix build error on riscv due to missing header for 'struct perf_sample'. - Fix 'make -C tools perf_install' install variant by not propagating the 'subdir' to submakes for the 'install_headers' targets. - Fix handling of unsupported cgroup events when using BPF counters in 'perf stat'. - Count all cgroups, not just the last one when using 'perf stat' and combining --for-each-cgroup with --bpf-counters. This makes the output using BPF counters match the output without using it, which was the intention all along, the output should be the same using --bpf-counters or not. - Fix 'perf lock contention' core dump related to not finding the "__sched_text_end" symbol on s/390. - Fix build failure when HEAD is signed: exclude the signature from the version string. - Add missing closedir() calls to in perf_data__open_dir(), plugging a fd leak. * tag 'perf-tools-fixes-for-v6.2-1-2023-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf tools: Fix build on uClibc systems by adding missing sys/types.h include perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode perf stat: Fix handling of unsupported cgroup events when using BPF counters perf test record_probe_libc_inet_pton: Fix test on s/390 where 'text_to_binary_address' now appears on the backtrace perf lock contention: Fix core dump related to not finding the "__sched_text_end" symbol on s/390 perf build: Don't propagate subdir to submakes for install_headers perf test record_probe_libc_inet_pton: Fix failure due to extra inet_pton() backtrace in glibc >= 2.35 perf tools: Fix segfault when trying to process tracepoints in perf.data and not linked with libtraceevent perf tools: Don't include signature in version strings perf help: Use HAVE_LIBTRACEEVENT to filter out unsupported commands perf tools riscv: Fix build error on riscv due to missing header for 'struct perf_sample' perf tools: Fix resources leak in perf_data__open_dir() commit d7a0853d650b381921732ff5bca618432a279033 Merge: 90bc52c525fda 57512b57dcfaf Author: Linus Torvalds Date: Fri Jan 6 11:20:12 2023 -0800 Merge tag 'perf-urgent-2023-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Ingo Molnar: "Intel RAPL updates for new model IDs" * tag 'perf-urgent-2023-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/rapl: Add support for Intel Emerald Rapids perf/x86/rapl: Add support for Intel Meteor Lake perf/x86/rapl: Treat Tigerlake like Icelake commit 90bc52c525fdac4ed8cbf13c08c813ec2a4fc856 Merge: 1f5abbd77e2c1 736f88689c691 Author: Linus Torvalds Date: Fri Jan 6 11:14:11 2023 -0800 Merge tag 'v6.2-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a CFI crash in arm64/sm4 as well as a regression in the caam driver" * tag 'v6.2-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: arm64/sm4 - fix possible crash with CFI enabled crypto: caam - fix CAAM io mem access in blob_gen commit 6710e07f01b54b2d93e81cfe1c207d39d4fdb9a8 Merge: b9b916aee6715 a943385aa8015 Author: Palmer Dabbelt Date: Fri Jan 6 10:31:12 2023 -0800 Merge patch series "riscv,isa fixups" Conor Dooley says: From: Conor Dooley I noticed ~today~ while looking at the isa manual that I had not accounted for another couple of edge cases with my regex. As before, I think attempting to validate the canonical order for multiletter stuff makes no sense - but we should totally try to avoid false-positives for combinations that are known to be valid. * b4-shazam-merge: dt-bindings: riscv: fix single letter canonical order dt-bindings: riscv: fix underscore requirement for multi-letter extensions Link: https://lore.kernel.org/r/20221205174459.60195-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit a943385aa80151c6b2611d3a1cf8338af2b257a1 Author: Conor Dooley Date: Mon Dec 5 17:45:00 2022 +0000 dt-bindings: riscv: fix single letter canonical order I used the wikipedia table for ordering extensions when updating the pattern here in commit 299824e68bd0 ("dt-bindings: riscv: add new riscv,isa strings for emulators"). Unfortunately that table did not match canonical order, as defined by the RISC-V ISA Manual, which defines extension ordering in (what is currently) Table 41, "Standard ISA extension names". Fix things up by re-sorting v (vector) and adding p (packed-simd) & j (dynamic languages). The e (reduced integer) and g (general) extensions are still intentionally left out. Link: https://github.com/riscv/riscv-isa-manual/releases/tag/riscv-unpriv-pdf-from-asciidoc-15112022 # Chapter 29.5 Fixes: 299824e68bd0 ("dt-bindings: riscv: add new riscv,isa strings for emulators") Acked-by: Guo Ren Reviewed-by: Heiko Stuebner Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Signed-off-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20221205174459.60195-3-conor@kernel.org Signed-off-by: Palmer Dabbelt commit ec64efc4966edf19fa1bc398a26bddfbadc1605f Author: Conor Dooley Date: Mon Dec 5 17:44:59 2022 +0000 dt-bindings: riscv: fix underscore requirement for multi-letter extensions The RISC-V ISA Manual allows the first multi-letter extension to avoid a leading underscore. Underscores are only required between multi-letter extensions. The dt-binding does not validate that a multi-letter extension is canonically ordered, as that'd need an even worse regex than is here, but it should not fail validation for valid ISA strings. Allow the first multi-letter extension to appear immediately after the single-letter extensions. Link: https://github.com/riscv/riscv-isa-manual/releases/tag/riscv-unpriv-pdf-from-asciidoc-15112022 # Chapter 29.5 Fixes: 299824e68bd0 ("dt-bindings: riscv: add new riscv,isa strings for emulators") Acked-by: Guo Ren Signed-off-by: Conor Dooley Acked-by: Rob Herring Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20221205174459.60195-2-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 7827c81f0248e3c2f40d438b020f3d222f002171 Author: Chuck Lever Date: Fri Jan 6 12:43:37 2023 -0500 Revert "SUNRPC: Use RMW bitops in single-threaded hot paths" The premise that "Once an svc thread is scheduled and executing an RPC, no other processes will touch svc_rqst::rq_flags" is false. svc_xprt_enqueue() examines the RQ_BUSY flag in scheduled nfsd threads when determining which thread to wake up next. Found via KCSAN. Fixes: 28df0988815f ("SUNRPC: Use RMW bitops in single-threaded hot paths") Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0b3a551fa58b4da941efeb209b3770868e2eddd7 Author: Jeff Layton Date: Thu Jan 5 14:55:56 2023 -0500 nfsd: fix handling of cached open files in nfsd4_open codepath Commit fb70bf124b05 ("NFSD: Instantiate a struct file when creating a regular NFSv4 file") added the ability to cache an open fd over a compound. There are a couple of problems with the way this currently works: It's racy, as a newly-created nfsd_file can end up with its PENDING bit cleared while the nf is hashed, and the nf_file pointer is still zeroed out. Other tasks can find it in this state and they expect to see a valid nf_file, and can oops if nf_file is NULL. Also, there is no guarantee that we'll end up creating a new nfsd_file if one is already in the hash. If an extant entry is in the hash with a valid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with the value of op_file and the old nf_file will leak. Fix both issues by making a new nfsd_file_acquirei_opened variant that takes an optional file pointer. If one is present when this is called, we'll take a new reference to it instead of trying to open the file. If the nfsd_file already has a valid nf_file, we'll just ignore the optional file and pass the nfsd_file back as-is. Also rework the tracepoints a bit to allow for an "opened" variant and don't try to avoid counting acquisitions in the case where we already have a cached open file. Fixes: fb70bf124b05 ("NFSD: Instantiate a struct file when creating a regular NFSv4 file") Cc: Trond Myklebust Reported-by: Stanislav Saner Reported-and-Tested-by: Ruben Vestergaard Reported-and-Tested-by: Torkil Svensgaard Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 599d41fb8ea8bd2a99ca9525dd69405020e43dda Author: Stephan Gerhold Date: Thu Dec 29 16:16:48 2022 +0100 soc: qcom: apr: Make qcom,protection-domain optional again APR should not fail if the service device tree node does not have the qcom,protection-domain property, since this functionality does not exist on older platforms such as MSM8916 and MSM8996. Ignore -EINVAL (returned when the property does not exist) to fix a regression on 6.2-rc1 that prevents audio from working: qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1: Failed to read second value of qcom,protection-domain qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1: Failed to add apr 3 svc Fixes: 6d7860f5750d ("soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index") Signed-off-by: Stephan Gerhold Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221229151648.19839-3-stephan@gerhold.net commit 26658868354963afbff672ad6f7a85c44c311975 Author: Stephan Gerhold Date: Thu Dec 29 16:16:47 2022 +0100 dt-bindings: soc: qcom: apr: Make qcom,protection-domain optional again The protection domain functionality exists only in SoCs starting from MSM8998 [1], while the APR bindings are also used on older platforms. Commit 41288c305836 ("ASoC: dt-bindings: qcom,apr: Split services to shared schema") made the "qcom,protection-domain" required but it should remain optional to avoid dtbs_check warnings on older platforms, e.g.: arch/arm64/boot/dts/qcom/apq8096-db820c.dtb: apr: service@3: 'qcom,protection-domain' is a required property From schema: Documentation/devicetree/bindings/soc/qcom/qcom,apr.yaml [1]: https://lore.kernel.org/all/20200312120842.21991-1-sibis@codeaurora.org/ Fixes: 41288c305836 ("ASoC: dt-bindings: qcom,apr: Split services to shared schema") Signed-off-by: Stephan Gerhold Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221229151648.19839-2-stephan@gerhold.net commit d3178e8a434b58678d99257c0387810a24042fb6 Author: Hao Sun Date: Wed Jan 4 09:47:09 2023 +0800 bpf: Skip invalid kfunc call in backtrack_insn The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dead code elimination. However, this can lead to the following warning in backtrack_insn(), also see [1]: ------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289 [...] So make backtracking conservative with this by returning ENOTSUPP. [1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/ Reported-by: syzbot+4da3ff23081bafe74fc2@syzkaller.appspotmail.com Signed-off-by: Hao Sun Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230104014709.9375-1-sunhao.th@gmail.com commit 5db568e748f6fb7d0d2e1bff4c2698ad4f50b982 Author: Anshuman Khandual Date: Mon Jan 2 11:46:51 2023 +0530 arm64: errata: Workaround possible Cortex-A715 [ESR|FAR]_ELx corruption If a Cortex-A715 cpu sees a page mapping permissions change from executable to non-executable, it may corrupt the ESR_ELx and FAR_ELx registers, on the next instruction abort caused by permission fault. Only user-space does executable to non-executable permission transition via mprotect() system call which calls ptep_modify_prot_start() and ptep_modify _prot_commit() helpers, while changing the page mapping. The platform code can override these helpers via __HAVE_ARCH_PTEP_MODIFY_PROT_TRANSACTION. Work around the problem via doing a break-before-make TLB invalidation, for all executable user space mappings, that go through mprotect() system call. This overrides ptep_modify_prot_start() and ptep_modify_prot_commit(), via defining HAVE_ARCH_PTEP_MODIFY_PROT_TRANSACTION on the platform thus giving an opportunity to intercept user space exec mappings, and do the necessary TLB invalidation. Similar interceptions are also implemented for HugeTLB. Cc: Catalin Marinas Cc: Will Deacon Cc: Jonathan Corbet Cc: Mark Rutland Cc: linux-arm-kernel@lists.infradead.org Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Catalin Marinas Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20230102061651.34745-1-anshuman.khandual@arm.com Signed-off-by: Will Deacon commit cef139299fd86098c6e3dbd389d1d0b2462d7710 Author: Marc Zyngier Date: Thu Jan 5 09:08:34 2023 +0000 firmware/psci: Don't register with debugfs if PSCI isn't available Contrary to popular belief, PSCI is not a universal property of an ARM/arm64 system. There is a garden variety of systems out there that don't (or even cannot) implement it. I'm the first one deplore such a situation, but hey... On such systems, a "cat /sys/kernel/debug/psci" results in fireworks, as no invocation callback is registered. Check for the invoke_psci_fn and psci_ops.get_version pointers before registering with the debugfs subsystem, avoiding the issue altogether. Fixes: 3137f2e60098 ("firmware/psci: Add debugfs support to ease debugging") Reported-by: Hector Martin Signed-off-by: Marc Zyngier Cc: Dmitry Baryshkov Cc: Mark Brown Cc: Ulf Hansson Cc: Arnd Bergmann Cc: Mark Rutland Cc: Lorenzo Pieralisi Reviewed-by: Hector Martin Acked-by: Dmitry Baryshkov Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20230105090834.630238-1-maz@kernel.org Signed-off-by: Will Deacon commit f3dc61cde80d48751999c4cb46daf3b2185e6895 Author: Will Deacon Date: Fri Nov 25 10:18:26 2022 +0000 firmware/psci: Fix MEM_PROTECT_RANGE function numbers PSCI v1.1 offers 32-bit and 64-bit variants of the MEM_PROTECT_RANGE call using function identifier 20. Fix the incorrect definitions of the MEM_PROTECT_CHECK_RANGE calls in the PSCI UAPI header. Cc: Dmitry Baryshkov Cc: Lorenzo Pieralisi Cc: Arnd Bergmann Fixes: 3137f2e60098 ("firmware/psci: Add debugfs support to ease debugging") Acked-by: Marc Zyngier Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20221125101826.22404-1-will@kernel.org Signed-off-by: Will Deacon commit a494398bde273143c2352dd373cad8211f7d94b2 Author: Masahiro Yamada Date: Thu Jan 5 12:13:06 2023 +0900 s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Nathan Chancellor reports that the s390 vmlinux fails to link with GNU ld < 2.36 since commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv"). It happens for defconfig, or more specifically for CONFIG_EXPOLINE=y. $ s390x-linux-gnu-ld --version | head -n1 GNU ld (GNU Binutils for Debian) 2.35.2 $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- allnoconfig $ ./scripts/config -e CONFIG_EXPOLINE $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- olddefconfig $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- `.exit.text' referenced in section `.s390_return_reg' of drivers/base/dd.o: defined in discarded section `.exit.text' of drivers/base/dd.o make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 make: *** [Makefile:1252: vmlinux] Error 2 arch/s390/kernel/vmlinux.lds.S wants to keep EXIT_TEXT: .exit.text : { EXIT_TEXT } But, at the same time, EXIT_TEXT is thrown away by DISCARD because s390 does not define RUNTIME_DISCARD_EXIT. I still do not understand why the latter wins after 99cb0d917ffa, but defining RUNTIME_DISCARD_EXIT seems correct because the comment line in arch/s390/kernel/vmlinux.lds.S says: /* * .exit.text is discarded at runtime, not link time, * to deal with references from __bug_table */ Nathan also found that binutils commit 21401fc7bf67 ("Duplicate output sections in scripts") cured this issue, so we cannot reproduce it with binutils 2.36+, but it is better to not rely on it. Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Link: https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/ Reported-by: Nathan Chancellor Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20230105031306.1455409-1-masahiroy@kernel.org Signed-off-by: Heiko Carstens commit 45d619bdaf799196d702a9ae464b07066d6db2f9 Author: Alexander Gordeev Date: Wed Dec 7 17:15:19 2022 +0100 s390: expicitly align _edata and _end symbols on page boundary Symbols _edata and _end in the linker script are the only unaligned expicitly on page boundary. Although _end is aligned implicitly by BSS_SECTION macro that is still inconsistent and could lead to a bug if a tool or function would assume that _edata is as aligned as others. For example, vmem_map_init() function does not align symbols _etext, _einittext etc. Should these symbols be unaligned as well, the size of ranges to update were short on one page. Instead of fixing every occurrence of this kind in the code and external tools just force the alignment on these two symbols. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 0d4d52361b6c29bf771acd4fa461f06d78fb2fac Author: Niklas Schnelle Date: Tue Jan 3 15:11:07 2023 +0100 s390/debug: add _ASM_S390_ prefix to header guard Using DEBUG_H without a prefix is very generic and inconsistent with other header guards in arch/s390/include/asm. In fact it collides with the same name in the ath9k wireless driver though that depends on !S390 via disabled wireless support. Let's just use a consistent header guard name and prevent possible future trouble. Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit c4e3ef5685393c5051b52cf1e94b8891d49793ab Author: Thinh Nguyen Date: Thu Dec 8 16:50:35 2022 -0800 usb: dwc3: gadget: Ignore End Transfer delay on teardown If we delay sending End Transfer for Setup TRB to be prepared, we need to check if the End Transfer was in preparation for a driver teardown/soft-disconnect. In those cases, just send the End Transfer command without delay. In the case of soft-disconnect, there's a very small chance the command may not go through immediately. But should it happen, the Setup TRB will be prepared during the polling of the controller halted state, allowing the command to go through then. In the case of disabling endpoint due to reconfiguration (e.g. set_interface(alt-setting) or usb reset), then it's driven by the host. Typically the host wouldn't immediately cancel the control request and send another control transfer to trigger the End Transfer command timeout. Fixes: 4db0fbb60136 ("usb: dwc3: gadget: Don't delay End Transfer on delayed_status") Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Link: https://lore.kernel.org/r/f1617a323e190b9cc408fb8b65456e32b5814113.1670546756.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman commit e498a04443240c15c3c857165f7b652b87f4fd96 Author: Arnd Bergmann Date: Tue Jan 3 13:17:46 2023 +0100 usb: dwc3: xilinx: include linux/gpio/consumer.h The newly added gpio consumer calls cause a build failure in configurations that fail to include the right header implicitly: drivers/usb/dwc3/dwc3-xilinx.c: In function 'dwc3_xlnx_init_zynqmp': drivers/usb/dwc3/dwc3-xilinx.c:207:22: error: implicit declaration of function 'devm_gpiod_get_optional'; did you mean 'devm_clk_get_optional'? [-Werror=implicit-function-declaration] 207 | reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); | ^~~~~~~~~~~~~~~~~~~~~~~ | devm_clk_get_optional Fixes: ca05b38252d7 ("usb: dwc3: xilinx: Add gpio-reset support") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230103121755.956027-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2a33ad4a0ba5a527b92aeef9a313aefec197fe28 Author: Basavaraj Natikar Date: Mon Jan 2 22:00:42 2023 +0530 HID: amd_sfh: Fix warning unwind goto Return directly instead of using existing goto will not cleanup previously allocated resources. Hence replace return with goto to fix warning unwind goto which cleanups previously allocated resources. Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Basavaraj Natikar Signed-off-by: Jiri Kosina commit 23970a1c9475b305770fd37bebfec7a10f263787 Author: Tom Rix Date: Fri Dec 30 12:53:41 2022 -0500 udf: initialize newblock to 0 The clang build reports this error fs/udf/inode.c:805:6: error: variable 'newblock' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (*err < 0) ^~~~~~~~ newblock is never set before error handling jump. Initialize newblock to 0 and remove redundant settings. Fixes: d8b39db5fab8 ("udf: Handle error when adding extent to a file") Reported-by: Nathan Chancellor Signed-off-by: Tom Rix Signed-off-by: Jan Kara Message-Id: <20221230175341.1629734-1-trix@redhat.com> commit 83c7423d1eb6806d13c521d1002cc1a012111719 Author: Jan Kara Date: Wed Dec 21 17:45:51 2022 +0100 udf: Fix extension of the last extent in the file When extending the last extent in the file within the last block, we wrongly computed the length of the last extent. This is mostly a cosmetical problem since the extent does not contain any data and the length will be fixed up by following operations but still. Fixes: 1f3868f06855 ("udf: Fix extending file within last block") Signed-off-by: Jan Kara commit c244c092f1ed2acfb5af3d3da81e22367d3dd733 Author: Tung Nguyen Date: Thu Jan 5 06:02:51 2023 +0000 tipc: fix unexpected link reset due to discovery messages This unexpected behavior is observed: node 1 | node 2 ------ | ------ link is established | link is established reboot | link is reset up | send discovery message receive discovery message | link is established | link is established send discovery message | | receive discovery message | link is reset (unexpected) | send reset message link is reset | It is due to delayed re-discovery as described in function tipc_node_check_dest(): "this link endpoint has already reset and re-established contact with the peer, before receiving a discovery message from that node." However, commit 598411d70f85 has changed the condition for calling tipc_node_link_down() which was the acceptance of new media address. This commit fixes this by restoring the old and correct behavior. Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic") Acked-by: Jon Maloy Signed-off-by: Tung Nguyen Signed-off-by: David S. Miller commit 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d Author: David Howells Date: Wed Oct 19 09:45:43 2022 +0100 rxrpc: Move client call connection to the I/O thread Move the connection setup of client calls to the I/O thread so that a whole load of locking and barrierage can be eliminated. This necessitates the app thread waiting for connection to complete before it can begin encrypting data. This also completes the fix for a race that exists between call connection and call disconnection whereby the data transmission code adds the call to the peer error distribution list after the call has been disconnected (say by the rxrpc socket getting closed). The fix is to complete the process of moving call connection, data transmission and call disconnection into the I/O thread and thus forcibly serialising them. Note that the issue may predate the overhaul to an I/O thread model that were included in the merge window for v6.2, but the timing is very much changed by the change given below. Fixes: cf37b5987508 ("rxrpc: Move DATA transmission into call processor work item") Reported-by: syzbot+c22650d2844392afdcfd@syzkaller.appspotmail.com Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 0d6bf319bc5aba4535bb46e1b607973688a2248a Author: David Howells Date: Wed Nov 2 16:46:13 2022 +0000 rxrpc: Move the client conn cache management to the I/O thread Move the management of the client connection cache to the I/O thread rather than managing it from the namespace as an aggregate across all the local endpoints within the namespace. This will allow a load of locking to be got rid of in a future patch as only the I/O thread will be looking at the this. The downside is that the total number of cached connections on the system can get higher because the limit is now per-local rather than per-netns. We can, however, keep the number of client conns in use across the entire netfs and use that to reduce the expiration time of idle connection. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 96b4059f43ce69e9c590f77d6ce3e99888d5cfe6 Author: David Howells Date: Thu Oct 27 11:25:55 2022 +0100 rxrpc: Remove call->state_lock All the setters of call->state are now in the I/O thread and thus the state lock is now unnecessary. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 93368b6bd58ac49d804fdc9ab041a6dc89ebf1cc Author: David Howells Date: Wed Oct 26 23:43:00 2022 +0100 rxrpc: Move call state changes from recvmsg to I/O thread Move the call state changes that are made in rxrpc_recvmsg() to the I/O thread. This means that, thenceforth, only the I/O thread does this and the call state lock can be removed. This requires the Rx phase to be ended when the last packet is received, not when it is processed. Since this now changes the rxrpc call state to SUCCEEDED before we've consumed all the data from it, rxrpc_kernel_check_life() mustn't say the call is dead until the recvmsg queue is empty (unless the call has failed). Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 2d689424b6184535890c251f937ccf815fde9cd2 Author: David Howells Date: Fri Nov 11 08:35:36 2022 +0000 rxrpc: Move call state changes from sendmsg to I/O thread Move all the call state changes that are made in rxrpc_sendmsg() to the I/O thread. This is a step towards removing the call state lock. This requires the switch to the RXRPC_CALL_CLIENT_AWAIT_REPLY and RXRPC_CALL_SERVER_SEND_REPLY states to be done when the last packet is decanted from ->tx_sendmsg to ->tx_buffer in the I/O thread, not when it is added to ->tx_sendmsg by sendmsg(). Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit d41b3f5b96881809c73f86e3ca436c9426610b7a Author: David Howells Date: Mon Dec 19 15:32:32 2022 +0000 rxrpc: Wrap accesses to get call state to put the barrier in one place Wrap accesses to get the state of a call from outside of the I/O thread in a single place so that the barrier needed to order wrt the error code and abort code is in just that place. Also use a barrier when setting the call state and again when reading the call state such that the auxiliary completion info (error code, abort code) can be read without taking a read lock on the call state lock. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 0b9bb322f13d486d5b8630264ccbfb4794bb43a9 Author: David Howells Date: Thu Oct 27 00:16:55 2022 +0100 rxrpc: Split out the call state changing functions into their own file Split out the functions that change the state of an rxrpc call into their own file. The idea being to remove anything to do with changing the state of a call directly from the rxrpc sendmsg() and recvmsg() paths and have all that done in the I/O thread only, with the ultimate aim of removing the state lock entirely. Moving the code out of sendmsg.c and recvmsg.c makes that easier to manage. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 1bab27af6b88b5c811f99de4812b5590f20d1cb7 Author: David Howells Date: Fri Oct 21 09:30:23 2022 +0100 rxrpc: Set up a connection bundle from a call, not rxrpc_conn_parameters Use the information now stored in struct rxrpc_call to configure the connection bundle and thence the connection, rather than using the rxrpc_conn_parameters struct. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 2953d3b8d8fd1188034c54862b74402b0b846695 Author: David Howells Date: Fri Oct 21 08:54:03 2022 +0100 rxrpc: Offload the completion of service conn security to the I/O thread Offload the completion of the challenge/response cycle on a service connection to the I/O thread. After the RESPONSE packet has been successfully decrypted and verified by the work queue, offloading the changing of the call states to the I/O thread makes iteration over the conn's channel list simpler. Do this by marking the RESPONSE skbuff and putting it onto the receive queue for the I/O thread to collect. We put it on the front of the queue as we've already received the packet for it. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit f06cb29189361353e9ed12df936c8e1d7f69b730 Author: David Howells Date: Thu Oct 20 22:58:56 2022 +0100 rxrpc: Make the set of connection IDs per local endpoint Make the set of connection IDs per local endpoint so that endpoints don't cause each other's connections to get dismissed. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 57af281e5389b6fefedb3685f86847cbb0055f75 Author: David Howells Date: Thu Oct 6 21:45:42 2022 +0100 rxrpc: Tidy up abort generation infrastructure Tidy up the abort generation infrastructure in the following ways: (1) Create an enum and string mapping table to list the reasons an abort might be generated in tracing. (2) Replace the 3-char string with the values from (1) in the places that use that to log the abort source. This gets rid of a memcpy() in the tracepoint. (3) Subsume the rxrpc_rx_eproto tracepoint with the rxrpc_abort tracepoint and use values from (1) to indicate the trace reason. (4) Always make a call to an abort function at the point of the abort rather than stashing the values into variables and using goto to get to a place where it reported. The C optimiser will collapse the calls together as appropriate. The abort functions return a value that can be returned directly if appropriate. Note that this extends into afs also at the points where that generates an abort. To aid with this, the afs sources need to #define RXRPC_TRACE_ONLY_DEFINE_ENUMS before including the rxrpc tracing header because they don't have access to the rxrpc internal structures that some of the tracepoints make use of. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit a00ce28b1778fa3576575b43bdb17f60ded38b66 Author: David Howells Date: Thu Oct 20 09:56:36 2022 +0100 rxrpc: Clean up connection abort Clean up connection abort, using the connection state_lock to gate access to change that state, and use an rxrpc_call_completion value to indicate the difference between local and remote aborts as these can be pasted directly into the call state. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit f2cce89a074e6d2991dddc94f6b6ebe1576b8459 Author: David Howells Date: Thu Oct 20 09:08:34 2022 +0100 rxrpc: Implement a mechanism to send an event notification to a connection Provide a means by which an event notification can be sent to a connection through such that the I/O thread can pick it up and handle it rather than doing it in a separate workqueue. This is then used to move the deferred final ACK of a call into the I/O thread rather than a separate work queue as part of the drive to do all transmission from the I/O thread. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 03fc55adf8761c546d72798264b019c9f672c578 Author: David Howells Date: Wed Oct 12 17:01:25 2022 +0100 rxrpc: Only disconnect calls in the I/O thread Only perform call disconnection in the I/O thread to reduce the locking requirement. This is the first part of a fix for a race that exists between call connection and call disconnection whereby the data transmission code adds the call to the peer error distribution list after the call has been disconnected (say by the rxrpc socket getting closed). The fix is to complete the process of moving call connection, data transmission and call disconnection into the I/O thread and thus forcibly serialising them. Note that the issue may predate the overhaul to an I/O thread model that were included in the merge window for v6.2, but the timing is very much changed by the change given below. Fixes: cf37b5987508 ("rxrpc: Move DATA transmission into call processor work item") Reported-by: syzbot+c22650d2844392afdcfd@syzkaller.appspotmail.com Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit a343b174b4bdde851033996960bca5ad1394d04b Author: David Howells Date: Wed Oct 12 22:17:56 2022 +0100 rxrpc: Only set/transmit aborts in the I/O thread Only set the abort call completion state in the I/O thread and only transmit ABORT packets from there. rxrpc_abort_call() can then be made to actually send the packet. Further, ABORT packets should only be sent if the call has been exposed to the network (ie. at least one attempted DATA transmission has occurred for it). Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 30df927b936b2ef21eb07dce9c141c7897609643 Author: David Howells Date: Sat Oct 8 14:33:50 2022 +0100 rxrpc: Separate call retransmission from other conn events Call the rxrpc_conn_retransmit_call() directly from rxrpc_input_packet() rather than calling it via connection event handling. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 5040011d073d3acdeb58af2b64f84e33bb03abd2 Author: David Howells Date: Wed Nov 2 10:24:29 2022 +0000 rxrpc: Make the local endpoint hold a ref on a connected call Make the local endpoint and it's I/O thread hold a reference on a connected call until that call is disconnected. Without this, we're reliant on either the AF_RXRPC socket to hold a ref (which is dropped when the call is released) or a queued work item to hold a ref (the work item is being replaced with the I/O thread). Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 8a758d98dba380a7d32a98b0840ad707e3036233 Author: David Howells Date: Thu Oct 20 23:17:06 2022 +0100 rxrpc: Stash the network namespace pointer in rxrpc_local Stash the network namespace pointer in the rxrpc_local struct in addition to a pointer to the rxrpc-specific net namespace info. Use this to remove some places where the socket is passed as a parameter. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit 5193326c4c5a656c733b6d2c6537e3f36319bcac Merge: 93235bfd5a9c3 87809d3196c2a Author: Daniel Vetter Date: Fri Jan 6 10:16:48 2023 +0100 Merge tag 'drm-intel-fixes-2023-01-05' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Only gvt-fixes: - debugfs fixes (Zhenyu) - fix up for vgpu status (Zhi) - double free fix in split_2MB_gtt_entry (Zheng) Signed-off-by: Daniel Vetter From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y7cszBkLRvAy6uao@intel.com commit 0688773f0710528e1ab302c3d6317e269f2e2e6e Author: Patrick Thompson Date: Tue Dec 20 15:58:26 2022 -0500 drm: Add orientation quirk for Lenovo ideapad D330-10IGL Panel is 800x1280 but mounted on a detachable form factor sideways. Signed-off-by: Patrick Thompson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20221220205826.178008-1-ptf@google.com commit 1a5a23b9bdf6bde0e5185ca834ff6e806cc2aaaf Author: Yang Yingliang Date: Fri Dec 30 14:54:27 2022 +0800 usb: fotg210-udc: fix error return code in fotg210_udc_probe() After commit 5f217ccd520f ("fotg210-udc: Support optional external PHY"), the error code is re-assigned to 0 in fotg210_udc_probe(), if allocate or map memory fails after the assignment, it can't return an error code. Set the error code to -ENOMEM to fix this problem. Fixes: 5f217ccd520f ("fotg210-udc: Support optional external PHY") Signed-off-by: Yang Yingliang Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20221230065427.944586-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit c45219cba101f32853d011da2ba46a1b2338dc4c Author: Pierre-Olivier Mercier Date: Thu Jan 5 13:02:08 2023 +0100 Revert "arm64: dts: meson-sm1-odroid-hc4: disable unused USB PHY0" This reverts commit 703e84d6615a4a95fb504c8f2e4c9426b86f3930. USB device enumeration was not working on Odroid HC4 as both USB2 PHYs need to be enabled. This is inherited from the GLX USB design [1]. [1]: https://lore.kernel.org/all/20170814224542.18257-1-martin.blumenstingl@googlemail.com/T/ Signed-off-by: Pierre-Olivier Mercier Acked-by: Neil Armstrong Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20230105120206.28964-1-nemunaire@nemunai.re Signed-off-by: Neil Armstrong commit eea8ce81fbb544e3caad1a1c876ba1af467b3d3c Author: Hui Wang Date: Thu Jan 5 11:42:49 2023 +0800 net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem This modem has 7 interfaces, 5 of them are serial interfaces and are driven by cdc_acm, while 2 of them are wwan interfaces and are driven by cdc_ether: If 0: Abstract (modem) If 1: Abstract (modem) If 2: Abstract (modem) If 3: Abstract (modem) If 4: Abstract (modem) If 5: Ethernet Networking If 6: Ethernet Networking Without this change, the 2 network interfaces will be named to usb0 and usb1, our QA think the names are confusing and filed a bug on it. After applying this change, the name will be wwan0 and wwan1, and they could work well with modem manager. Signed-off-by: Hui Wang Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20230105034249.10433-1-hui.wang@canonical.com Signed-off-by: Jakub Kicinski commit c26de7507d1f5ffa5daf6a4980ef7896889691a9 Author: Biao Huang Date: Thu Jan 5 09:07:11 2023 +0800 stmmac: dwmac-mediatek: remove the dwmac_fix_mac_speed In current driver, MAC will always enable 2ns delay in RGMII mode, but that's not the correct usage. Remove the dwmac_fix_mac_speed() in driver, and recommend "rgmii-id" for phy-mode in device tree. Fixes: f2d356a6ab71 ("stmmac: dwmac-mediatek: add support for mt8195") Reviewed-by: Andrew Lunn Signed-off-by: Biao Huang Signed-off-by: Jakub Kicinski commit f4a75b5933c998e60fd812a7680e0971eb1c7cee Author: Akhil P Oommen Date: Fri Dec 16 22:33:14 2022 +0530 drm/msm/a6xx: Avoid gx gbit halt during rpm suspend As per the downstream driver, gx gbif halt is required only during recovery sequence. So lets avoid it during regular rpm suspend. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/515279/ Link: https://lore.kernel.org/r/20221216223253.1.Ice9c47bfeb1fddb8dc377a3491a043a3ee7fca7d@changeid Signed-off-by: Rob Clark commit 13ef096e342b00e30b95a90c6c13eee1f0bec4c5 Author: Konrad Dybcio Date: Mon Jan 2 11:02:00 2023 +0100 drm/msm/adreno: Make adreno quirks not overwrite each other So far the adreno quirks have all been assigned with an OR operator, which is problematic, because they were assigned consecutive integer values, which makes checking them with an AND operator kind of no bueno.. Switch to using BIT(n) so that only the quirks that the programmer chose are taken into account when evaluating info->quirks & ADRENO_QUIRK_... Fixes: 370063ee427a ("drm/msm/adreno: Add A540 support") Reviewed-by: Dmitry Baryshkov Reviewed-by: Marijn Suijten Reviewed-by: Rob Clark Signed-off-by: Konrad Dybcio Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/516456/ Link: https://lore.kernel.org/r/20230102100201.77286-1-konrad.dybcio@linaro.org Signed-off-by: Rob Clark commit 1f5abbd77e2c1787e74b7c2caffac97def78ba52 Merge: 50011c32f4212 b878d3ba9bb41 Author: Linus Torvalds Date: Thu Jan 5 13:48:49 2023 -0800 Merge tag 'thermal-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Add a missing sysfs attribute to the int340x thermal driver (Srinivas Pandruvada)" * tag 'thermal-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: int340x: Add missing attribute for data rate base commit 00dd060ab3cf95ca6ede7853bc14397014971b5e Author: Dmitry Baryshkov Date: Thu Jan 5 03:47:43 2023 +0200 drm/msm: another fix for the headless Adreno GPU Fix another oops reproducible when rebooting the board with the Adreno GPU working in the headless mode (e.g. iMX platforms). Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=74936831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] ARM CPU: 0 PID: 51 Comm: reboot Not tainted 6.2.0-rc1-dirty #11 Hardware name: Freescale i.MX53 (Device Tree Support) PC is at msm_atomic_commit_tail+0x50/0x970 LR is at commit_tail+0x9c/0x188 pc : [] lr : [] psr: 600e0013 sp : e0851d30 ip : ee4eb7eb fp : 00090acc r10: 00000058 r9 : c2193014 r8 : c4310000 r7 : c4759380 r6 : 07bef61d r5 : 00000000 r4 : 00000000 r3 : c44cc440 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 74910019 DAC: 00000051 Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: slab kmalloc-1k start c44cc400 pointer offset 64 size 1024 Register r4 information: NULL pointer Register r5 information: NULL pointer Register r6 information: non-paged memory Register r7 information: slab kmalloc-128 start c4759380 pointer offset 0 size 128 Register r8 information: slab kmalloc-2k start c4310000 pointer offset 0 size 2048 Register r9 information: non-slab/vmalloc memory Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: non-paged memory Process reboot (pid: 51, stack limit = 0xc80046d9) Stack: (0xe0851d30 to 0xe0852000) 1d20: c4759380 fbd77200 000005ff 002b9c70 1d40: c4759380 c4759380 00000000 07bef61d 00000600 c0d6fe7c c2193014 00000058 1d60: 00090acc c067a214 00000000 c4759380 c4310000 00000000 c44cc854 c067a89c 1d80: 00000000 00000000 00000000 c4310468 00000000 c4759380 c4310000 c4310468 1da0: c4310470 c0643258 c4759380 00000000 00000000 c0c4ee24 00000000 c44cc810 1dc0: 00000000 c0c4ee24 00000000 c44cc810 00000000 0347d2a8 e0851e00 e0851e00 1de0: c4759380 c067ad20 c4310000 00000000 c44cc810 c27f8718 c44cc854 c067adb8 1e00: c4933000 00000002 00000001 00000000 00000000 c2130850 00000000 c2130854 1e20: c25fc488 00000000 c0ff162c 00000000 00000001 00000002 00000000 00000000 1e40: c43102c0 c43102c0 00000000 0347d2a8 c44cc810 c44cc814 c2133da8 c06d1a60 1e60: 00000000 00000000 00079028 c2012f24 fee1dead c4933000 00000058 c01431e4 1e80: 01234567 c0143a20 00000000 00000000 00000000 00000000 00000000 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f80: 00000000 00000000 00000000 0347d2a8 00000002 00000004 00000078 00000058 1fa0: c010028c c0100060 00000002 00000004 fee1dead 28121969 01234567 00079028 1fc0: 00000002 00000004 00000078 00000058 0002fdc5 00000000 00000000 00090acc 1fe0: 00000058 becc9c64 b6e97e05 b6e0e5f6 600e0030 fee1dead 00000000 00000000 msm_atomic_commit_tail from commit_tail+0x9c/0x188 commit_tail from drm_atomic_helper_commit+0x160/0x188 drm_atomic_helper_commit from drm_atomic_commit+0xac/0xe0 drm_atomic_commit from drm_atomic_helper_disable_all+0x1b0/0x1c0 drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x88/0x140 drm_atomic_helper_shutdown from device_shutdown+0x16c/0x240 device_shutdown from kernel_restart+0x38/0x90 kernel_restart from __do_sys_reboot+0x174/0x224 __do_sys_reboot from ret_fast_syscall+0x0/0x1c Exception stack(0xe0851fa8 to 0xe0851ff0) 1fa0: 00000002 00000004 fee1dead 28121969 01234567 00079028 1fc0: 00000002 00000004 00000078 00000058 0002fdc5 00000000 00000000 00090acc 1fe0: 00000058 becc9c64 b6e97e05 b6e0e5f6 Code: 15922088 1184421c e1500003 1afffff8 (e5953000) ---[ end trace 0000000000000000 ]--- Fixes: 0a58d2ae572a ("drm/msm: Make .remove and .shutdown HW shutdown consistent") Reported-by: kernel test robot Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Clark Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/516909/ Link: https://lore.kernel.org/r/20230105014743.1478110-1-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 654ffe4b793b42ed6b5909daff0b91809916d94e Author: Bryan O'Donoghue Date: Fri Dec 23 02:10:10 2022 +0000 dt-bindings: msm: dsi-controller-main: Fix description of core clock There's a typo in describing the core clock as an 'escape' clock. The accurate description is 'core'. Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") Reviewed-by: Dmitry Baryshkov Acked-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Patchwork: https://patchwork.freedesktop.org/patch/515938/ Link: https://lore.kernel.org/r/20221223021025.1646636-4-bryan.odonoghue@linaro.org Signed-off-by: Abhinav Kumar commit a6f033938beb31f893302a93f83ec0b6460c6cac Author: Bryan O'Donoghue Date: Fri Dec 23 02:10:09 2022 +0000 dt-bindings: msm: dsi-controller-main: Fix power-domain constraint power-domain is required for the sc7180 dispcc GDSC but not every qcom SoC has a similar dependency for example the apq8064. Most Qcom SoC's using mdss-dsi-ctrl seem to have the ability to power-collapse the MDP without collapsing DSI. For example the qcom vendor kernel commit for apq8084, msm8226, msm8916, msm8974. https://review.carbonrom.org/plugins/gitiles/CarbonROM/android_kernel_oneplus_msm8994/+/7b5c011a770daa2811778937ed646237a28a8694 "ARM: dts: msm: add mdss gdsc supply to dsi controller device It is possible for the DSI controller to be active when MDP is power collapsed. DSI controller needs to have it's own vote for mdss gdsc to ensure that gdsc remains on in such cases." This however doesn't appear to be the case for the apq8064 so we shouldn't be marking power-domain as required in yaml checks. Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") Reviewed-by: Dmitry Baryshkov Acked-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Patchwork: https://patchwork.freedesktop.org/patch/515958/ Link: https://lore.kernel.org/r/20221223021025.1646636-3-bryan.odonoghue@linaro.org Signed-off-by: Abhinav Kumar commit cdf64343f91a1225e9e3d4ce4261962cd41b4ddd Author: Bryan O'Donoghue Date: Fri Dec 23 02:10:08 2022 +0000 dt-bindings: msm: dsi-controller-main: Fix operating-points-v2 constraint The existing msm8916.dtsi does not depend on nor require operating points. Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") Reviewed-by: Dmitry Baryshkov Acked-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Patchwork: https://patchwork.freedesktop.org/patch/515940/ Link: https://lore.kernel.org/r/20221223021025.1646636-2-bryan.odonoghue@linaro.org Signed-off-by: Abhinav Kumar commit 50011c32f421215f6231996fcc84fd1fe81c4a48 Merge: aa01a183924fd fe69230f05897 Author: Linus Torvalds Date: Thu Jan 5 12:40:50 2023 -0800 Merge tag 'net-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, wifi, and netfilter. Current release - regressions: - bpf: fix nullness propagation for reg to reg comparisons, avoid null-deref - inet: control sockets should not use current thread task_frag - bpf: always use maximal size for copy_array() - eth: bnxt_en: don't link netdev to a devlink port for VFs Current release - new code bugs: - rxrpc: fix a couple of potential use-after-frees - netfilter: conntrack: fix IPv6 exthdr error check - wifi: iwlwifi: fw: skip PPAG for JF, avoid FW crashes - eth: dsa: qca8k: various fixes for the in-band register access - eth: nfp: fix schedule in atomic context when sync mc address - eth: renesas: rswitch: fix getting mac address from device tree - mobile: ipa: use proper endpoint mask for suspend Previous releases - regressions: - tcp: add TIME_WAIT sockets in bhash2, fix regression caught by Jiri / python tests - net: tc: don't intepret cls results when asked to drop, fix oob-access - vrf: determine the dst using the original ifindex for multicast - eth: bnxt_en: - fix XDP RX path if BPF adjusted packet length - fix HDS (header placement) and jumbo thresholds for RX packets - eth: ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf, avoid memory corruptions Previous releases - always broken: - ulp: prevent ULP without clone op from entering the LISTEN status - veth: fix race with AF_XDP exposing old or uninitialized descriptors - bpf: - pull before calling skb_postpull_rcsum() (fix checksum support and avoid a WARN()) - fix panic due to wrong pageattr of im->image (when livepatch and kretfunc coexist) - keep a reference to the mm, in case the task is dead - mptcp: fix deadlock in fastopen error path - netfilter: - nf_tables: perform type checking for existing sets - nf_tables: honor set timeout and garbage collection updates - ipset: fix hash:net,port,net hang with /0 subnet - ipset: avoid hung task warning when adding/deleting entries - selftests: net: - fix cmsg_so_mark.sh test hang on non-x86 systems - fix the arp_ndisc_evict_nocarrier test for IPv6 - usb: rndis_host: secure rndis_query check against int overflow - eth: r8169: fix dmar pte write access during suspend/resume with WOL - eth: lan966x: fix configuration of the PCS - eth: sparx5: fix reading of the MAC address - eth: qed: allow sleep in qed_mcp_trace_dump() - eth: hns3: - fix interrupts re-initialization after VF FLR - fix handling of promisc when MAC addr table gets full - refine the handling for VF heartbeat - eth: mlx5: - properly handle ingress QinQ-tagged packets on VST - fix io_eq_size and event_eq_size params validation on big endian - fix RoCE setting at HCA level if not supported at all - don't turn CQE compression on by default for IPoIB - eth: ena: - fix toeplitz initial hash key value - account for the number of XDP-processed bytes in interface stats - fix rx_copybreak value update Misc: - ethtool: harden phy stat handling against buggy drivers - docs: netdev: convert maintainer's doc from FAQ to a normal document" * tag 'net-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (112 commits) caif: fix memory leak in cfctrl_linkup_request() inet: control sockets should not use current thread task_frag net/ulp: prevent ULP without clone op from entering the LISTEN status qed: allow sleep in qed_mcp_trace_dump() MAINTAINERS: Update maintainers for ptp_vmw driver usb: rndis_host: Secure rndis_query check against int overflow net: dpaa: Fix dtsec check for PCS availability octeontx2-pf: Fix lmtst ID used in aura free drivers/net/bonding/bond_3ad: return when there's no aggregator netfilter: ipset: Rework long task execution when adding/deleting entries netfilter: ipset: fix hash:net,port,net hang with /0 subnet net: sparx5: Fix reading of the MAC address vxlan: Fix memory leaks in error path net: sched: htb: fix htb_classify() kernel-doc net: sched: cbq: dont intepret cls results when asked to drop net: sched: atm: dont intepret cls results when asked to drop dt-bindings: net: marvell,orion-mdio: Fix examples dt-bindings: net: sun8i-emac: Add phy-supply property net: ipa: use proper endpoint mask for suspend selftests: net: return non-zero for failures reported in arp_ndisc_evict_nocarrier ... commit b9b916aee6715cd7f3318af6dc360c4729417b94 Author: Ben Dooks Date: Thu Dec 29 17:05:45 2022 +0000 riscv: uaccess: fix type of 0 variable on error in get_user() If the get_user(x, ptr) has x as a pointer, then the setting of (x) = 0 is going to produce the following sparse warning, so fix this by forcing the type of 'x' when access_ok() fails. fs/aio.c:2073:21: warning: Using plain integer as NULL pointer Signed-off-by: Ben Dooks Reviewed-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20221229170545.718264-1-ben-linux@fluff.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit b2d473a6019ef9a54b0156ecdb2e0398c9fa6a24 Author: Björn Töpel Date: Mon Jan 2 17:07:48 2023 +0100 riscv, kprobes: Stricter c.jr/c.jalr decoding In the compressed instruction extension, c.jr, c.jalr, c.mv, and c.add is encoded the following way (each instruction is 16b): ---+-+-----------+-----------+-- 100 0 rs1[4:0]!=0 00000 10 : c.jr 100 1 rs1[4:0]!=0 00000 10 : c.jalr 100 0 rd[4:0]!=0 rs2[4:0]!=0 10 : c.mv 100 1 rd[4:0]!=0 rs2[4:0]!=0 10 : c.add The following logic is used to decode c.jr and c.jalr: insn & 0xf007 == 0x8002 => instruction is an c.jr insn & 0xf007 == 0x9002 => instruction is an c.jalr When 0xf007 is used to mask the instruction, c.mv can be incorrectly decoded as c.jr, and c.add as c.jalr. Correct the decoding by changing the mask from 0xf007 to 0xf07f. Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") Signed-off-by: Björn Töpel Reviewed-by: Conor Dooley Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230102160748.1307289-1-bjorn@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit aa01a183924fdf2ab05eb6e44c256aaf8a786d3c Merge: 5e9af4b42660b 694175cd8a164 Author: Linus Torvalds Date: Thu Jan 5 12:06:40 2023 -0800 Merge tag 'gpio-fixes-for-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "A reference leak fix, two fixes for using uninitialized variables and more drivers converted to using immutable irqchips: - fix a reference leak in gpio-sifive - fix a potential use of an uninitialized variable in core gpiolib - fix a potential use of an uninitialized variable in gpio-pca953x - make GPIO irqchips immutable in gpio-pmic-eic-sprd, gpio-eic-sprd and gpio-sprd" * tag 'gpio-fixes-for-v6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sifive: Fix refcount leak in sifive_gpio_probe gpio: sprd: Make the irqchip immutable gpio: pmic-eic-sprd: Make the irqchip immutable gpio: eic-sprd: Make the irqchip immutable gpio: pca953x: avoid to use uninitialized value pinctrl gpiolib: Fix using uninitialized lookup-flags on ACPI platforms commit e95d50d74b93a767a026f588e8de0b9718a0105e Author: Yishai Hadas Date: Thu Jan 5 13:23:39 2023 +0200 lib/scatterlist: Fix to merge contiguous pages into the last SG properly When sg_alloc_append_table_from_pages() calls to pages_are_mergeable() in its 'sgt_append->prv' flow to check whether it can merge contiguous pages into the last SG, it passes the page arguments in the wrong order. The first parameter should be the next candidate page to be merged to the last page and not the opposite. The current code leads to a corrupted SG which resulted in OOPs and unexpected errors when non-contiguous pages are merged wrongly. Fix to pass the page parameters in the right order. Fixes: 1567b49d1a40 ("lib/scatterlist: add check when merging zone device pages") Link: https://lore.kernel.org/r/20230105112339.107969-1-yishaih@nvidia.com Signed-off-by: Yishai Hadas Reviewed-by: Jason Gunthorpe Reviewed-by: Logan Gunthorpe Signed-off-by: Jason Gunthorpe commit 41cc108b2451e0c65e8c9c9f6a3e103b62b60bb3 Author: Christian König Date: Thu Jan 5 11:27:16 2023 +0100 drm/amdgpu: fix missing dma_fence_put in error path When the fence can't be added we need to drop the reference. Suggested-by: Bert Karwatzki Signed-off-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230105111703.52695-2-christian.koenig@amd.com Reviewed-by: Alex Deucher Reviewed-by: Luben Tuikov commit ed21f6c3fe423b17211fa5a85cd028621a749a2a Author: Christian König Date: Thu Jan 5 10:45:36 2023 +0100 drm/amdgpu: fix another missing fence reference in the CS code drm_sched_job_add_dependency() consumes the references of the gang members. Only triggered by mesh shaders. Signed-off-by: Christian König Fixes: 1728baa7e4e6 ("drm/amdgpu: use scheduler dependencies for CS") Tested-by: Mike Lothian Tested-by: Bert Karwatzki Link: https://patchwork.freedesktop.org/patch/msgid/20230105111703.52695-1-christian.koenig@amd.com Reviewed-by: Alex Deucher Reviewed-by: Luben Tuikov commit 5e9af4b42660b2a8db067db8ff03db8a268d6a95 Merge: 41c03ba9beea7 634cf6ead9398 Author: Linus Torvalds Date: Thu Jan 5 11:24:33 2023 -0800 Merge tag 'fbdev-for-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - Fix Matrox G200eW initialization failure - Fix build failure of offb driver when built as module - Optimize stack usage in omapfb * tag 'fbdev-for-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: omapfb: avoid stack overflow warning fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB fbdev: atyfb: use strscpy() to instead of strncpy() fbdev: omapfb: use strscpy() to instead of strncpy() fbdev: make offb driver tristate commit 318ca20893c19ead02845a08204c3f9249bb74cd Author: Evan Quan Date: Wed Jan 4 10:45:01 2023 +0800 drm/amd/pm: add the missing mapping for PPT feature on SMU13.0.0 and 13.0.7 Then we are able to set a new ppt limit via the hwmon interface(power1_cap). Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x, 6.1.x commit 6fea87637bf36bd285227f490132e83582ab7513 Author: Evan Quan Date: Fri Dec 16 17:12:53 2022 +0800 drm/amd/pm: correct the reference clock for fan speed(rpm) calculation Correct the reference clock as 25Mhz for SMU13 fan speed calculation. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x, 6.1.x commit e0fe6a31cac84735939c29d1e05055d58325c6c0 Author: Hector Martin Date: Wed Jan 4 18:36:28 2023 +0900 spi: Rename spi-cs-setup-ns property to spi-cs-setup-delay-ns As mentioned in the corresponding DT binding commit, the naming scheme for delay properties includes "delay" in the name, so let's keep that consistent. Fixes: 33a2fde5f77b ("spi: Introduce spi-cs-setup-ns property") Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20230104093631.15611-3-marcan@marcan.st Signed-off-by: Mark Brown commit 38892ea4cefbb6ed3a91e76d3af84a1f8077d2d4 Author: Hector Martin Date: Wed Jan 4 18:36:27 2023 +0900 spi: dt-bindings: Rename spi-cs-setup-ns to spi-cs-setup-delay-ns Other delay values follow the delay-ns naming convention, so unify the newly introduced spi-cs-setup-ns property for consistency. Also fix a typo while we're here. Fixes: f6c911f3308c ("spi: dt-bindings: Introduce spi-cs-setup-ns property") Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20230104093631.15611-2-marcan@marcan.st Signed-off-by: Mark Brown commit cdfa92eb90f5770b26a79824ef213ebdbbd988b1 Author: Chancel Liu Date: Wed Jan 4 10:57:54 2023 +0800 ASoC: fsl_micfil: Correct the number of steps on SX controls The parameter "max" of SOC_SINGLE_SX_TLV() means the number of steps rather than maximum value. This patch corrects the minimum value to -8 and the number of steps to 15. Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20230104025754.3019235-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit b2b50d572135c5c6e10c2ff79cd828d5a8141ef6 Author: Paul E. McKenney Date: Wed Jan 4 16:37:53 2023 -0800 block: Remove "select SRCU" Now that the SRCU Kconfig option is unconditionally selected, there is no longer any point in selecting it. Therefore, remove the "select SRCU" Kconfig statements. Signed-off-by: Paul E. McKenney Cc: Jens Axboe Cc: linux-block@vger.kernel.org Signed-off-by: Jens Axboe commit 601a27ea09a317d0fe2895df7d875381fb393041 Author: Wengang Wang Date: Wed Jan 4 10:05:43 2023 -0800 xfs: fix extent busy updating In xfs_extent_busy_update_extent() case 6 and 7, whenever bno is modified on extent busy, the relavent length has to be modified accordingly. Signed-off-by: Wengang Wang Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit f26cd7372160da2eba31061d7943348ab9f2c01d Author: Mark Brown Date: Tue Dec 27 17:12:06 2022 +0000 arm64/signal: Always allocate SVE signal frames on SME only systems Currently we only allocate space for SVE signal frames on systems that support SVE, meaning that SME only systems do not allocate a signal frame for streaming mode SVE state. Change the check so space is allocated if either feature is supported. Fixes: 85ed24dad290 ("arm64/sme: Implement streaming SVE signal handling") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20221223-arm64-fix-sme-only-v1-3-938d663f69e5@kernel.org Signed-off-by: Will Deacon commit 7dde62f0687c8856b6c0660066c7ee83a6a6f033 Author: Mark Brown Date: Tue Dec 27 17:12:05 2022 +0000 arm64/signal: Always accept SVE signal frames on SME only systems Currently we reject an attempt to restore a SVE signal frame on a system with SME but not SVE supported. This means that it is not possible to disable streaming mode via signal return as this is configured via the flags in the SVE signal context. Instead accept the signal frame, we will require it to have a vector length of 0 specified and no payload since the task will have no SVE vector length configured. Fixes: 85ed24dad290 ("arm64/sme: Implement streaming SVE signal handling") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20221223-arm64-fix-sme-only-v1-2-938d663f69e5@kernel.org Signed-off-by: Will Deacon commit 0cab5b4964c7064893e6ff5e81087a9206c63908 Author: Mark Brown Date: Tue Dec 27 17:12:04 2022 +0000 arm64/sme: Fix context switch for SME only systems When refactoring fpsimd_load() to support keeping SVE enabled over syscalls support for systems with SME but not SVE was broken. The code that selects between loading regular FPSIMD and SVE states was guarded by using system_supports_sve() but is also needed to handle the streaming SVE state in SME only systems where that check will be false. Fix this by also checking for system_supports_sme(). Fixes: a0136be443d5 ("arm64/fpsimd: Load FP state based on recorded data type") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20221223-arm64-fix-sme-only-v1-1-938d663f69e5@kernel.org Signed-off-by: Will Deacon commit dd42ec8ea5b979edcebbf0ba05807d866884b567 Author: Konrad Dybcio Date: Sat Dec 10 21:03:52 2022 +0100 interconnect: qcom: rpm: Use _optional func for provider clocks It turned out that - very unfortunately - msm8996 needs a binding update, adding 2 more clocks to the A2NoC node. Use the _optional variant of devm_clk_get to make sure old DTs will still probe with newer versions of the driver. Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov #db820c Link: https://lore.kernel.org/r/20221210200353.418391-5-konrad.dybcio@linaro.org Signed-off-by: Georgi Djakov commit 4be39d5d86c690c60e2afe55787fc5ec4409d0f0 Author: Konrad Dybcio Date: Sat Dec 10 21:03:51 2022 +0100 interconnect: qcom: msm8996: Fix regmap max_register values The device tree reg starts at BUS_BASE + QoS_OFFSET, but the regmap configs in the ICC driver had values suggesting the reg started at BUS_BASE. Shrink them down (where they haven't been already, so for providers where QoS_OFFSET = 0) to make sure they stay within their window. Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov #db820c Link: https://lore.kernel.org/r/20221210200353.418391-4-konrad.dybcio@linaro.org Signed-off-by: Georgi Djakov commit 60426ff08af6a21275d9c879c0dfb09406469868 Author: Konrad Dybcio Date: Sat Dec 10 21:03:50 2022 +0100 interconnect: qcom: msm8996: Provide UFS clocks to A2NoC On eMMC devices the bootloader has no business enabling UFS clocks. That results in a platform hang and hard reboot when trying to vote on paths including MASTER_UFS and since sync_state guarantees that it's done at boot time, this effectively prevents such devices from booting. Fix that. Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov #db820c Link: https://lore.kernel.org/r/20221210200353.418391-3-konrad.dybcio@linaro.org Signed-off-by: Georgi Djakov commit df875276d8c69b27e1ed242d3cee6bc23d3b7f43 Author: Konrad Dybcio Date: Sat Dec 10 21:03:49 2022 +0100 dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC MSM8996 A2NoC contains a UFS master, which means the UFS hardware is accessed every time sync_state is called within the interconnect framework. It's all good on devices where this clock is already enabled (most likely from the bootloader), but devices with eMMC storage are rather unlikely to have it like that. Add the missing 2 clocks to the binding. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Tested-by: Dmitry Baryshkov #db820c Link: https://lore.kernel.org/r/20221210200353.418391-2-konrad.dybcio@linaro.org Signed-off-by: Georgi Djakov commit 031af50045ea97ed4386eb3751ca2c134d0fc911 Author: Mark Rutland Date: Wed Jan 4 15:16:26 2023 +0000 arm64: cmpxchg_double*: hazard against entire exchange variable The inline assembly for arm64's cmpxchg_double*() implementations use a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a pointer to unsigned long, and thus the hazard only applies to the first 8 bytes of the location. GCC can take advantage of this, assuming that other portions of the location are unchanged, leading to a number of potential problems. This is similar to what we fixed back in commit: fee960bed5e857eb ("arm64: xchg: hazard against entire exchange variable") ... but we forgot to adjust cmpxchg_double*() similarly at the same time. The same problem applies, as demonstrated with the following test: | struct big { | u64 lo, hi; | } __aligned(128); | | unsigned long foo(struct big *b) | { | u64 hi_old, hi_new; | | hi_old = b->hi; | cmpxchg_double_local(&b->lo, &b->hi, 0x12, 0x34, 0x56, 0x78); | hi_new = b->hi; | | return hi_old ^ hi_new; | } ... which GCC 12.1.0 compiles as: | 0000000000000000 : | 0: d503233f paciasp | 4: aa0003e4 mov x4, x0 | 8: 1400000e b 40 | c: d2800240 mov x0, #0x12 // #18 | 10: d2800681 mov x1, #0x34 // #52 | 14: aa0003e5 mov x5, x0 | 18: aa0103e6 mov x6, x1 | 1c: d2800ac2 mov x2, #0x56 // #86 | 20: d2800f03 mov x3, #0x78 // #120 | 24: 48207c82 casp x0, x1, x2, x3, [x4] | 28: ca050000 eor x0, x0, x5 | 2c: ca060021 eor x1, x1, x6 | 30: aa010000 orr x0, x0, x1 | 34: d2800000 mov x0, #0x0 // #0 <--- BANG | 38: d50323bf autiasp | 3c: d65f03c0 ret | 40: d2800240 mov x0, #0x12 // #18 | 44: d2800681 mov x1, #0x34 // #52 | 48: d2800ac2 mov x2, #0x56 // #86 | 4c: d2800f03 mov x3, #0x78 // #120 | 50: f9800091 prfm pstl1strm, [x4] | 54: c87f1885 ldxp x5, x6, [x4] | 58: ca0000a5 eor x5, x5, x0 | 5c: ca0100c6 eor x6, x6, x1 | 60: aa0600a6 orr x6, x5, x6 | 64: b5000066 cbnz x6, 70 | 68: c8250c82 stxp w5, x2, x3, [x4] | 6c: 35ffff45 cbnz w5, 54 | 70: d2800000 mov x0, #0x0 // #0 <--- BANG | 74: d50323bf autiasp | 78: d65f03c0 ret Notice that at the lines with "BANG" comments, GCC has assumed that the higher 8 bytes are unchanged by the cmpxchg_double() call, and that `hi_old ^ hi_new` can be reduced to a constant zero, for both LSE and LL/SC versions of cmpxchg_double(). This patch fixes the issue by passing a pointer to __uint128_t into the +Q constraint, ensuring that the compiler hazards against the entire 16 bytes being modified. With this change, GCC 12.1.0 compiles the above test as: | 0000000000000000 : | 0: f9400407 ldr x7, [x0, #8] | 4: d503233f paciasp | 8: aa0003e4 mov x4, x0 | c: 1400000f b 48 | 10: d2800240 mov x0, #0x12 // #18 | 14: d2800681 mov x1, #0x34 // #52 | 18: aa0003e5 mov x5, x0 | 1c: aa0103e6 mov x6, x1 | 20: d2800ac2 mov x2, #0x56 // #86 | 24: d2800f03 mov x3, #0x78 // #120 | 28: 48207c82 casp x0, x1, x2, x3, [x4] | 2c: ca050000 eor x0, x0, x5 | 30: ca060021 eor x1, x1, x6 | 34: aa010000 orr x0, x0, x1 | 38: f9400480 ldr x0, [x4, #8] | 3c: d50323bf autiasp | 40: ca0000e0 eor x0, x7, x0 | 44: d65f03c0 ret | 48: d2800240 mov x0, #0x12 // #18 | 4c: d2800681 mov x1, #0x34 // #52 | 50: d2800ac2 mov x2, #0x56 // #86 | 54: d2800f03 mov x3, #0x78 // #120 | 58: f9800091 prfm pstl1strm, [x4] | 5c: c87f1885 ldxp x5, x6, [x4] | 60: ca0000a5 eor x5, x5, x0 | 64: ca0100c6 eor x6, x6, x1 | 68: aa0600a6 orr x6, x5, x6 | 6c: b5000066 cbnz x6, 78 | 70: c8250c82 stxp w5, x2, x3, [x4] | 74: 35ffff45 cbnz w5, 5c | 78: f9400480 ldr x0, [x4, #8] | 7c: d50323bf autiasp | 80: ca0000e0 eor x0, x7, x0 | 84: d65f03c0 ret ... sampling the high 8 bytes before and after the cmpxchg, and performing an EOR, as we'd expect. For backporting, I've tested this atop linux-4.9.y with GCC 5.5.0. Note that linux-4.9.y is oldest currently supported stable release, and mandates GCC 5.1+. Unfortunately I couldn't get a GCC 5.1 binary to run on my machines due to library incompatibilities. I've also used a standalone test to check that we can use a __uint128_t pointer in a +Q constraint at least as far back as GCC 4.8.5 and LLVM 3.9.1. Fixes: 5284e1b4bc8a ("arm64: xchg: Implement cmpxchg_double") Fixes: e9a4b795652f ("arm64: cmpxchg_dbl: patch in lse instructions when supported by the CPU") Reported-by: Boqun Feng Link: https://lore.kernel.org/lkml/Y6DEfQXymYVgL3oJ@boqun-archlinux/ Reported-by: Peter Zijlstra Link: https://lore.kernel.org/lkml/Y6GXoO4qmH9OIZ5Q@hirez.programming.kicks-ass.net/ Signed-off-by: Mark Rutland Cc: stable@vger.kernel.org Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Steve Capper Cc: Will Deacon Link: https://lore.kernel.org/r/20230104151626.3262137-1-mark.rutland@arm.com Signed-off-by: Will Deacon commit de535c0234dd2dbd9c790790f2ca1c4ec8a52d2b Merge: afbb1b1caef7f 7ed906e576a78 Author: Marc Zyngier Date: Thu Jan 5 15:26:53 2023 +0000 Merge branch kvm-arm64/MAINTAINERS into kvmarm-master/fixes * kvm-arm64/MAINTAINERS: : . : Update to the KVM/arm64 MAINTAINERS entry: : : - Remove Alexandru from the list of reviewers : - Add Zenghui to the list of reviewers : . MAINTAINERS: Remove myself as a KVM/arm64 reviewer MAINTAINERS: Add Zenghui Yu as a KVM/arm64 reviewer Signed-off-by: Marc Zyngier commit 7ed906e576a782b8272727f39c68a1762ea3ef98 Author: Alexandru Elisei Date: Tue Jan 3 12:07:36 2023 +0000 MAINTAINERS: Remove myself as a KVM/arm64 reviewer Haven't done any meaningful reviews for more than a year, and it doesn't look like I'll be able to do so in the future. Make it official and remove myself from the KVM/arm64 "Reviewers" list. Signed-off-by: Alexandru Elisei Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230103120736.116523-1-alexandru.elisei@arm.com commit 36d7546b56a254709a38f1904231e1a93f1c5717 Author: Marc Zyngier Date: Tue Jan 3 12:39:33 2023 +0000 MAINTAINERS: Add Zenghui Yu as a KVM/arm64 reviewer Zenghui has been around for quite some time, and has been instrumental in reviewing the GICv4/4.1 KVM support. I'm delighted that he's agreed to help with the patch review in a more official capacity! Acked-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230103123933.3234865-1-maz@kernel.org commit ef08c0fadd8a17ebe429b85e23952dac3263ad34 Author: junhua huang Date: Wed Dec 28 09:54:12 2022 +0800 arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning After we fixed the uprobe inst endian in aarch_be, the sparse check report the following warning info: sparse warnings: (new ones prefixed by >>) >> kernel/events/uprobes.c:223:25: sparse: sparse: restricted __le32 degrades to integer >> kernel/events/uprobes.c:574:56: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int [addressable] [usertype] opcode @@ got restricted __le32 [usertype] @@ kernel/events/uprobes.c:574:56: sparse: expected unsigned int [addressable] [usertype] opcode kernel/events/uprobes.c:574:56: sparse: got restricted __le32 [usertype] >> kernel/events/uprobes.c:1483:32: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] insn @@ got restricted __le32 [usertype] @@ kernel/events/uprobes.c:1483:32: sparse: expected unsigned int [usertype] insn kernel/events/uprobes.c:1483:32: sparse: got restricted __le32 [usertype] use the __le32 to u32 for uprobe_opcode_t, to keep the same. Fixes: 60f07e22a73d ("arm64:uprobe fix the uprobe SWBP_INSN in big-endian") Reported-by: kernel test robot Signed-off-by: junhua huang Link: https://lore.kernel.org/r/202212280954121197626@zte.com.cn Signed-off-by: Will Deacon commit afbb1b1caef7fb8b23f31f32162dd5756d877dd5 Merge: d5b4d07bb361f b0803ba72b558 Author: Marc Zyngier Date: Thu Jan 5 15:25:54 2023 +0000 Merge branch kvm-arm64/s1ptw-write-fault into kvmarm-master/fixes * kvm-arm64/s1ptw-write-fault: : . : Fix S1PTW fault handling that was until then always taken : as a write. From the cover letter: : : `Recent developments on the EFI front have resulted in guests that : simply won't boot if the page tables are in a read-only memslot and : that you're a bit unlucky in the way S2 gets paged in... The core : issue is related to the fact that we treat a S1PTW as a write, which : is close enough to what needs to be done. Until to get to RO memslots. : : The first patch fixes this and is definitely a stable candidate. It : splits the faulting of page tables in two steps (RO translation fault, : followed by a writable permission fault -- should it even happen). : The second one documents the slightly odd behaviour of PTW writes to : RO memslot, which do not result in a KVM_MMIO exit. The last patch is : totally optional, only tangentially related, and randomly repainting : stuff (maybe that's contagious, who knows)." : : . KVM: arm64: Convert FSC_* over to ESR_ELx_FSC_* KVM: arm64: Document the behaviour of S1PTW faults on RO memslots KVM: arm64: Fix S1PTW handling on RO memslots Signed-off-by: Marc Zyngier commit d5b4d07bb361fa893244cf55ce5eb053e29b5562 Merge: decb17aeb8fa2 aff234839f8b8 Author: Marc Zyngier Date: Thu Jan 5 15:25:43 2023 +0000 Merge branch kvm-arm64/pmu-fixes-6.2 into kvmarm-master/fixes * kvm-arm64/pmu-fixes-6.2: : . : Fix for an incredibly stupid bug in the PMU rework that went into : 6.2. Brown paper bag time. : . KVM: arm64: PMU: Fix PMCR_EL0 reset value Signed-off-by: Marc Zyngier commit decb17aeb8fa21484a0140c0696dc5a477cc5c57 Author: Marc Zyngier Date: Tue Jan 3 09:50:20 2023 +0000 KVM: arm64: vgic: Add Apple M2 cpus to the list of broken SEIS implementations I really hoped that Apple had fixed their not-quite-a-vgic implementation when moving from M1 to M2. Alas, it seems they didn't, and running a buggy EFI version results in the vgic generating SErrors outside of the guest and taking the host down. Apply the same workaround as for M1. Yes, this is all a bit crap. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230103095022.3230946-2-maz@kernel.org commit 4f4c549feb4ecca95ae9abb88887b941d196f83a Author: Catalin Marinas Date: Thu Dec 22 18:12:51 2022 +0000 arm64: mte: Avoid the racy walk of the vma list during core dump The MTE coredump code in arch/arm64/kernel/elfcore.c iterates over the vma list without the mmap_lock held. This can race with another process or userfaultfd concurrently modifying the vma list. Change the for_each_mte_vma macro and its callers to instead use the vma snapshot taken by dump_vma_snapshot() and stored in the cprm object. Fixes: 6dd8b1a0b6cb ("arm64: mte: Dump the MTE tags in the core file") Cc: # 5.18.x Signed-off-by: Catalin Marinas Reported-by: Seth Jenkins Suggested-by: Seth Jenkins Cc: Will Deacon Link: https://lore.kernel.org/r/20221222181251.1345752-4-catalin.marinas@arm.com Signed-off-by: Will Deacon commit 19e183b54528f11fafeca60fc6d0821e29ff281e Author: Catalin Marinas Date: Thu Dec 22 18:12:50 2022 +0000 elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size} A subsequent fix for arm64 will use this parameter to parse the vma information from the snapshot created by dump_vma_snapshot() rather than traversing the vma list without the mmap_lock. Fixes: 6dd8b1a0b6cb ("arm64: mte: Dump the MTE tags in the core file") Cc: # 5.18.x Signed-off-by: Catalin Marinas Reported-by: Seth Jenkins Suggested-by: Seth Jenkins Cc: Will Deacon Cc: Eric Biederman Cc: Kees Cook Link: https://lore.kernel.org/r/20221222181251.1345752-3-catalin.marinas@arm.com Signed-off-by: Will Deacon commit 736eedc974eaafbf4360e0ea85fc892cea72a223 Author: Catalin Marinas Date: Thu Dec 22 18:12:49 2022 +0000 arm64: mte: Fix double-freeing of the temporary tag storage during coredump Commit 16decce22efa ("arm64: mte: Fix the stack frame size warning in mte_dump_tag_range()") moved the temporary tag storage array from the stack to slab but it also introduced an error in double freeing this object. Remove the in-loop freeing. Fixes: 16decce22efa ("arm64: mte: Fix the stack frame size warning in mte_dump_tag_range()") Cc: # 5.18.x Signed-off-by: Catalin Marinas Reported-by: Seth Jenkins Cc: Will Deacon Link: https://lore.kernel.org/r/20221222181251.1345752-2-catalin.marinas@arm.com Signed-off-by: Will Deacon commit eb9a85261e297292c4cc44b628c1373c996cedc2 Author: Zenghui Yu Date: Wed Dec 14 21:59:43 2022 +0800 arm64: ptrace: Use ARM64_SME to guard the SME register enumerations We currently guard REGSET_{SSVE, ZA} using ARM64_SVE for no good reason. Both enumerations would be pointless without ARM64_SME and create two empty entries in aarch64_regsets[] which would then become part of a process's native regset view (they should be ignored though). Switch to use ARM64_SME instead. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Signed-off-by: Zenghui Yu Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20221214135943.379-1-yuzenghui@huawei.com Signed-off-by: Will Deacon commit 730a11f982e61aaef758ab552dfb7c30de79e99b Author: Liu Shixin Date: Tue Nov 22 20:31:37 2022 +0800 arm64/mm: add pud_user_exec() check in pud_user_accessible_page() Add check for the executable case in pud_user_accessible_page() too like what we did for pte and pmd. Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Suggested-by: Will Deacon Signed-off-by: Liu Shixin Link: https://lore.kernel.org/r/20221122123137.429686-1-liushixin2@huawei.com Signed-off-by: Will Deacon commit 74c2f81054510d45b813548cb0a1c4ebf87cdd5f Author: Liu Shixin Date: Mon Nov 21 15:36:08 2022 +0800 arm64/mm: fix incorrect file_map_count for invalid pmd The page table check trigger BUG_ON() unexpectedly when split hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:119! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 7 PID: 210 Comm: transhuge-stres Not tainted 6.1.0-rc3+ #748 Hardware name: linux,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_set.isra.0+0x398/0x468 lr : page_table_check_set.isra.0+0x1c0/0x468 [...] Call trace: page_table_check_set.isra.0+0x398/0x468 __page_table_check_pte_set+0x160/0x1c0 __split_huge_pmd_locked+0x900/0x1648 __split_huge_pmd+0x28c/0x3b8 unmap_page_range+0x428/0x858 unmap_single_vma+0xf4/0x1c8 zap_page_range+0x2b0/0x410 madvise_vma_behavior+0xc44/0xe78 do_madvise+0x280/0x698 __arm64_sys_madvise+0x90/0xe8 invoke_syscall.constprop.0+0xdc/0x1d8 do_el0_svc+0xf4/0x3f8 el0_svc+0x58/0x120 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x19c/0x1a0 [...] On arm64, pmd_leaf() will return true even if the pmd is invalid due to pmd_present_invalid() check. So in pmdp_invalidate() the file_map_count will not only decrease once but also increase once. Then in set_pte_at(), the file_map_count increase again, and so trigger BUG_ON() unexpectedly. Add !pmd_present_invalid() check in pmd_user_accessible_page() to fix the problem. Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Reported-by: Denys Vlasenko Signed-off-by: Liu Shixin Acked-by: Pasha Tatashin Acked-by: David Hildenbrand Reviewed-by: Kefeng Wang Acked-by: Will Deacon Link: https://lore.kernel.org/r/20221121073608.4183459-1-liushixin2@huawei.com Signed-off-by: Will Deacon commit 12521a5d5cb7ff0ad43eadfc9c135d86e1131fa8 Author: Pavel Begunkov Date: Thu Jan 5 10:49:15 2023 +0000 io_uring: fix CQ waiting timeout handling Jiffy to ktime CQ waiting conversion broke how we treat timeouts, in particular we rearm it anew every time we get into io_cqring_wait_schedule() without adjusting the timeout. Waiting for 2 CQEs and getting a task_work in the middle may double the timeout value, or even worse in some cases task may wait indefinitely. Cc: stable@vger.kernel.org Fixes: 228339662b398 ("io_uring: don't convert to jiffies for waiting on timeouts") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/f7bffddd71b08f28a877d44d37ac953ddb01590d.1672915663.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit be5f95c8779e19779dd81927c8574fec5aaba36c Author: Michael Ellerman Date: Thu Jan 5 22:42:59 2023 +1100 powerpc/vmlinux.lds: Don't discard .comment Although the powerpc linker script mentions .comment in the DISCARD section, that has never actually caused it to be discarded, because the earlier ELF_DETAILS macro (previously STABS_DEBUG) explicitly includes .comment. However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") introduced an earlier use of DISCARD as part of the RO_DATA macro. With binutils < 2.36 that causes the DISCARD directives later in the script to be applied earlier, causing .comment to actually be discarded. It's confusing to explicitly include and discard .comment, and even more so if the behaviour depends on the toolchain version. So don't discard .comment in order to maintain the existing behaviour in all cases. Fixes: 83a092cf95f2 ("powerpc: Link warning for orphan sections") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230105132349.384666-3-mpe@ellerman.id.au commit 07b050f9290ee012a407a0f64151db902a1520f5 Author: Michael Ellerman Date: Thu Jan 5 22:28:36 2023 +1100 powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds Relocatable kernels must not discard relocations, they need to be processed at runtime. As such they are included for CONFIG_RELOCATABLE builds in the powerpc linker script (line 340). However they are also unconditionally discarded later in the script (line 414). Previously that worked because the earlier inclusion superseded the discard. However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") introduced an earlier use of DISCARD as part of the RO_DATA macro (line 137). With binutils < 2.36 that causes the DISCARD directives later in the script to be applied earlier, causing .rela* to actually be discarded at link time, leading to build warnings and a kernel that doesn't boot: ld: warning: discarding dynamic section .rela.init.rodata Fix it by conditionally discarding .rela* only when CONFIG_RELOCATABLE is disabled. Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230105132349.384666-2-mpe@ellerman.id.au commit 4b9880dbf3bdba3a7c56445137c3d0e30aaa0a40 Author: Michael Ellerman Date: Thu Jan 5 22:05:04 2023 +1100 powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT The powerpc linker script explicitly includes .exit.text, because otherwise the link fails due to references from __bug_table and __ex_table. The code is freed (discarded) at runtime along with .init.text and data. That has worked in the past despite powerpc not defining RUNTIME_DISCARD_EXIT because DISCARDS appears late in the powerpc linker script (line 410), and the explicit inclusion of .exit.text earlier (line 280) supersedes the discard. However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") introduced an earlier use of DISCARD as part of the RO_DATA macro (line 136). With binutils < 2.36 that causes the DISCARD directives later in the script to be applied earlier [1], causing .exit.text to actually be discarded at link time, leading to build errors: '.exit.text' referenced in section '__bug_table' of crypto/algboss.o: defined in discarded section '.exit.text' of crypto/algboss.o '.exit.text' referenced in section '__ex_table' of drivers/nvdimm/core.o: defined in discarded section '.exit.text' of drivers/nvdimm/core.o Fix it by defining RUNTIME_DISCARD_EXIT, which causes the generic DISCARDS macro to not include .exit.text at all. 1: https://lore.kernel.org/lkml/87fscp2v7k.fsf@igel.home/ Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230105132349.384666-1-mpe@ellerman.id.au commit 87809d3196c2a7a015ab80ca1cb8c19b659bc5f6 Merge: 88603b6dc4194 4a61648af68f5 Author: Rodrigo Vivi Date: Thu Jan 5 08:03:38 2023 -0500 Merge tag 'gvt-fixes-2023-01-05' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2023-01-05 - Fix one missed unpin in error of intel_vgpu_shadow_mm_pin() - Fix two debugfs destroy oops issues for vgpu and gvt entries - Fix one potential double free issue in gtt shadow pt code - Fix to use atomic bit flag for vgpu status Signed-off-by: Rodrigo Vivi From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/Y7YWoFpz4plnSLCd@zhen-hp.sh.intel.com commit 93235bfd5a9c3329df31d1a4d7a93d138b3138c2 Merge: 83e79ae3216c7 6fe6ece398f74 Author: Daniel Vetter Date: Thu Jan 5 12:13:51 2023 +0100 Merge tag 'amd-drm-fixes-6.2-2023-01-04' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.2-2023-01-04: amdgpu: - DCN 3.2 fix - Display fix amdkfd: - Fix kernel warning Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230105033839.23711-1-alexander.deucher@amd.com commit 634cf6ead93988b0da9ac054521ab63a3ba189db Author: Arnd Bergmann Date: Thu Dec 15 18:02:28 2022 +0100 fbdev: omapfb: avoid stack overflow warning The dsi_irq_stats structure is a little too big to fit on the stack of a 32-bit task, depending on the specific gcc options: fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs': fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Since this is only a debugfs file, performance is not critical, so just dynamically allocate it, and print an error message in there in place of a failure code when the allocation fails. Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller commit fe69230f05897b3de758427b574fc98025dfc907 Author: Zhengchao Shao Date: Wed Jan 4 14:51:46 2023 +0800 caif: fix memory leak in cfctrl_linkup_request() When linktype is unknown or kzalloc failed in cfctrl_linkup_request(), pkt is not released. Add release process to error path. Fixes: b482cd2053e3 ("net-caif: add CAIF core protocol stack") Fixes: 8d545c8f958f ("caif: Disconnect without waiting for response") Signed-off-by: Zhengchao Shao Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20230104065146.1153009-1-shaozhengchao@huawei.com Signed-off-by: Paolo Abeni commit 9c694fbfe6f36017b060ad74c7565cb379852e40 Author: Jeremy Szu Date: Thu Jan 5 12:41:53 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform There is a HP platform uses ALC236 codec which using GPIO2 to control mute LED and GPIO1 to control micmute LED. Thus, add a quirk to make them work. Signed-off-by: Jeremy Szu Cc: Link: https://lore.kernel.org/r/20230105044154.8242-1-jeremy.szu@canonical.com Signed-off-by: Takashi Iwai commit 83e79ae3216c70f2b63c935a4e089d1620e8ef01 Merge: c8de526215fda 69555549cfa42 Author: Daniel Vetter Date: Thu Jan 5 09:43:36 2023 +0100 Merge tag 'drm-misc-fixes-2023-01-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Several fixes to fix the error path of dma_buf_export, add a missing structure declaration resulting in a compiler warning, fix the GEM handle refcounting in panfrost, fix a corrupted image with AFBC on meson, a memleak in virtio, improper plane width for imx, and a lockup in drm_sched_entity_kill() Signed-off-by: Daniel Vetter From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230105074909.qd2h23hpxac4lxi7@houat commit 735aec59afb18c3e2da0a637037e69ad62dbda6a Author: Masahiro Yamada Date: Wed Jan 4 23:04:59 2023 +0900 kbuild: readd -w option when vmlinux.o or Module.symver is missing Commit 63ffe00d8c93 ("kbuild: Fix running modpost with musl libc") accidentally turned the unresolved symbol warnings into errors when vmlinux.o (for in-tree builds) or Module.symver (for external module builds) is missing. In those cases, unresolved symbols are expected, but the -w option is not set because 'missing-input' is referenced before set. Move $(missing-input) back to the original place. This should be fine for musl libc because vmlinux.o and -w are not added at the same time. With this change, -w may be passed twice, but it is not a big deal. Link: https://lore.kernel.org/all/b56a03b8-2a2a-f833-a5d2-cdc50a7ca2bb@cschramm.eu/ Fixes: 63ffe00d8c93 ("kbuild: Fix running modpost with musl libc") Reported-by: Christopher Schramm Signed-off-by: Masahiro Yamada Tested-by: Samuel Holland commit a53da43decaa3936998fa7dce2346855a6942166 Author: Masahiro Yamada Date: Sun Jan 1 15:07:09 2023 +0900 kbuild: fix single *.ko build The single *.ko build is broken since commit f65a486821cf ("kbuild: change module.order to list *.o instead of *.ko"). Fixes: f65a486821cf ("kbuild: change module.order to list *.o instead of *.ko") Reported-by: Marc Kleine-Budde Signed-off-by: Masahiro Yamada Tested-by: Marc Kleine-Budde commit cc7d79d4fad6a4eab3f88c4bb237de72be4478f1 Author: Shyam Prasad N Date: Thu Dec 22 12:54:44 2022 +0000 cifs: fix interface count calculation during refresh The last fix to iface_count did fix the overcounting issue. However, during each refresh, we could end up undercounting the iface_count, if a match was found. Fixing this by doing increments and decrements instead of setting it to 0 before each parsing of server interfaces. Fixes: 096bbeec7bd6 ("smb3: interface count displayed incorrectly") Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7246210ecdd0cda97fa3e3bb15c32c6c2d9a23b5 Author: Shyam Prasad N Date: Tue Dec 27 11:29:28 2022 +0000 cifs: refcount only the selected iface during interface update When the server interface for a channel is not active anymore, we have the logic to select an alternative interface. However this was not breaking out of the loop as soon as a new alternative was found. As a result, some interfaces may get refcounted unintentionally. There was also a bug in checking if we found an alternate iface. Fixed that too. Fixes: b54034a73baf ("cifs: during reconnect, update interface if necessary") Cc: stable@vger.kernel.org # 5.19+ Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 1ac88557447088ccd15eb2f2520ce46d463c8e0b Author: Eric Dumazet Date: Tue Jan 3 19:27:36 2023 +0000 inet: control sockets should not use current thread task_frag Because ICMP handlers run from softirq contexts, they must not use current thread task_frag. Previously, all sockets allocated by inet_ctl_sock_create() would use the per-socket page fragment, with no chance of recursion. Fixes: 98123866fcf3 ("Treewide: Stop corrupting socket's task_frag") Reported-by: syzbot+bebc6f1acdf4cbb79b03@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Benjamin Coddington Acked-by: Guillaume Nault Link: https://lore.kernel.org/r/20230103192736.454149-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2c02d41d71f90a5168391b6a5f2954112ba2307c Author: Paolo Abeni Date: Tue Jan 3 12:19:17 2023 +0100 net/ulp: prevent ULP without clone op from entering the LISTEN status When an ULP-enabled socket enters the LISTEN status, the listener ULP data pointer is copied inside the child/accepted sockets by sk_clone_lock(). The relevant ULP can take care of de-duplicating the context pointer via the clone() operation, but only MPTCP and SMC implement such op. Other ULPs may end-up with a double-free at socket disposal time. We can't simply clear the ULP data at clone time, as TLS replaces the socket ops with custom ones assuming a valid TLS ULP context is available. Instead completely prevent clone-less ULP sockets from entering the LISTEN status. Fixes: 734942cc4ea6 ("tcp: ULP infrastructure") Reported-by: slipper Signed-off-by: Paolo Abeni Link: https://lore.kernel.org/r/4b80c3d1dbe3d0ab072f80450c202d9bc88b4b03.1672740602.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 5401c3e0992860b11fb4b25796e4c4f1921740df Author: Caleb Sander Date: Tue Jan 3 16:30:21 2023 -0700 qed: allow sleep in qed_mcp_trace_dump() By default, qed_mcp_cmd_and_union() delays 10us at a time in a loop that can run 500K times, so calls to qed_mcp_nvm_rd_cmd() may block the current thread for over 5s. We observed thread scheduling delays over 700ms in production, with stacktraces pointing to this code as the culprit. qed_mcp_trace_dump() is called from ethtool, so sleeping is permitted. It already can sleep in qed_mcp_halt(), which calls qed_mcp_cmd(). Add a "can sleep" parameter to qed_find_nvram_image() and qed_nvram_read() so they can sleep during qed_mcp_trace_dump(). qed_mcp_trace_get_meta_info() and qed_mcp_trace_read_meta(), called only by qed_mcp_trace_dump(), allow these functions to sleep. I can't tell if the other caller (qed_grc_dump_mcp_hw_dump()) can sleep, so keep b_can_sleep set to false when it calls these functions. An example stacktrace from a custom warning we added to the kernel showing a thread that has not scheduled despite long needing resched: [ 2745.362925,17] ------------[ cut here ]------------ [ 2745.362941,17] WARNING: CPU: 23 PID: 5640 at arch/x86/kernel/irq.c:233 do_IRQ+0x15e/0x1a0() [ 2745.362946,17] Thread not rescheduled for 744 ms after irq 99 [ 2745.362956,17] Modules linked in: ... [ 2745.363339,17] CPU: 23 PID: 5640 Comm: lldpd Tainted: P O 4.4.182+ #202104120910+6d1da174272d.61x [ 2745.363343,17] Hardware name: FOXCONN MercuryB/Quicksilver Controller, BIOS H11P1N09 07/08/2020 [ 2745.363346,17] 0000000000000000 ffff885ec07c3ed8 ffffffff8131eb2f ffff885ec07c3f20 [ 2745.363358,17] ffffffff81d14f64 ffff885ec07c3f10 ffffffff81072ac2 ffff88be98ed0000 [ 2745.363369,17] 0000000000000063 0000000000000174 0000000000000074 0000000000000000 [ 2745.363379,17] Call Trace: [ 2745.363382,17] [] dump_stack+0x8e/0xcf [ 2745.363393,17] [] warn_slowpath_common+0x82/0xc0 [ 2745.363398,17] [] warn_slowpath_fmt+0x4c/0x50 [ 2745.363404,17] [] ? rcu_irq_exit+0xae/0xc0 [ 2745.363408,17] [] do_IRQ+0x15e/0x1a0 [ 2745.363413,17] [] common_interrupt+0x89/0x89 [ 2745.363416,17] [] ? delay_tsc+0x24/0x50 [ 2745.363425,17] [] __udelay+0x34/0x40 [ 2745.363457,17] [] qed_mcp_cmd_and_union+0x36f/0x7d0 [qed] [ 2745.363473,17] [] qed_mcp_nvm_rd_cmd+0x4d/0x90 [qed] [ 2745.363490,17] [] qed_mcp_trace_dump+0x4a7/0x630 [qed] [ 2745.363504,17] [] ? qed_fw_asserts_dump+0x1d6/0x1f0 [qed] [ 2745.363520,17] [] qed_dbg_mcp_trace_get_dump_buf_size+0x37/0x80 [qed] [ 2745.363536,17] [] qed_dbg_feature_size+0x61/0xa0 [qed] [ 2745.363551,17] [] qed_dbg_all_data_size+0x247/0x260 [qed] [ 2745.363560,17] [] qede_get_regs_len+0x30/0x40 [qede] [ 2745.363566,17] [] ethtool_get_drvinfo+0xe3/0x190 [ 2745.363570,17] [] dev_ethtool+0x1362/0x2140 [ 2745.363575,17] [] ? finish_task_switch+0x76/0x260 [ 2745.363580,17] [] ? __schedule+0x3c6/0x9d0 [ 2745.363585,17] [] ? hrtimer_start_range_ns+0x1d0/0x370 [ 2745.363589,17] [] ? dev_get_by_name_rcu+0x6b/0x90 [ 2745.363594,17] [] dev_ioctl+0xe8/0x710 [ 2745.363599,17] [] sock_do_ioctl+0x48/0x60 [ 2745.363603,17] [] sock_ioctl+0x1c7/0x280 [ 2745.363608,17] [] ? seccomp_phase1+0x83/0x220 [ 2745.363612,17] [] do_vfs_ioctl+0x2b3/0x4e0 [ 2745.363616,17] [] SyS_ioctl+0x41/0x70 [ 2745.363619,17] [] entry_SYSCALL_64_fastpath+0x1e/0x79 [ 2745.363622,17] ---[ end trace f6954aa440266421 ]--- Fixes: c965db4446291 ("qed: Add support for debug data collection") Signed-off-by: Caleb Sander Acked-by: Alok Prasad Link: https://lore.kernel.org/r/20230103233021.1457646-1-csander@purestorage.com Signed-off-by: Jakub Kicinski commit 49d9601b8187f202bb7f6f43026ef6acf4c7a178 Merge: 558016722e9d5 45435d8da71f9 Author: Jakub Kicinski Date: Wed Jan 4 20:17:19 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== bpf 2023-01-04 We've added 5 non-merge commits during the last 8 day(s) which contain a total of 5 files changed, 112 insertions(+), 18 deletions(-). The main changes are: 1) Always use maximal size for copy_array in the verifier to fix KASAN tracking, from Kees. 2) Fix bpf task iterator walking through dead tasks, from Kui-Feng. 3) Make sure livepatch and bpf fexit can coexist, from Chuang. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Always use maximal size for copy_array() selftests/bpf: add a test for iter/task_vma for short-lived processes bpf: keep a reference to the mm, in case the task is dead. selftests/bpf: Temporarily disable part of btf_dump:var_data test. bpf: Fix panic due to wrong pageattr of im->image ==================== Link: https://lore.kernel.org/r/20230104215500.79435-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit 064e32dc5b03114d0767893fecdaf7b5dfd8c286 Author: Rob Herring Date: Tue Jan 3 12:00:32 2023 -0600 of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 I do not read a strict requirement on /chosen node in either ePAPR or in Documentation/devicetree. Help text for CONFIG_CMDLINE and CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on the presence of /chosen or the presense of /chosen/bootargs. However the early check for /chosen and bailing out in early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not really related to /chosen node or the particular method of passing cmdline from bootloader. This leads to counterintuitive combinations (assuming CONFIG_CMDLINE_EXTEND=y): a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar" b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline=="" c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar" Rework early_init_dt_scan_chosen() so that the cmdline config options are always handled. [commit msg written by Alexander Sverdlin] Cc: Alexander Sverdlin Cc: Linus Walleij Cc: Arnd Bergmann Tested-by: Geoff Levand Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20230103-dt-cmdline-fix-v1-2-7038e88b18b6@kernel.org Signed-off-by: Rob Herring commit bd0ddcfc83d85bc30c868f2c3457312c7f1ccee2 Author: Rob Herring Date: Tue Jan 3 12:00:31 2023 -0600 Revert "of: fdt: Honor CONFIG_CMDLINE* even without /chosen node" This reverts commit a7d550f82b445cf218b47a2c1a9c56e97ecb8c7a. Some arches (PPC at least) don't call early_init_dt_scan_nodes(), so moving the cmdline processing there breaks them. Reported-by: Geoff Levand Cc: Alexander Sverdlin Tested-by: Geoff Levand Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20230103-dt-cmdline-fix-v1-1-7038e88b18b6@kernel.org Signed-off-by: Rob Herring commit 6fe6ece398f7431784847e922a2c8c385dc58a35 Author: Michel Dänzer Date: Wed Dec 21 16:24:13 2022 +0100 Revert "drm/amd/display: Enable Freesync Video Mode by default" This reverts commit de05abe6b9d0fe08f65d744f7f75a4cba4df27ad. The bug referenced below was bisected to this commit. There has been no activity toward fixing it in 3 months, so let's revert for now. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2162 Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 41c03ba9beea760bd2d2ac9250b09a2e192da2dc Merge: 512dee0c00ad9 a26116c1e7402 Author: Linus Torvalds Date: Wed Jan 4 17:13:53 2023 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Mostly fixes all over the place, a couple of cleanups" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (32 commits) virtio_blk: Fix signedness bug in virtblk_prep_rq() vdpa_sim_net: should not drop the multicast/broadcast packet vdpasim: fix memory leak when freeing IOTLBs vdpa: conditionally fill max max queue pair for stats vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove vduse: Validate vq_num in vduse_validate_config() tools/virtio: remove smp_read_barrier_depends() tools/virtio: remove stray characters vhost_vdpa: fix the crash in unmap a large memory virtio: Implementing attribute show with sysfs_emit virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() tools/virtio: Variable type completion vdpa_sim: fix vringh initialization in vdpasim_queue_ready() virtio_blk: use UINT_MAX instead of -1U vhost-vdpa: fix an iotlb memory leak vhost: fix range used in translate_desc() vringh: fix range used in iotlb_translate() vhost/vsock: Fix error handling in vhost_vsock_init() vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() tools: Delete the unneeded semicolon after curly braces ... commit 4b83e99ee7092df37a5cf292fde976ebc475ea63 Author: Jens Axboe Date: Wed Jan 4 14:44:13 2023 -0700 Revert "pktcdvd: remove driver." This reverts commit f40eb99897af665f11858dd7b56edcb62c3f3c67. There are apparently still users out there of this driver. While we'd love to remove it to ease the maintenance burden, let's reinstate it for now until better (userspace) solutions can be developed. Link: https://lore.kernel.org/lkml/20230104190115.ceglfefco475ev6c@pali/ Reported-by: Pali Rohár Signed-off-by: Jens Axboe commit 050a4f341f35bf51db321c7f68700f9e0b1a7552 Author: Jens Axboe Date: Wed Jan 4 14:44:02 2023 -0700 Revert "block: remove devnode callback from struct block_device_operations" This reverts commit 85d6ce58e493ac8b7122e2fbe3f41b94d6ebdc11. We're reinstating the pktcdvd driver, which needs this API. Signed-off-by: Jens Axboe commit ee4b4e2248565babfba807d82c0f3e00c392a4c0 Author: Jens Axboe Date: Wed Jan 4 14:43:27 2023 -0700 Revert "block: bio_copy_data_iter" This reverts commit db1c7d77976775483a8ef240b4c705f113e13ea1. We're reinstating the pktcdvd driver, which needs this API. Signed-off-by: Jens Axboe commit 59b745bb4e0bd445366c45b8df6b51b69134f4f5 Author: Jens Axboe Date: Wed Jan 4 13:49:54 2023 -0700 io_uring: move 'poll_multi_queue' bool in io_ring_ctx The cacheline section holding this variable has two gaps, where one is caused by this bool not packing well with structs. This causes it to blow into the next cacheline. Move the variable, shrinking io_ring_ctx by a full cacheline in size. Signed-off-by: Jens Axboe commit fa8e442e832a3647cdd90f3e606c473a51bc1b26 Author: Ming Lei Date: Wed Jan 4 21:32:35 2023 +0800 ublk: honor IO_URING_F_NONBLOCK for handling control command Most of control command handlers may sleep, so return -EAGAIN in case of IO_URING_F_NONBLOCK to defer the handling into io wq context. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reported-by: Jens Axboe Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230104133235.836536-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9cea62b2cbabff8ed46f2df17778b624ad9dd25a Author: Jens Axboe Date: Wed Jan 4 08:52:06 2023 -0700 block: don't allow splitting of a REQ_NOWAIT bio If we split a bio marked with REQ_NOWAIT, then we can trigger spurious EAGAIN if constituent parts of that split bio end up failing request allocations. Parts will complete just fine, but just a single failure in one of the chained bios will yield an EAGAIN final result for the parent bio. Return EAGAIN early if we end up needing to split such a bio, which allows for saner recovery handling. Cc: stable@vger.kernel.org # 5.15+ Link: https://github.com/axboe/liburing/issues/766 Reported-by: Michael Kelley Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 512dee0c00ad9e9c7ae9f11fc6743702ea40caff Merge: 2ac44821a8161 a664ec9158eed Author: Linus Torvalds Date: Wed Jan 4 12:11:29 2023 -0800 Merge tag 'x86-urgent-2023-01-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: "Fix a double-free bug, a binutils warning, a header namespace clash and a bug in ib_prctl_set()" * tag 'x86-urgent-2023-01-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Flush IBP in ib_prctl_set() x86/insn: Avoid namespace clash by separating instruction decoder MMIO type from MMIO trace type x86/asm: Fix an assembler warning with current binutils x86/kexec: Fix double-free of elf header buffer commit 2ac44821a81612317f4451b765986d8b9695d5d5 Merge: b61778fa51730 df9d44b645b83 Author: Linus Torvalds Date: Wed Jan 4 12:02:26 2023 -0800 Merge tag 'f2fs-fix-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: - fix a null pointer dereference in f2fs_issue_flush, which occurs by the combination of mount/remount options. - fix a bug in per-block age-based extent_cache newly introduced in 6.2-rc1, which reported a wrong age information in extent_cache. - fix a kernel panic if extent_tree was not created, which was caught by a wrong BUG_ON * tag 'f2fs-fix-6.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: let's avoid panic if extent_tree is not created f2fs: should use a temp extent_info for lookup f2fs: don't mix to use union values in extent_info f2fs: initialize extent_cache parameter f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() commit 57512b57dcfaf63c52d8ad2fb35321328cde31b0 Author: Zhang Rui Date: Wed Jan 4 22:58:31 2023 +0800 perf/x86/rapl: Add support for Intel Emerald Rapids Emerald Rapids RAPL support is the same as previous Sapphire Rapids. Add Emerald Rapids model for RAPL. Signed-off-by: Zhang Rui Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230104145831.25498-2-rui.zhang@intel.com commit f52853a668bfeddd79f319d536a506f68cc2b478 Author: Zhang Rui Date: Wed Jan 4 22:58:30 2023 +0800 perf/x86/rapl: Add support for Intel Meteor Lake Meteor Lake RAPL support is the same as previous Sky Lake. Add Meteor Lake model for RAPL. Signed-off-by: Zhang Rui Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230104145831.25498-1-rui.zhang@intel.com commit 481028dbf1daa2808e1be06f6a865b5fe5939efc Author: Jesus Sanchez-Palencia Date: Wed Jan 4 11:34:14 2023 -0800 perf tools: Fix build on uClibc systems by adding missing sys/types.h include Not all libc implementations define ssize_t as part of stdio.h like glibc does since the standard only requires this type to be defined by unistd.h and sys/types.h. For this reason the perf build is currently broken for toolchains based on uClibc, for instance. Include sys/types.h explicitly to fix that. Committer notes: In addition, in the past this worked in uClibc test systems as there was another way to get to sys/types.h that got removed in that cset: tools/perf/util/trace-event.h /usr/include/traceevent/event_parse.h # This got removed from util/trace-event.h in 378ef0f5d9d7f465 /usr/include/regex.h /usr/include/sys/types.h typedef __ssize_t ssize_t; So the size_t that is used in tools/perf/util/trace-event.h was being obtained indirectly, by chance. Fixes: 378ef0f5d9d7f465 ("perf build: Use libtraceevent from the system") Signed-off-by: Jesus Sanchez-Palencia Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20230104193414.606905-1-jesussanp@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b61778fa5173021e628b3c9372c9ceae01951b34 Merge: 69b41ac87e4a6 cad853374d85f Author: Linus Torvalds Date: Wed Jan 4 11:26:36 2023 -0800 Merge tag 'nfsd-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix a filecache UAF during NFSD shutdown - Avoid exposing automounted mounts on NFS re-exports * tag 'nfsd-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: fix handling of readdir in v4root vs. mount upcall timeout nfsd: shut down the NFSv4 state objects before the filecache commit be79f805a1e1b95605c825f1c513bdd2c8b167ed Author: Bryan O'Donoghue Date: Thu Dec 29 12:44:38 2022 +0000 dt-bindings: msm: dsi-phy-28nm: Add missing qcom, dsi-phy-regulator-ldo-mode Add in missing qcom,dsi-phy-regulator-ldo-mode to the 28nm DSI PHY. When converting from .txt to .yaml we missed this one. Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") Reviewed-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Patchwork: https://patchwork.freedesktop.org/patch/516205/ Link: https://lore.kernel.org/r/20221229124438.504770-2-bryan.odonoghue@linaro.org Signed-off-by: Abhinav Kumar commit 613b14884b8595e20b9fac4126bf627313827fbe Author: Jens Axboe Date: Wed Jan 4 08:51:19 2023 -0700 block: handle bio_split_to_limits() NULL return This can't happen right now, but in preparation for allowing bio_split_to_limits() returning NULL if it ended the bio, check for it in all the callers. Signed-off-by: Jens Axboe commit 4a61648af68f5ba4884f0e3b494ee1cabc4b6620 Author: Zheng Wang Date: Fri Dec 30 00:56:41 2022 +0800 drm/i915/gvt: fix double free bug in split_2MB_gtt_entry If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller function ppgtt_populate_spt_by_guest_entry does not notice that, it will free spt again in its error path. Fix this by canceling the mapping of DMA address and freeing sub_spt. Besides, leave the handle of spt destroy to caller function instead of callee function when error occurs. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Signed-off-by: Zheng Wang Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20221229165641.1192455-1-zyytlz.wz@163.com commit a06d4b9e15c0ea4e05b200cfb1f1050e785a5e87 Author: Zhi Wang Date: Thu Nov 10 12:20:34 2022 +0000 drm/i915/gvt: use atomic operations to change the vGPU status Several vGPU status are used to decide the availability of GVT-g core logics when creating a vGPU. Use atomic operations on changing the vGPU status to avoid the racing. Cc: Zhenyu Wang Cc: Kevin Tian Cc: Jason Gunthorpe Cc: intel-gvt-dev@lists.freedesktop.org Suggested-by: Alex Williamson Signed-off-by: Zhi Wang Reviewed-by: Zhenyu Wang Reviewed-by: Kevin Tian Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20221110122034.3382-2-zhi.a.wang@intel.com commit 704f3384f322b40ba24d958473edfb1c9750c8fd Author: Zhenyu Wang Date: Mon Dec 19 22:03:57 2022 +0800 drm/i915/gvt: fix vgpu debugfs clean in remove Check carefully on root debugfs available when destroying vgpu, e.g in remove case drm minor's debugfs root might already be destroyed, which led to kernel oops like below. Console: switching to colour dummy device 80x25 i915 0000:00:02.0: MDEV: Unregistering intel_vgpu_mdev b1338b2d-a709-4c23-b766-cc436c36cdf0: Removing from iommu group 14 BUG: kernel NULL pointer dereference, address: 0000000000000150 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 3 PID: 1046 Comm: driverctl Not tainted 6.1.0-rc2+ #6 Hardware name: HP HP ProDesk 600 G3 MT/829D, BIOS P02 Ver. 02.44 09/13/2022 RIP: 0010:__lock_acquire+0x5e2/0x1f90 Code: 87 ad 09 00 00 39 05 e1 1e cc 02 0f 82 f1 09 00 00 ba 01 00 00 00 48 83 c4 48 89 d0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ff <48> 81 3f 60 9e c2 b6 45 0f 45 f8 83 fe 01 0f 87 55 fa ff ff 89 f0 RSP: 0018:ffff9f770274f948 EFLAGS: 00010046 RAX: 0000000000000003 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000150 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8895d1173300 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000150 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fc9b2ba0740(0000) GS:ffff889cdfcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000150 CR3: 000000010fd93005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0xbf/0x2b0 ? simple_recursive_removal+0xa5/0x2b0 ? lock_release+0x13d/0x2d0 down_write+0x2a/0xd0 ? simple_recursive_removal+0xa5/0x2b0 simple_recursive_removal+0xa5/0x2b0 ? start_creating.part.0+0x110/0x110 ? _raw_spin_unlock+0x29/0x40 debugfs_remove+0x40/0x60 intel_gvt_debugfs_remove_vgpu+0x15/0x30 [kvmgt] intel_gvt_destroy_vgpu+0x60/0x100 [kvmgt] intel_vgpu_release_dev+0xe/0x20 [kvmgt] device_release+0x30/0x80 kobject_put+0x79/0x1b0 device_release_driver_internal+0x1b8/0x230 bus_remove_device+0xec/0x160 device_del+0x189/0x400 ? up_write+0x9c/0x1b0 ? mdev_device_remove_common+0x60/0x60 [mdev] mdev_device_remove_common+0x22/0x60 [mdev] mdev_device_remove_cb+0x17/0x20 [mdev] device_for_each_child+0x56/0x80 mdev_unregister_parent+0x5a/0x81 [mdev] intel_gvt_clean_device+0x2d/0xe0 [kvmgt] intel_gvt_driver_remove+0x2e/0xb0 [i915] i915_driver_remove+0xac/0x100 [i915] i915_pci_remove+0x1a/0x30 [i915] pci_device_remove+0x31/0xa0 device_release_driver_internal+0x1b8/0x230 unbind_store+0xd8/0x100 kernfs_fop_write_iter+0x156/0x210 vfs_write+0x236/0x4a0 ksys_write+0x61/0xd0 do_syscall_64+0x55/0x80 ? find_held_lock+0x2b/0x80 ? lock_release+0x13d/0x2d0 ? up_read+0x17/0x20 ? lock_is_held_type+0xe3/0x140 ? asm_exc_page_fault+0x22/0x30 ? lockdep_hardirqs_on+0x7d/0x100 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fc9b2c9e0c4 Code: 15 71 7d 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 80 3d 3d 05 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 48 89 54 24 18 48 RSP: 002b:00007ffec29c81c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc9b2c9e0c4 RDX: 000000000000000d RSI: 0000559f8b5f48a0 RDI: 0000000000000001 RBP: 0000559f8b5f48a0 R08: 0000559f8b5f3540 R09: 00007fc9b2d76d30 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d R13: 00007fc9b2d77780 R14: 000000000000000d R15: 00007fc9b2d72a00 Modules linked in: sunrpc intel_rapl_msr intel_rapl_common intel_pmc_core_pltdrv intel_pmc_core intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ee1004 igbvf rapl vfat fat intel_cstate intel_uncore pktcdvd i2c_i801 pcspkr wmi_bmof i2c_smbus acpi_pad vfio_pci vfio_pci_core vfio_virqfd zram fuse dm_multipath kvmgt mdev vfio_iommu_type1 vfio kvm irqbypass i915 nvme e1000e igb nvme_core crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic serio_raw ghash_clmulni_intel sha512_ssse3 dca drm_buddy intel_gtt video wmi drm_display_helper ttm CR2: 0000000000000150 ---[ end trace 0000000000000000 ]--- Cc: Wang Zhi Cc: He Yu Cc: Alex Williamson Cc: stable@vger.kernel.org Reviewed-by: Zhi Wang Tested-by: Yu He Fixes: bc7b0be316ae ("drm/i915/gvt: Add basic debugfs infrastructure") Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20221219140357.769557-2-zhenyuw@linux.intel.com commit c4b850d1f448a901fbf4f7f36dec38c84009b489 Author: Zhenyu Wang Date: Mon Dec 19 22:03:56 2022 +0800 drm/i915/gvt: fix gvt debugfs destroy When gvt debug fs is destroyed, need to have a sane check if drm minor's debugfs root is still available or not, otherwise in case like device remove through unbinding, drm minor's debugfs directory has already been removed, then intel_gvt_debugfs_clean() would act upon dangling pointer like below oops. i915 0000:00:02.0: Direct firmware load for i915/gvt/vid_0x8086_did_0x1926_rid_0x0a.golden_hw_state failed with error -2 i915 0000:00:02.0: MDEV: Registered Console: switching to colour dummy device 80x25 i915 0000:00:02.0: MDEV: Unregistering BUG: kernel NULL pointer dereference, address: 00000000000000a0 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 2486 Comm: gfx-unbind.sh Tainted: G I 6.1.0-rc8+ #15 Hardware name: Dell Inc. XPS 13 9350/0JXC1H, BIOS 1.13.0 02/10/2020 RIP: 0010:down_write+0x1f/0x90 Code: 1d ff ff 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb e8 62 c0 ff ff bf 01 00 00 00 e8 28 5e 31 ff 31 c0 ba 01 00 00 00 48 0f b1 13 75 33 65 48 8b 04 25 c0 bd 01 00 48 89 43 08 bf 01 RSP: 0018:ffff9eb3036ffcc8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000000a0 RCX: ffffff8100000000 RDX: 0000000000000001 RSI: 0000000000000064 RDI: ffffffffa48787a8 RBP: ffff9eb3036ffd30 R08: ffffeb1fc45a0608 R09: ffffeb1fc45a05c0 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 R13: ffff91acc33fa328 R14: ffff91acc033f080 R15: ffff91acced533e0 FS: 00007f6947bba740(0000) GS:ffff91ae36d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a0 CR3: 00000001133a2002 CR4: 00000000003706e0 Call Trace: simple_recursive_removal+0x9f/0x2a0 ? start_creating.part.0+0x120/0x120 ? _raw_spin_lock+0x13/0x40 debugfs_remove+0x40/0x60 intel_gvt_debugfs_clean+0x15/0x30 [kvmgt] intel_gvt_clean_device+0x49/0xe0 [kvmgt] intel_gvt_driver_remove+0x2f/0xb0 i915_driver_remove+0xa4/0xf0 i915_pci_remove+0x1a/0x30 pci_device_remove+0x33/0xa0 device_release_driver_internal+0x1b2/0x230 unbind_store+0xe0/0x110 kernfs_fop_write_iter+0x11b/0x1f0 vfs_write+0x203/0x3d0 ksys_write+0x63/0xe0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6947cb5190 Code: 40 00 48 8b 15 71 9c 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d 51 24 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 RSP: 002b:00007ffcbac45a28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f6947cb5190 RDX: 000000000000000d RSI: 0000555e35c866a0 RDI: 0000000000000001 RBP: 0000555e35c866a0 R08: 0000000000000002 R09: 0000555e358cb97c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 R13: 000000000000000d R14: 0000000000000000 R15: 0000555e358cb8e0 Modules linked in: kvmgt CR2: 00000000000000a0 ---[ end trace 0000000000000000 ]--- Cc: Wang, Zhi Cc: He, Yu Cc: stable@vger.kernel.org Reviewed-by: Zhi Wang Fixes: bc7b0be316ae ("drm/i915/gvt: Add basic debugfs infrastructure") Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20221219140357.769557-1-zhenyuw@linux.intel.com commit 3792fc508c095abd84b10ceae12bd773e61fdc36 Author: Dan Carpenter Date: Tue Nov 15 16:15:18 2022 +0300 drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() Call intel_vgpu_unpin_mm() on this error path. Fixes: 418741480809 ("drm/i915/gvt: Adding ppgtt to GVT GEM context after shadow pdps settled.") Signed-off-by: Dan Carpenter Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/Y3OQ5tgZIVxyQ/WV@kili Reviewed-by: Zhenyu Wang commit 16f1f838442dc6430d32d51ddda347b8421ec34b Author: Takashi Iwai Date: Wed Jan 4 16:09:44 2023 +0100 Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing" This reverts commit ac5e2fb425e1121ceef2b9d1b3ffccc195d55707. The commit caused a regression on Behringer UMC404HD (and likely others). As the change was meant only as a minor optimization, it's better to revert it to address the regression. Reported-and-tested-by: Michael Ralston Cc: Link: https://lore.kernel.org/r/CAC2975JXkS1A5Tj9b02G_sy25ZWN-ys+tc9wmkoS=qPgKCogSg@mail.gmail.com Link: https://lore.kernel.org/r/20230104150944.24918-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 39a154fc2d172a3a5865e5a9fa2a2983eb7a99ac Author: Paulo Alcantara Date: Thu Dec 29 18:43:46 2022 -0300 cifs: protect access of TCP_Server_Info::{dstaddr,hostname} Use the appropriate locks to protect access of hostname and dstaddr fields in cifs_tree_connect() as they might get changed by other tasks. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 191f8453fc99a537ea78b727acea739782378b0d Author: Jens Axboe Date: Wed Jan 4 07:48:37 2023 -0700 ARM: renumber bits related to _TIF_WORK_MASK We want to ensure that the mask related to calling do_work_pending() is within the first 16 bits. Move bits unrelated to that outside of that range, to avoid spuriously calling do_work_pending() when we don't need to. Cc: stable@vger.kernel.org Fixes: 32d59773da38 ("arm: add support for TIF_NOTIFY_SIGNAL") Reported-and-tested-by: Hui Tang Suggested-by: Russell King (Oracle) Link: https://lore.kernel.org/lkml/7ecb8f3c-2aeb-a905-0d4a-aa768b9649b5@huawei.com/ Signed-off-by: Jens Axboe commit 54b353a20c7e8be98414754f5aff98c8a68fcc1f Author: Namhyung Kim Date: Tue Jan 3 22:44:02 2023 -0800 perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode The --for-each-cgroup can have the same cgroup multiple times, but this confuses BPF counters (since they have the same cgroup id), making only the last cgroup events to be counted. Let's check the cgroup name before adding a new entry to the cgroups list. Before: $ sudo ./perf stat -a --bpf-counters --for-each-cgroup /,/ sleep 1 Performance counter stats for 'system wide': msec cpu-clock / context-switches / cpu-migrations / page-faults / cycles / instructions / branches / branch-misses / 8,016.04 msec cpu-clock / # 7.998 CPUs utilized 6,152 context-switches / # 767.461 /sec 250 cpu-migrations / # 31.187 /sec 442 page-faults / # 55.139 /sec 613,111,487 cycles / # 0.076 GHz 280,599,604 instructions / # 0.46 insn per cycle 57,692,724 branches / # 7.197 M/sec 3,385,168 branch-misses / # 5.87% of all branches 1.002220125 seconds time elapsed After it becomes similar to the non-BPF mode: $ sudo ./perf stat -a --bpf-counters --for-each-cgroup /,/ sleep 1 Performance counter stats for 'system wide': 8,013.38 msec cpu-clock / # 7.998 CPUs utilized 6,859 context-switches / # 855.944 /sec 334 cpu-migrations / # 41.680 /sec 345 page-faults / # 43.053 /sec 782,326,119 cycles / # 0.098 GHz 471,645,724 instructions / # 0.60 insn per cycle 94,963,430 branches / # 11.851 M/sec 3,685,511 branch-misses / # 3.88% of all branches 1.001864539 seconds time elapsed Committer notes: As a reminder, to test with BPF counters one has to use BUILD_BPF_SKEL=1 in the make command line and have clang/llvm installed when building perf, otherwise the --bpf-counters option will not be available: # perf stat -a --bpf-counters --for-each-cgroup /,/ sleep 1 Error: unknown option `bpf-counters' Usage: perf stat [] [] -a, --all-cpus system-wide collection from all CPUs # Fixes: bb1c15b60b981d10 ("perf stat: Support regex pattern in --for-each-cgroup") Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: bpf@vger.kernel.org Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20230104064402.1551516-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2d656b0f81b22101db0447f890e39fdd736b745e Author: Namhyung Kim Date: Tue Jan 3 22:44:01 2023 -0800 perf stat: Fix handling of unsupported cgroup events when using BPF counters When --for-each-cgroup option is used, it fails when any of events is not supported and exits immediately. This is not how 'perf stat' handles unsupported events. Let's ignore the failure and proceed with others so that the output is similar to when BPF counters are not used: Before: $ sudo ./perf stat -a --bpf-counters -e L1-icache-loads,L1-dcache-loads --for-each-cgroup system.slice,user.slice sleep 1 Failed to open first cgroup events $ After it shows output similat to when --bpf-counters isn't specified: $ sudo ./perf stat -a --bpf-counters -e L1-icache-loads,L1-dcache-loads --for-each-cgroup system.slice,user.slice sleep 1 Performance counter stats for 'system wide': L1-icache-loads system.slice 29,892,418 L1-dcache-loads system.slice L1-icache-loads user.slice 52,497,220 L1-dcache-loads user.slice $ Fixes: 944138f048f7d759 ("perf stat: Enable BPF counter with --for-each-cgroup") Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20230104064402.1551516-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fb710ddee75fb96f50ee6d004ef777a0cf7ad5a3 Author: Thomas Richter Date: Wed Dec 28 15:57:03 2022 +0100 perf test record_probe_libc_inet_pton: Fix test on s/390 where 'text_to_binary_address' now appears on the backtrace perf test '84: probe libc's inet_pton & backtrace it with ping' fails on s390. Debugging revealed a changed stack trace for the ping command using probes: ping 35729 [002] 8006.365063: probe_libc:inet_pton: (3ff9603e7c0) 13e7c0 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) ---> 104371 text_to_binary_address+0xef1 (inlined) 104371 gaih_inet+0xef1 (inlined) 104371 __GI_getaddrinfo+0xef1 (inlined) 5d4b main+0x139b (/usr/bin/ping) The line "---> text_to_binary_address ..." is new. It was introduced with glibc version 2.36.7.2 released with Fedora 37 for s390. Output before # perf test inet_pton 84: probe libc's inet_pton & backtrace it with ping : FAILED! # Output after: # perf test inet_pton 84: probe libc's inet_pton & backtrace it with ping : Ok # Signed-off-by: Thomas Richter Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20221228145704.2702487-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 760d560f71c828a97c77596af5c3f9978aefd9d1 Author: Lukas Bulwahn Date: Thu Dec 15 11:34:52 2022 +0100 PCI: dwc: Adjust to recent removal of PCI_MSI_IRQ_DOMAIN a474d3fbe287 ("PCI/MSI: Get rid of PCI_MSI_IRQ_DOMAIN") removed PCI_MSI_IRQ_DOMAIN and changed all references to refer to PCI_MSI instead. ba6ed462dcf4 ("PCI: dwc: Add Baikal-T1 PCIe controller support") independently added PCIE_BT1, depending on PCI_MSI_IRQ_DOMAIN. Both commits appeared in v6.2-rc1, so the latter missed the conversion from PCI_MSI_IRQ_DOMAIN to PCI_MSI. Update PCIE_BT1 to depend on PCI_MSI instead. [bhelgaas: commit log] Link: https://lore.kernel.org/r/20221215103452.23131-1-lukas.bulwahn@gmail.com Signed-off-by: Lukas Bulwahn Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Serge Semin commit c956541736b94944047ee52ebfc5ee4babcd6ca1 Author: Hector Martin Date: Wed Jan 4 19:21:49 2023 +0900 cpufreq: apple-soc: Switch to the lowest frequency on suspend Without this, the CPUs are left in a random pstate. Since we don't support deep idle yet (which powers down the CPUs), this results in significantly increased idle power consumption in suspend. Fixes: 6286bbb40576 ("cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states") Signed-off-by: Hector Martin Signed-off-by: Viresh Kumar commit fa81ab49bbe4e1ce756581c970486de0ddb14309 Author: Miaoqian Lin Date: Fri Dec 16 14:03:03 2022 +0400 memblock: Fix doc for memblock_phys_free memblock_phys_free() is the counterpart to memblock_phys_alloc. Change memblock_alloc_xx() with memblock_phys_alloc_xx() to keep consistency. Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20221216100304.688209-1-linmq006@gmail.com Signed-off-by: Mike Rapoport (IBM) commit 340726747336716350eb5a928b860a29db955f05 Author: Aaron Thompson Date: Wed Jan 4 10:07:37 2023 +0000 memblock tests: Fix compilation error. Commit cf4694be2b2cf ("tools: Add atomic_test_and_set_bit()") changed tools/arch/x86/include/asm/atomic.h to include , which causes 'make -C tools/testing/memblock' to fail with: In file included from ../../include/asm/atomic.h:6, from ../../include/linux/atomic.h:5, from ./linux/mmzone.h:5, from ../../include/linux/mm.h:5, from ../../include/linux/pfn.h:5, from ./linux/memory_hotplug.h:6, from ./linux/init.h:7, from ./linux/memblock.h:11, from tests/common.h:8, from tests/basic_api.h:5, from main.c:2: ../../include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/asm.h: No such file or directory 11 | #include | ^~~~~~~~~~~ Create a symlink to asm/asm.h in the same manner as the existing one to asm/cmpxchg.h. Signed-off-by: Aaron Thompson Link: https://lore.kernel.org/r/010101857c402765-96e2dbc6-b82b-47e2-a437-4834dbe0b96b-000000@us-west-2.amazonses.com Signed-off-by: Mike Rapoport (IBM) commit a664ec9158eeddd75121d39c9a0758016097fa96 Author: Rodrigo Branco Date: Tue Jan 3 14:17:51 2023 -0600 x86/bugs: Flush IBP in ib_prctl_set() We missed the window between the TIF flag update and the next reschedule. Signed-off-by: Rodrigo Branco Reviewed-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Cc: commit 37b3e56d8911f9ec1e1aaa5cccdff33cb0a7a832 Author: Takashi Iwai Date: Mon Jan 2 18:07:59 2023 +0100 ALSA: usb-audio: More refactoring of hw constraint rules Although we applied a workaround for the hw constraints code with the implicit feedback sync, it still has a potential problem. Namely, as the code treats only the first matching (sync) endpoint, it might be too restrictive when multiple endpoints are listed in the substream's format list. This patch is another attempt to improve the hw constraint handling for the implicit feedback sync. The code is rewritten and the sync EP handling for the rate and the format is put inside the fmt_list loop in each hw_rule_*() function instead of the additional rules. The rules for the period size and periods are extended to loop over the fmt_list like others, and they apply the constraints only if needed. Link: https://lore.kernel.org/r/4e509aea-e563-e592-e652-ba44af6733fe@veniogames.com Link: https://lore.kernel.org/r/20230102170759.29610-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit d463ac1acb454fafed58f695cb3067fbf489f3a0 Author: Takashi Iwai Date: Mon Jan 2 18:07:58 2023 +0100 ALSA: usb-audio: Relax hw constraints for implicit fb sync The fix commit the commit e4ea77f8e53f ("ALSA: usb-audio: Always apply the hw constraints for implicit fb sync") tried to address the bug where an incorrect PCM parameter is chosen when two (implicit fb) streams are set up at the same time. This change had, however, some side effect: once when the sync endpoint is chosen and set up, this restriction is applied at the next hw params unless it's freed via hw free explicitly. This patch is a workaround for the problem by relaxing the hw constraints a bit for the implicit fb sync. We still keep applying the hw constraints for implicit fb sync, but only when the matching sync EP is being used by other streams. Fixes: e4ea77f8e53f ("ALSA: usb-audio: Always apply the hw constraints for implicit fb sync") Reported-by: Ruud van Asseldonk Link: https://lore.kernel.org/r/4e509aea-e563-e592-e652-ba44af6733fe@veniogames.com Link: https://lore.kernel.org/r/20230102170759.29610-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0599313e26666e79f6e7fe1450588431b8cb25d5 Author: Takashi Iwai Date: Mon Jan 2 18:07:57 2023 +0100 ALSA: usb-audio: Make sure to stop endpoints before closing EPs At the PCM hw params, we may re-configure the endpoints and it's done by a temporary EP close followed by re-open. A potential problem there is that the EP might be already running internally at the PCM prepare stage; it's seen typically in the playback stream with the implicit feedback sync. As this stream start isn't tracked by the core PCM layer, we'd need to stop it explicitly, and that's the missing piece. This patch adds the stop_endpoints() call at snd_usb_hw_params() to assure the stream stop before closing the EPs. Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") Link: https://lore.kernel.org/r/4e509aea-e563-e592-e652-ba44af6733fe@veniogames.com Link: https://lore.kernel.org/r/20230102170759.29610-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 558016722e9d5bc0ac79c246ccd14a8a4eb028d4 Author: Srivatsa S. Bhat (VMware) Date: Tue Jan 3 14:09:41 2023 -0800 MAINTAINERS: Update maintainers for ptp_vmw driver Vivek has decided to transfer the maintainership of the VMware virtual PTP clock driver (ptp_vmw) to Srivatsa and Deep. Update the MAINTAINERS file to reflect this change, and also add Alexey as a reviewer for the driver. Signed-off-by: Srivatsa S. Bhat (VMware) Acked-by: Vivek Thampi Acked-by: Deep Shah Acked-by: Alexey Makhalov Signed-off-by: David S. Miller commit 53cd37c1368d07649421517ed0aab94a49cca003 Author: Krzysztof Kozlowski Date: Tue Dec 27 15:42:02 2022 +0100 dt-bindings: cpufreq: cpufreq-qcom-hw: document interrupts The Qualcomm Soc cpufreq hardware engine has LMh/thermal throttling interrupts (already present in SM8250 and SM8450 DTS) and Linux driver uses them: sm8250-hdk.dtb: cpufreq@18591000: 'interrupt-names', 'interrupts' do not match any of the regexes: 'pinctrl-[0-9]+' sm8450-qrd.dtb: cpufreq@17d91000: 'interrupt-names', 'interrupts' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Signed-off-by: Viresh Kumar commit faf28e240dd118d9521c68aeb9388b9b8f02d9d0 Author: Konrad Dybcio Date: Tue Jan 3 18:11:29 2023 +0100 cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist The Qualcomm SM6375 platform uses the qcom-cpufreq-hw driver, so add it to the cpufreq-dt-platdev driver's blocklist. Signed-off-by: Konrad Dybcio Signed-off-by: Viresh Kumar commit 775e44d6d86dca400d614cbda5dab4def4951fe7 Author: Paulo Alcantara Date: Thu Dec 29 12:33:56 2022 -0300 cifs: fix race in assemble_neg_contexts() Serialise access of TCP_Server_Info::hostname in assemble_neg_contexts() by holding the server's mutex otherwise it might end up accessing an already-freed hostname pointer from cifs_reconnect() or cifs_resolve_server(). Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 9e6002c8738a9d5675ba706fcdbc0a544f814974 Author: Paulo Alcantara Date: Thu Dec 29 12:33:55 2022 -0300 cifs: ignore ipc reconnect failures during dfs failover If it failed to reconnect ipc used for getting referrals, we can just ignore it as it is not required for reconnecting the share. The worst case would be not being able to detect or chase nested links as long as dfs root server is unreachable. Before patch: $ mount.cifs //root/dfs/link /mnt -o echo_interval=10,... -> target share: /fs0/share disconnect root & fs0 $ ls /mnt ls: cannot access '/mnt': Host is down connect fs0 $ ls /mnt ls: cannot access '/mnt': Resource temporarily unavailable After patch: $ mount.cifs //root/dfs/link /mnt -o echo_interval=10,... -> target share: /fs0/share disconnect root & fs0 $ ls /mnt ls: cannot access '/mnt': Host is down connect fs0 $ ls /mnt bar.rtf dir1 foo Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 67fcb2c598bc7643f694e8194d5c300a52af5aa9 Author: Ira Weiny Date: Thu Dec 29 14:04:46 2022 -0800 cifs: Fix kmap_local_page() unmapping kmap_local_page() requires kunmap_local() to unmap the mapping. In addition memcpy_page() is provided to perform this common memcpy pattern. Replace the kmap_local_page() and broken kunmap() with memcpy_page() Fixes: d406d26745ab ("cifs: skip alloc when request has no pages") Reviewed-by: Paulo Alcantara Reviewed-by: "Fabio M. De Francesco" Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Ira Weiny Signed-off-by: Steve French commit 1cba0d150fa102439114a91b3e215909efc9f169 Author: Kuogee Hsieh Date: Tue Dec 27 18:16:24 2022 -0800 drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer There are 3 possible interrupt sources are handled by DP controller, HPDstatus, Controller state changes and Aux read/write transaction. At every irq, DP controller have to check isr status of every interrupt sources and service the interrupt if its isr status bits shows interrupts are pending. There is potential race condition may happen at current aux isr handler implementation since it is always complete dp_aux_cmd_fifo_tx() even irq is not for aux read or write transaction. This may cause aux read transaction return premature if host aux data read is in the middle of waiting for sink to complete transferring data to host while irq happen. This will cause host's receiving buffer contains unexpected data. This patch fixes this problem by checking aux isr and return immediately at aux isr handler if there are no any isr status bits set. Current there is a bug report regrading eDP edid corruption happen during system booting up. After lengthy debugging to found that VIDEO_READY interrupt was continuously firing during system booting up which cause dp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data from aux hardware buffer which is not yet contains complete data transfer from sink. This cause edid corruption. Follows are the signature at kernel logs when problem happen, EDID has corrupt header panel-simple-dp-aux aux-aea0000.edp: Couldn't identify panel via EDID Changes in v2: -- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr() -- add more commit text Changes in v3: -- add Stephen suggested -- dp_aux_isr() return IRQ_XXX back to caller -- dp_ctrl_isr() return IRQ_XXX back to caller Changes in v4: -- split into two patches Changes in v5: -- delete empty line between tags Changes in v6: -- remove extra "that" and fixed line more than 75 char at commit text Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Signed-off-by: Kuogee Hsieh Tested-by: Douglas Anderson Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/516121/ Link: https://lore.kernel.org/r/1672193785-11003-2-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Abhinav Kumar commit f26cc9593581bd734c846bf827401350b36dc3c9 Author: Pavel Begunkov Date: Wed Jan 4 01:34:57 2023 +0000 io_uring: lockdep annotate CQ locking Locking around CQE posting is complex and depends on options the ring is created with, add more thorough lockdep annotations checking all invariants. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/aa3770b4eacae3915d782cc2ab2f395a99b4b232.1672795976.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 9ffa13ff78a0a55df968a72d6f0ebffccee5c9f4 Author: Pavel Begunkov Date: Wed Jan 4 01:34:02 2023 +0000 io_uring: pin context while queueing deferred tw Unlike normal tw, nothing prevents deferred tw to be executed right after an tw item added to ->work_llist in io_req_local_work_add(). For instance, the waiting task may get waken up by CQ posting or a normal tw. Thus we need to pin the ring for the rest of io_req_local_work_add() Cc: stable@vger.kernel.org Fixes: c0e0d6ba25f18 ("io_uring: add IORING_SETUP_DEFER_TASKRUN") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1a79362b9c10b8523ef70b061d96523650a23344.1672795998.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 937e7a39068d806c1a951f19e38e1326be20f1b0 Author: Andy Shevchenko Date: Thu Dec 29 12:07:46 2022 +0200 pinctrl: nomadik: Add missing header(s) Do not imply that some of the generic headers may be always included. Instead, include explicitly what we are direct user of. While at it, sort headers alphabetically. Fixes: e5530adc17a7 ("pinctrl: Clean up headers") Cc: Randy Dunlap Reported-by: Arnd Bergmann Reported-by: kernel test robot Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20221229100746.35047-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij commit 1d7a4a40bf76e2305c8beed4a019bf58af6121ac Author: Krzysztof Kozlowski Date: Fri Dec 23 14:21:59 2022 +0100 dt-bindings: soundwire: qcom,soundwire: correct sizes related to number of ports There are several properties depending on number of ports. Some of them had maximum limit of 5 and some of 8. SM8450 AudioReach comes with 8 ports, so fix the limits: sm8450-sony-xperia-nagara-pdx224.dtb: soundwire-controller@3250000: qcom,ports-word-length: 'oneOf' conditional failed, one must be fixed: [[255, 255, 255, 255, 255, 255, 255, 255]] is too short [255, 255, 255, 255, 255, 255, 255, 255] is too long Fixes: febc50b82bc9 ("dt-bindings: soundwire: Convert text bindings to DT Schema") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221223132159.81211-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 2a12187d5853d9fd5102278cecef7dac7c8ce7ea Author: Andreas Rammhold Date: Fri Dec 23 12:27:47 2022 +0100 of/fdt: run soc memory setup when early_init_dt_scan_memory fails If memory has been found early_init_dt_scan_memory now returns 1. If it hasn't found any memory it will return 0, allowing other memory setup mechanisms to carry on. Previously early_init_dt_scan_memory always returned 0 without distinguishing between any kind of memory setup being done or not. Any code path after the early_init_dt_scan memory call in the ramips plat_mem_setup code wouldn't be executed anymore. Making early_init_dt_scan_memory the only way to initialize the memory. Some boards, including my mt7621 based Cudy X6 board, depend on memory initialization being done via the soc_info.mem_detect function pointer. Those wouldn't be able to obtain memory and panic the kernel during early bootup with the message "early_init_dt_alloc_memory_arch: Failed to allocate 12416 bytes align=0x40". Fixes: 1f012283e936 ("of/fdt: Rework early_init_dt_scan_memory() to call directly") Cc: stable@vger.kernel.org Signed-off-by: Andreas Rammhold Link: https://lore.kernel.org/r/20221223112748.2935235-1-andreas@rammhold.de Signed-off-by: Rob Herring commit f3c23bea598ab7e8e4b8c5ca66598921310f718e Author: Samson Tam Date: Mon Dec 5 11:08:40 2022 -0500 drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at DPM1 and not DPM0 [Why] SwathSizePerSurfaceY[] and SwathSizePerSurfaceC[] values are uninitialized because we are using += instead of = operator. [How] Assign values in loop with = operator. Acked-by: Aurabindo Pillai Signed-off-by: Samson Tam Reviewed-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x, 6.1.x commit cf97eb7e47d4671084c7e114c5d88a3d0540ecbd Author: Mukul Joshi Date: Tue Dec 20 17:11:24 2022 -0500 drm/amdkfd: Fix kernel warning during topology setup This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs file: [ +0.002865] ------------[ cut here ]------------ [ +0.002327] kobject: '(null)' (0000000056260cfb): is not initialized, yet kobject_put() is being called. [ +0.004780] WARNING: CPU: 32 PID: 1006 at lib/kobject.c:718 kobject_put+0xaa/0x1c0 [ +0.001361] Call Trace: [ +0.001234] [ +0.001067] kfd_remove_sysfs_node_entry+0x24a/0x2d0 [amdgpu] [ +0.003147] kfd_topology_update_sysfs+0x3d/0x750 [amdgpu] [ +0.002890] kfd_topology_add_device+0xbd7/0xc70 [amdgpu] [ +0.002844] ? lock_release+0x13c/0x2e0 [ +0.001936] ? smu_cmn_send_smc_msg_with_param+0x1e8/0x2d0 [amdgpu] [ +0.003313] ? amdgpu_dpm_get_mclk+0x54/0x60 [amdgpu] [ +0.002703] kgd2kfd_device_init.cold+0x39f/0x4ed [amdgpu] [ +0.002930] amdgpu_amdkfd_device_init+0x13d/0x1f0 [amdgpu] [ +0.002944] amdgpu_device_init.cold+0x1464/0x17b4 [amdgpu] [ +0.002970] ? pci_bus_read_config_word+0x43/0x80 [ +0.002380] amdgpu_driver_load_kms+0x15/0x100 [amdgpu] [ +0.002744] amdgpu_pci_probe+0x147/0x370 [amdgpu] [ +0.002522] local_pci_probe+0x40/0x80 [ +0.001896] work_for_cpu_fn+0x10/0x20 [ +0.001892] process_one_work+0x26e/0x5a0 [ +0.002029] worker_thread+0x1fd/0x3e0 [ +0.001890] ? process_one_work+0x5a0/0x5a0 [ +0.002115] kthread+0xea/0x110 [ +0.001618] ? kthread_complete_and_exit+0x20/0x20 [ +0.002422] ret_from_fork+0x1f/0x30 [ +0.001808] [ +0.001103] irq event stamp: 59837 [ +0.001718] hardirqs last enabled at (59849): [] __up_console_sem+0x52/0x60 [ +0.004414] hardirqs last disabled at (59860): [] __up_console_sem+0x37/0x60 [ +0.004414] softirqs last enabled at (59654): [] irq_exit_rcu+0xd7/0x130 [ +0.004205] softirqs last disabled at (59649): [] irq_exit_rcu+0xd7/0x130 [ +0.004203] ---[ end trace 0000000000000000 ]--- Fixes: 0f28cca87e9a ("drm/amdkfd: Extend KFD device topology to surface peer-to-peer links") Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c8de526215fdab9f2dd0d9675582cf9f1391a919 Merge: 88603b6dc4194 03dec92c4f788 Author: Daniel Vetter Date: Tue Jan 3 21:02:28 2023 +0100 Merge tag 'drm-misc-next-fixes-2023-01-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Maxime writes: "The drm-misc-next-fixes leftovers. It addresses a bug in drm/scheduler ending up causing a lockup, and reduces the stack usage of some drm/mm kunit tests." Signed-off-by: Daniel Vetter From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230103144926.bmjjni3xnuis2jmq@houat commit d8d85ce86dc82de4f88b821a78f533b9d5b22a45 Author: Thomas Richter Date: Fri Dec 30 11:26:27 2022 +0100 perf lock contention: Fix core dump related to not finding the "__sched_text_end" symbol on s/390 The test case perf lock contention dumps core on s390. Run the following commands: # ./perf lock record -- ./perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 2.799 [sec] [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.073 MB perf.data (100 samples) ] # # ./perf lock contention Segmentation fault (core dumped) # The function call stack is lengthy, here are the top 5 functions: # gdb ./perf core.24048 GNU gdb (GDB) Fedora Linux 12.1-6.fc37 Core was generated by `./perf lock contention'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00000000011dd25c in machine__is_lock_function (machine=0x3029e28, addr=1789230) at util/machine.c:3356 3356 machine->sched.text_end = kmap->unmap_ip(kmap, sym->start); (gdb) where #0 0x00000000011dd25c in machine__is_lock_function (machine=0x3029e28, addr=1789230) at util/machine.c:3356 #1 0x000000000109f244 in callchain_id (evsel=0x30313e0, sample=0x3ffea4f77d0) at builtin-lock.c:957 #2 0x000000000109e094 in get_key_by_aggr_mode (key=0x3ffea4f7290, addr=27758136, evsel=0x30313e0, sample=0x3ffea4f77d0) at builtin-lock.c:586 #3 0x000000000109f4d0 in report_lock_contention_begin_event (evsel=0x30313e0, sample=0x3ffea4f77d0) at builtin-lock.c:1004 #4 0x00000000010a00ae in evsel__process_contention_begin (evsel=0x30313e0, sample=0x3ffea4f77d0) at builtin-lock.c:1254 #5 0x00000000010a0e14 in process_sample_event (tool=0x3ffea4f8480, event=0x3ff85601ef8, sample=0x3ffea4f77d0, evsel=0x30313e0, machine=0x3029e28) at builtin-lock.c:1464 ..... The issue is in function machine__is_lock_function() in file ./util/machine.c lines 3355: /* should not fail from here */ sym = machine__find_kernel_symbol_by_name(machine, "__sched_text_end", &kmap); machine->sched.text_end = kmap->unmap_ip(kmap, sym->start) On s390 the symbol __sched_text_end is *NOT* in the symbol list and the resulting pointer sym is set to NULL. The sym->start is then a NULL pointer access and generates the core dump. The reason why __sched_text_end is not in the symbol list on s390 is simple: When the symbol list is created at perf start up with function calls dso__load +--> dso__load_vmlinux_path +--> dso__load_vmlinux +--> dso__load_sym +--> dso__load_sym_internal (reads kernel symbols) +--> symbols__fixup_end +--> symbols__fixup_duplicate The issue is in function symbols__fixup_duplicate(). It deletes all symbols with have the same address. On s390: # nm -g ~/linux/vmlinux| fgrep c68390 0000000000c68390 T __cpuidle_text_start 0000000000c68390 T __sched_text_end # two symbols have identical addresses and __sched_text_end is considered duplicate (in ascending sort order) and removed from the symbol list. Therefore it is missing and an invalid pointer reference occurs. The code checks for symbol __sched_text_start and when it exists assumes symbol __sched_text_end is also in the symbol table. However this is not the case on s390. Same situation exists for symbol __lock_text_start: 0000000000c68770 T __cpuidle_text_end 0000000000c68770 T __lock_text_start This symbol is also removed from the symbol table but used in function machine__is_lock_function(). To fix this and keep duplicate symbols in the symbol table, set symbol_conf.allow_aliases to true. This prevents the removal of duplicate symbols in function symbols__fixup_duplicate(). Output After: # ./perf lock contention contended total wait max wait avg wait type caller 48 124.39 ms 123.99 ms 2.59 ms rwsem:W unlink_anon_vmas+0x24a 47 83.68 ms 83.26 ms 1.78 ms rwsem:W free_pgtables+0x132 5 41.22 us 10.55 us 8.24 us rwsem:W free_pgtables+0x140 4 40.12 us 20.55 us 10.03 us rwsem:W copy_process+0x1ac8 # Fixes: 0d2997f750d1de39 ("perf lock: Look up callchain for the contended locks") Signed-off-by: Thomas Richter Acked-by: Namhyung Kim Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20221230102627.2410847-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit f89fb55714b620ff1352141a9f9315611f16573e Author: Ian Rogers Date: Mon Jan 2 23:09:16 2023 -0800 perf build: Don't propagate subdir to submakes for install_headers subdir is added to the OUTPUT which fails as part of building install_headers when passed from "make -C tools perf_install". Committer testing: The original reporter (see the Link: below) had trouble with this: $ make -C tools perf_install That ended up with errors like this: /var/home/acme/git/perf-urgent/tools/scripts/Makefile.include:17: *** output directory "/var/home/acme/git/perf-urgent/tools/perf/libperf/perf/" does not exist. Stop. With this patch applied we now get it installed at: INSTALL /var/home/acme/git/perf-urgent/tools/perf/libperf/include/perf/bpf_perf.h As expected: $ ls -la /var/home/acme/git/perf-urgent/tools/perf/libperf/include/perf/bpf_perf.h -rw-r--r--. 1 acme acme 1146 Jan 3 15:42 /var/home/acme/git/perf-urgent/tools/perf/libperf/include/perf/bpf_perf.h And if we clean tools with: $ make -C tools clean it gets cleaned up: $ ls -la /var/home/acme/git/perf-urgent/tools/perf/libperf/include/perf/bpf_perf.h ls: cannot access '/var/home/acme/git/perf-urgent/tools/perf/libperf/include/perf/bpf_perf.h': No such file or directory $ Fixes: 746bd29e348f99b4 ("perf build: Use tools/lib headers from install path") Reported-by: Torsten Hilbrich Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/fa4b3115-d555-3d7f-54d1-018002e99350@secunet.com Signed-off-by: Arnaldo Carvalho de Melo commit e195605ed28b5581dc2d509283cfea2e8635a251 Author: Li zeming Date: Tue Jan 3 09:54:28 2023 -0800 xfs: xfs_qm: remove unnecessary ‘0’ values from error error is assigned first, so it does not need to initialize the assignment. Signed-off-by: Li zeming Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 4da112513c01d7d0acf1025b8764349d46e177d6 Author: Wu Guanghao Date: Tue Dec 27 09:41:30 2022 -0800 xfs: Fix deadlock on xfs_inodegc_worker We are doing a test about deleting a large number of files when memory is low. A deadlock problem was found. [ 1240.279183] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1240.280450] lock_acquire+0x197/0x460 [ 1240.281548] fs_reclaim_acquire.part.0+0x20/0x30 [ 1240.282625] kmem_cache_alloc+0x2b/0x940 [ 1240.283816] xfs_trans_alloc+0x8a/0x8b0 [ 1240.284757] xfs_inactive_ifree+0xe4/0x4e0 [ 1240.285935] xfs_inactive+0x4e9/0x8a0 [ 1240.286836] xfs_inodegc_worker+0x160/0x5e0 [ 1240.287969] process_one_work+0xa19/0x16b0 [ 1240.289030] worker_thread+0x9e/0x1050 [ 1240.290131] kthread+0x34f/0x460 [ 1240.290999] ret_from_fork+0x22/0x30 [ 1240.291905] [ 1240.291905] -> #0 ((work_completion)(&gc->work)){+.+.}-{0:0}: [ 1240.293569] check_prev_add+0x160/0x2490 [ 1240.294473] __lock_acquire+0x2c4d/0x5160 [ 1240.295544] lock_acquire+0x197/0x460 [ 1240.296403] __flush_work+0x6bc/0xa20 [ 1240.297522] xfs_inode_mark_reclaimable+0x6f0/0xdc0 [ 1240.298649] destroy_inode+0xc6/0x1b0 [ 1240.299677] dispose_list+0xe1/0x1d0 [ 1240.300567] prune_icache_sb+0xec/0x150 [ 1240.301794] super_cache_scan+0x2c9/0x480 [ 1240.302776] do_shrink_slab+0x3f0/0xaa0 [ 1240.303671] shrink_slab+0x170/0x660 [ 1240.304601] shrink_node+0x7f7/0x1df0 [ 1240.305515] balance_pgdat+0x766/0xf50 [ 1240.306657] kswapd+0x5bd/0xd20 [ 1240.307551] kthread+0x34f/0x460 [ 1240.308346] ret_from_fork+0x22/0x30 [ 1240.309247] [ 1240.309247] other info that might help us debug this: [ 1240.309247] [ 1240.310944] Possible unsafe locking scenario: [ 1240.310944] [ 1240.312379] CPU0 CPU1 [ 1240.313363] ---- ---- [ 1240.314433] lock(fs_reclaim); [ 1240.315107] lock((work_completion)(&gc->work)); [ 1240.316828] lock(fs_reclaim); [ 1240.318088] lock((work_completion)(&gc->work)); [ 1240.319203] [ 1240.319203] *** DEADLOCK *** ... [ 2438.431081] Workqueue: xfs-inodegc/sda xfs_inodegc_worker [ 2438.432089] Call Trace: [ 2438.432562] __schedule+0xa94/0x1d20 [ 2438.435787] schedule+0xbf/0x270 [ 2438.436397] schedule_timeout+0x6f8/0x8b0 [ 2438.445126] wait_for_completion+0x163/0x260 [ 2438.448610] __flush_work+0x4c4/0xa40 [ 2438.455011] xfs_inode_mark_reclaimable+0x6ef/0xda0 [ 2438.456695] destroy_inode+0xc6/0x1b0 [ 2438.457375] dispose_list+0xe1/0x1d0 [ 2438.458834] prune_icache_sb+0xe8/0x150 [ 2438.461181] super_cache_scan+0x2b3/0x470 [ 2438.461950] do_shrink_slab+0x3cf/0xa50 [ 2438.462687] shrink_slab+0x17d/0x660 [ 2438.466392] shrink_node+0x87e/0x1d40 [ 2438.467894] do_try_to_free_pages+0x364/0x1300 [ 2438.471188] try_to_free_pages+0x26c/0x5b0 [ 2438.473567] __alloc_pages_slowpath.constprop.136+0x7aa/0x2100 [ 2438.482577] __alloc_pages+0x5db/0x710 [ 2438.485231] alloc_pages+0x100/0x200 [ 2438.485923] allocate_slab+0x2c0/0x380 [ 2438.486623] ___slab_alloc+0x41f/0x690 [ 2438.490254] __slab_alloc+0x54/0x70 [ 2438.491692] kmem_cache_alloc+0x23e/0x270 [ 2438.492437] xfs_trans_alloc+0x88/0x880 [ 2438.493168] xfs_inactive_ifree+0xe2/0x4e0 [ 2438.496419] xfs_inactive+0x4eb/0x8b0 [ 2438.497123] xfs_inodegc_worker+0x16b/0x5e0 [ 2438.497918] process_one_work+0xbf7/0x1a20 [ 2438.500316] worker_thread+0x8c/0x1060 [ 2438.504938] ret_from_fork+0x22/0x30 When the memory is insufficient, xfs_inonodegc_worker will trigger memory reclamation when memory is allocated, then flush_work() may be called to wait for the work to complete. This causes a deadlock. So use memalloc_nofs_save() to avoid triggering memory reclamation in xfs_inodegc_worker. Signed-off-by: Wu Guanghao Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 817644fa4525258992f17fecf4f1d6cdd2e1b731 Author: Hironori Shiina Date: Mon Dec 26 10:11:19 2022 -0800 xfs: get root inode correctly at bulkstat The root inode number should be set to `breq->startino` for getting stat information of the root when XFS_BULK_IREQ_SPECIAL_ROOT is used. Otherwise, the inode search is started from 1 (XFS_BULK_IREQ_SPECIAL_ROOT) and the inode with the lowest number in a filesystem is returned. Fixes: bf3cb3944792 ("xfs: allow single bulkstat of special inodes") Signed-off-by: Hironori Shiina Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit c0f399ff51495ac8d30367418f4f6292ecd61fbe Author: Darrick J. Wong Date: Mon Dec 26 10:11:18 2022 -0800 xfs: fix off-by-one error in xfs_btree_space_to_height Lately I've been stress-testing extreme-sized rmap btrees by using the (new) xfs_db bmap_inflate command to clone bmbt mappings billions of times and then using xfs_repair to build new rmap and refcount btrees. This of course is /much/ faster than actually FICLONEing a file billions of times. Unfortunately, xfs_repair fails in xfs_btree_bload_compute_geometry with EOVERFLOW, which indicates that xfs_mount.m_rmap_maxlevels is not sufficiently large for the test scenario. For a 1TB filesystem (~67 million AG blocks, 4 AGs) the btheight command reports: $ xfs_db -c 'btheight -n 4400801200 -w min rmapbt' /dev/sda rmapbt: worst case per 4096-byte block: 84 records (leaf) / 45 keyptrs (node) level 0: 4400801200 records, 52390491 blocks level 1: 52390491 records, 1164234 blocks level 2: 1164234 records, 25872 blocks level 3: 25872 records, 575 blocks level 4: 575 records, 13 blocks level 5: 13 records, 1 block 6 levels, 53581186 blocks total The AG is sufficiently large to build this rmap btree. Unfortunately, m_rmap_maxlevels is 5. Augmenting the loop in the space->height function to report height, node blocks, and blocks remaining produces this: ht 1 node_blocks 45 blockleft 67108863 ht 2 node_blocks 2025 blockleft 67108818 ht 3 node_blocks 91125 blockleft 67106793 ht 4 node_blocks 4100625 blockleft 67015668 final height: 5 The goal of this function is to compute the maximum height btree that can be stored in the given number of ondisk fsblocks. Starting with the top level of the tree, each iteration through the loop adds the fanout factor of the next level down until we run out of blocks. IOWs, maximum height is achieved by using the smallest fanout factor that can apply to that level. However, the loop setup is not correct. Top level btree blocks are allowed to contain fewer than minrecs items, so the computation is incorrect because the first time through the loop it should be using a fanout factor of 2. With this corrected, the above becomes: ht 1 node_blocks 2 blockleft 67108863 ht 2 node_blocks 90 blockleft 67108861 ht 3 node_blocks 4050 blockleft 67108771 ht 4 node_blocks 182250 blockleft 67104721 ht 5 node_blocks 8201250 blockleft 66922471 final height: 6 Fixes: 9ec691205e7d ("xfs: compute the maximum height of the rmap btree when reflink enabled") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit c07311b5509f6035f1dd828db3e90ff4859cf3b9 Author: Chris Wilson Date: Wed Dec 28 06:34:54 2022 -0500 perf/x86/rapl: Treat Tigerlake like Icelake Since Tigerlake seems to have inherited its cstates and other RAPL power caps from Icelake, assume it also follows Icelake for its RAPL events. Signed-off-by: Chris Wilson Signed-off-by: Rodrigo Vivi Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Zhang Rui Link: https://lore.kernel.org/r/20221228113454.1199118-1-rodrigo.vivi@intel.com commit 72bb8f8cc088730c4d84117a6906f458c2fc64bb Author: Jason A. Donenfeld Date: Sun Jan 1 17:29:04 2023 +0100 x86/insn: Avoid namespace clash by separating instruction decoder MMIO type from MMIO trace type Both and define various MMIO_ enum constants, whose namespace overlaps. Rename the ones to have a INSN_ prefix, so that the headers can be used from the same source file. Signed-off-by: Jason A. Donenfeld Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230101162910.710293-2-Jason@zx2c4.com commit df9d44b645b83fffccfb4e28c1f93376585fdec8 Author: Jaegeuk Kim Date: Wed Dec 21 16:14:10 2022 -0800 f2fs: let's avoid panic if extent_tree is not created This patch avoids the below panic. pc : __lookup_extent_tree+0xd8/0x760 lr : f2fs_do_write_data_page+0x104/0x87c sp : ffffffc010cbb3c0 x29: ffffffc010cbb3e0 x28: 0000000000000000 x27: ffffff8803e7f020 x26: ffffff8803e7ed40 x25: ffffff8803e7f020 x24: ffffffc010cbb460 x23: ffffffc010cbb480 x22: 0000000000000000 x21: 0000000000000000 x20: ffffffff22e90900 x19: 0000000000000000 x18: ffffffc010c5d080 x17: 0000000000000000 x16: 0000000000000020 x15: ffffffdb1acdbb88 x14: ffffff888759e2b0 x13: 0000000000000000 x12: ffffff802da49000 x11: 000000000a001200 x10: ffffff8803e7ed40 x9 : ffffff8023195800 x8 : ffffff802da49078 x7 : 0000000000000001 x6 : 0000000000000000 x5 : 0000000000000006 x4 : ffffffc010cbba28 x3 : 0000000000000000 x2 : ffffffc010cbb480 x1 : 0000000000000000 x0 : ffffff8803e7ed40 Call trace: __lookup_extent_tree+0xd8/0x760 f2fs_do_write_data_page+0x104/0x87c f2fs_write_single_data_page+0x420/0xb60 f2fs_write_cache_pages+0x418/0xb1c __f2fs_write_data_pages+0x428/0x58c f2fs_write_data_pages+0x30/0x40 do_writepages+0x88/0x190 __writeback_single_inode+0x48/0x448 writeback_sb_inodes+0x468/0x9e8 __writeback_inodes_wb+0xb8/0x2a4 wb_writeback+0x33c/0x740 wb_do_writeback+0x2b4/0x400 wb_workfn+0xe4/0x34c process_one_work+0x24c/0x5bc worker_thread+0x3e8/0xa50 kthread+0x150/0x1b4 Signed-off-by: Jaegeuk Kim commit 22a341b43036415718f2d50f5f98b2f891fe17e9 Author: Jaegeuk Kim Date: Fri Dec 16 16:36:36 2022 -0800 f2fs: should use a temp extent_info for lookup Otherwise, __lookup_extent_tree() will override the given extent_info which will be used by caller. Signed-off-by: Jaegeuk Kim commit ed2724765e58e3310d3de48f4a1761631b3dd640 Author: Jaegeuk Kim Date: Fri Dec 16 14:41:54 2022 -0800 f2fs: don't mix to use union values in extent_info Let's explicitly use the defined values in block_age case only. Signed-off-by: Jaegeuk Kim commit fe59109ae5c0b34a8c7c07f693fc501b12b57787 Author: Jaegeuk Kim Date: Fri Dec 16 14:05:44 2022 -0800 f2fs: initialize extent_cache parameter This can avoid confusing tracepoint values. Signed-off-by: Jaegeuk Kim commit b3d83066cbebc76dbac8a5fca931f64b4c6fff34 Author: Chao Yu Date: Fri Dec 30 23:43:32 2022 +0800 f2fs: fix to avoid NULL pointer dereference in f2fs_issue_flush() With below two cases, it will cause NULL pointer dereference when accessing SM_I(sbi)->fcc_info in f2fs_issue_flush(). a) If kthread_run() fails in f2fs_create_flush_cmd_control(), it will release SM_I(sbi)->fcc_info, - mount -o noflush_merge /dev/vda /mnt/f2fs - mount -o remount,flush_merge /dev/vda /mnt/f2fs -- kthread_run() fails - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync b) we will never allocate memory for SM_I(sbi)->fcc_info w/ below testcase, - mount -o ro /dev/vda /mnt/f2fs - mount -o rw,remount /dev/vda /mnt/f2fs - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=1 conv=fsync In order to fix this issue, let change as below: - fix error path handling in f2fs_create_flush_cmd_control(). - allocate SM_I(sbi)->fcc_info even if readonly is on. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 55d235361fccef573990dfa5724ab453866e7816 Author: Mikulas Patocka Date: Tue Jan 3 10:24:11 2023 -0500 x86/asm: Fix an assembler warning with current binutils Fix a warning: "found `movsd'; assuming `movsl' was meant" Signed-off-by: Mikulas Patocka Signed-off-by: Ingo Molnar Cc: linux-kernel@vger.kernel.org commit e325285de2cd82fbdcc4df8898e4c6a597674816 Author: Cristian Marussi Date: Thu Dec 22 18:38:23 2022 +0000 firmware: arm_scmi: Fix virtio channels cleanup on shutdown When unloading the SCMI core stack module, configured to use the virtio SCMI transport, LOCKDEP reports the splat down below about unsafe locks dependencies. In order to avoid this possible unsafe locking scenario call upfront virtio_break_device() before getting hold of vioch->lock. ===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.1.0-00067-g6b934395ba07-dirty #4 Not tainted ----------------------------------------------------- rmmod/307 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff000080c510e0 (&dev->vqs_list_lock){+.+.}-{3:3}, at: virtio_break_device+0x28/0x68 and this task is already holding: ffff00008288ada0 (&channels[i].lock){-.-.}-{3:3}, at: virtio_chan_free+0x60/0x168 [scmi_module] which would create a new lock dependency: (&channels[i].lock){-.-.}-{3:3} -> (&dev->vqs_list_lock){+.+.}-{3:3} but this new dependency connects a HARDIRQ-irq-safe lock: (&channels[i].lock){-.-.}-{3:3} ... which became HARDIRQ-irq-safe at: lock_acquire+0x128/0x398 _raw_spin_lock_irqsave+0x78/0x140 scmi_vio_complete_cb+0xb4/0x3b8 [scmi_module] vring_interrupt+0x84/0x120 vm_interrupt+0x94/0xe8 __handle_irq_event_percpu+0xb4/0x3d8 handle_irq_event_percpu+0x20/0x68 handle_irq_event+0x50/0xb0 handle_fasteoi_irq+0xac/0x138 generic_handle_domain_irq+0x34/0x50 gic_handle_irq+0xa0/0xd8 call_on_irq_stack+0x2c/0x54 do_interrupt_handler+0x8c/0x90 el1_interrupt+0x40/0x78 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x64/0x68 _raw_write_unlock_irq+0x48/0x80 ep_start_scan+0xf0/0x128 do_epoll_wait+0x390/0x858 do_compat_epoll_pwait.part.34+0x1c/0xb8 __arm64_sys_epoll_pwait+0x80/0xd0 invoke_syscall+0x4c/0x110 el0_svc_common.constprop.3+0x98/0x120 do_el0_svc+0x34/0xd0 el0_svc+0x40/0x98 el0t_64_sync_handler+0x98/0xc0 el0t_64_sync+0x170/0x174 to a HARDIRQ-irq-unsafe lock: (&dev->vqs_list_lock){+.+.}-{3:3} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x128/0x398 _raw_spin_lock+0x58/0x70 __vring_new_virtqueue+0x130/0x1c0 vring_create_virtqueue+0xc4/0x2b8 vm_find_vqs+0x20c/0x430 init_vq+0x308/0x390 virtblk_probe+0x114/0x9b0 virtio_dev_probe+0x1a4/0x248 really_probe+0xc8/0x3a8 __driver_probe_device+0x84/0x190 driver_probe_device+0x44/0x110 __driver_attach+0x104/0x1e8 bus_for_each_dev+0x7c/0xd0 driver_attach+0x2c/0x38 bus_add_driver+0x1e4/0x258 driver_register+0x6c/0x128 register_virtio_driver+0x2c/0x48 virtio_blk_init+0x70/0xac do_one_initcall+0x84/0x420 kernel_init_freeable+0x2d0/0x340 kernel_init+0x2c/0x138 ret_from_fork+0x10/0x20 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&dev->vqs_list_lock); local_irq_disable(); lock(&channels[i].lock); lock(&dev->vqs_list_lock); lock(&channels[i].lock); *** DEADLOCK *** ================ Fixes: 42e90eb53bf3f ("firmware: arm_scmi: Add a virtio channel refcount") Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20221222183823.518856-6-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit 9bae076cd4e3e3c3dc185cae829d80b2dddec86e Author: Cristian Marussi Date: Thu Dec 22 18:38:21 2022 +0000 firmware: arm_scmi: Harden shared memory access in fetch_notification A misbheaving SCMI platform firmware could reply with out-of-spec notifications, shorter than the mimimum size comprising a header. Fixes: d5141f37c42e ("firmware: arm_scmi: Add notifications support in transport layer") Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20221222183823.518856-4-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit ad78b81a1077f7d956952cd8bdfe1e61504e3eb8 Author: Cristian Marussi Date: Thu Dec 22 18:38:20 2022 +0000 firmware: arm_scmi: Harden shared memory access in fetch_response A misbheaving SCMI platform firmware could reply with out-of-spec messages, shorter than the mimimum size comprising a header and a status field. Harden shmem_fetch_response to properly truncate such a bad messages. Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20221222183823.518856-3-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit f6ca5059dc0d6608dc46070f48e396d611f240d6 Author: Cristian Marussi Date: Thu Dec 22 18:38:19 2022 +0000 firmware: arm_scmi: Clear stale xfer->hdr.status Stale error status reported from a previous message transaction must be cleared before starting a new transaction to avoid being confusingly reported in the following SCMI message dump traces. Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20221222183823.518856-2-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit e7a293658c20a7945014570e1921bf7d25d68a36 Author: Miaoqian Lin Date: Thu Dec 29 09:48:24 2022 +0400 EDAC/highbank: Fix memory leak in highbank_mc_probe() When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc(). Call edac_mc_free() on the error handling path to avoid a memory leak. [ bp: Massage commit message. ] Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") Signed-off-by: Miaoqian Lin Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Andre Przywara Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com commit f528fe213a6ad21a6e8644dbd5de10dc264a89fd Author: Neil Armstrong Date: Mon Jan 2 12:23:20 2023 +0100 regulator: qcom-rpmh: PM8550 ldo11 regulator is an nldo This fixes the definition of the PM8550 ldo11 regulator matching it's capabilities since this LDO is designed to work between 1,2V and 1,5V. Fixes: e6e3776d682d ("regulator: qcom-rpmh: Add support for PM8550 regulators") Signed-off-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20230102-topic-sm8550-upstream-fixes-reg-l11b-nldo-v1-1-d97def246338@linaro.org Signed-off-by: Mark Brown commit 2ba48b20049b5a76f34a85f853c9496d1b10533a Author: Qu Wenruo Date: Thu Dec 22 07:59:17 2022 +0800 btrfs: fix compat_ro checks against remount [BUG] Even with commit 81d5d61454c3 ("btrfs: enhance unsupported compat RO flags handling"), btrfs can still mount a fs with unsupported compat_ro flags read-only, then remount it RW: # btrfs ins dump-super /dev/loop0 | grep compat_ro_flags -A 3 compat_ro_flags 0x403 ( FREE_SPACE_TREE | FREE_SPACE_TREE_VALID | unknown flag: 0x400 ) # mount /dev/loop0 /mnt/btrfs mount: /mnt/btrfs: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error. dmesg(1) may have more information after failed mount system call. ^^^ RW mount failed as expected ^^^ # dmesg -t | tail -n5 loop0: detected capacity change from 0 to 1048576 BTRFS: device fsid cb5b82f5-0fdd-4d81-9b4b-78533c324afa devid 1 transid 7 /dev/loop0 scanned by mount (1146) BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm BTRFS info (device loop0): using free space tree BTRFS error (device loop0): cannot mount read-write because of unknown compat_ro features (0x403) BTRFS error (device loop0): open_ctree failed # mount /dev/loop0 -o ro /mnt/btrfs # mount -o remount,rw /mnt/btrfs ^^^ RW remount succeeded unexpectedly ^^^ [CAUSE] Currently we use btrfs_check_features() to check compat_ro flags against our current mount flags. That function get reused between open_ctree() and btrfs_remount(). But for btrfs_remount(), the super block we passed in still has the old mount flags, thus btrfs_check_features() still believes we're mounting read-only. [FIX] Replace the existing @sb argument with @is_rw_mount. As originally we only use @sb to determine if the mount is RW. Now it's callers' responsibility to determine if the mount is RW, and since there are only two callers, the check is pretty simple: - caller in open_ctree() Just pass !sb_rdonly(). - caller in btrfs_remount() Pass !(*flags & SB_RDONLY), as our check should be against the new flags. Now we can correctly reject the RW remount: # mount /dev/loop0 -o ro /mnt/btrfs # mount -o remount,rw /mnt/btrfs mount: /mnt/btrfs: mount point not mounted or bad option. dmesg(1) may have more information after failed mount system call. # dmesg -t | tail -n 1 BTRFS error (device loop0: state M): cannot mount read-write because of unknown compat_ro features (0x403) Reported-by: Chung-Chiang Cheng Fixes: 81d5d61454c3 ("btrfs: enhance unsupported compat RO flags handling") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 39f501d68ec1ed5cd5c66ac6ec2a7131c517bb92 Author: Qu Wenruo Date: Mon Dec 26 09:00:40 2022 +0800 btrfs: always report error in run_one_delayed_ref() Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but if end users hit such problem, there will be no chance that btrfs_debug() is enabled. This can lead to very little useful info for debugging. This patch will: - Add extra info for error reporting Including: * logical bytenr * num_bytes * type * action * ref_mod - Replace the btrfs_debug() with btrfs_err() - Move the error reporting into run_one_delayed_ref() This is to avoid use-after-free, the @node can be freed in the caller. This error should only be triggered at most once. As if run_one_delayed_ref() failed, we trigger the error message, then causing the call chain to error out: btrfs_run_delayed_refs() `- btrfs_run_delayed_refs() `- btrfs_run_delayed_refs_for_head() `- run_one_delayed_ref() And we will abort the current transaction in btrfs_run_delayed_refs(). If we have to run delayed refs for the abort transaction, run_one_delayed_ref() will just cleanup the refs and do nothing, thus no new error messages would be output. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit a5751933a7f6abbdad90d98f25a25bb4b133a9e6 Author: Chris Chiu Date: Tue Jan 3 17:53:32 2023 +0800 ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 There is another Dell Latitude laptop (1028:0c03) with Realtek codec ALC3254 which needs the ALC269_FIXUP_DELL4_MIC_NO_PRESENCE instead of the default matched ALC269_FIXUP_DELL1_MIC_NO_PRESENCE. Apply correct fixup for this particular model to enable headset mic. Signed-off-by: Chris Chiu Cc: Link: https://lore.kernel.org/r/20230103095332.730677-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit 1f680609bf1beac20e2a31ddcb1b88874123c39f Author: Yuchi Yang Date: Fri Dec 30 15:22:25 2022 +0800 ALSA: hda/realtek - Turn on power early Turn on power early to avoid wrong state for power relation register. This can earlier update JD state when resume back. Signed-off-by: Yuchi Yang Cc: Link: https://lore.kernel.org/r/e35d8f4fa18f4448a2315cc7d4a3715f@realtek.com Signed-off-by: Takashi Iwai commit d73a27b86fc722c28a26ec64002e3a7dc86d1c07 Author: Qu Wenruo Date: Sun Jan 1 09:02:21 2023 +0800 btrfs: handle case when repair happens with dev-replace [BUG] There is a bug report that a BUG_ON() in btrfs_repair_io_failure() (originally repair_io_failure() in v6.0 kernel) got triggered when replacing a unreliable disk: BTRFS warning (device sda1): csum failed root 257 ino 2397453 off 39624704 csum 0xb0d18c75 expected csum 0x4dae9c5e mirror 3 kernel BUG at fs/btrfs/extent_io.c:2380! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 3614331 Comm: kworker/u257:2 Tainted: G OE 6.0.0-5-amd64 #1 Debian 6.0.10-2 Hardware name: Micro-Star International Co., Ltd. MS-7C60/TRX40 PRO WIFI (MS-7C60), BIOS 2.70 07/01/2021 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] RIP: 0010:repair_io_failure+0x24a/0x260 [btrfs] Call Trace: clean_io_failure+0x14d/0x180 [btrfs] end_bio_extent_readpage+0x412/0x6e0 [btrfs] ? __switch_to+0x106/0x420 process_one_work+0x1c7/0x380 worker_thread+0x4d/0x380 ? rescuer_thread+0x3a0/0x3a0 kthread+0xe9/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 [CAUSE] Before the BUG_ON(), we got some read errors from the replace target first, note the mirror number (3, which is beyond RAID1 duplication, thus it's read from the replace target device). Then at the BUG_ON() location, we are trying to writeback the repaired sectors back the failed device. The check looks like this: ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, logical, &map_length, &bioc, mirror_num); if (ret) goto out_counter_dec; BUG_ON(mirror_num != bioc->mirror_num); But inside btrfs_map_block(), we can modify bioc->mirror_num especially for dev-replace: if (dev_replace_is_ongoing && mirror_num == map->num_stripes + 1 && !need_full_stripe(op) && dev_replace->tgtdev != NULL) { ret = get_extra_mirror_from_replace(fs_info, logical, *length, dev_replace->srcdev->devid, &mirror_num, &physical_to_patch_in_first_stripe); patch_the_first_stripe_for_dev_replace = 1; } Thus if we're repairing the replace target device, we're going to trigger that BUG_ON(). But in reality, the read failure from the replace target device may be that, our replace hasn't reached the range we're reading, thus we're reading garbage, but with replace running, the range would be properly filled later. Thus in that case, we don't need to do anything but let the replace routine to handle it. [FIX] Instead of a BUG_ON(), just skip the repair if we're repairing the device replace target device. Reported-by: 小太 Link: https://lore.kernel.org/linux-btrfs/CACsxjPYyJGQZ+yvjzxA1Nn2LuqkYqTCcUH43S=+wXhyf8S00Ag@mail.gmail.com/ CC: stable@vger.kernel.org # 6.0+ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2f2e84ca60660402bd81d0859703567c59556e6a Author: Filipe Manana Date: Fri Dec 23 18:28:53 2022 +0000 btrfs: fix off-by-one in delalloc search during lseek During lseek, when searching for delalloc in a range that represents a hole and that range has a length of 1 byte, we end up not doing the actual delalloc search in the inode's io tree, resulting in not correctly reporting the offset with data or a hole. This actually only happens when the start offset is 0 because with any other start offset we round it down by sector size. Reproducer: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt/sdc $ xfs_io -f -c "pwrite -q 0 1" /mnt/sdc/foo $ xfs_io -c "seek -d 0" /mnt/sdc/foo Whence Result DATA EOF It should have reported an offset of 0 instead of EOF. Fix this by updating btrfs_find_delalloc_in_range() and count_range_bits() to deal with inclusive ranges properly. These functions are already supposed to work with inclusive end offsets, they just got it wrong in a couple places due to off-by-one mistakes. A test case for fstests will be added later. Reported-by: Joan Bruguera Micó Link: https://lore.kernel.org/linux-btrfs/20221223020509.457113-1-joanbrugueram@gmail.com/ Fixes: b6e833567ea1 ("btrfs: make hole and data seeking a lot more efficient") CC: stable@vger.kernel.org # 6.1 Tested-by: Joan Bruguera Micó Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 1d854e4fbabb0cb12ca4a7fcd784eb67a65de5f8 Author: Qu Wenruo Date: Thu Dec 29 07:32:24 2022 +0800 btrfs: fix false alert on bad tree level check [BUG] There is a bug report that on a RAID0 NVMe btrfs system, under heavy write load the filesystem can flip RO randomly. With extra debugging, it shows some tree blocks failed to pass their level checks, and if that happens at critical path of a transaction, we abort the transaction: BTRFS error (device nvme0n1p3): level verify failed on logical 5446121209856 mirror 1 wanted 0 found 1 BTRFS error (device nvme0n1p3: state A): Transaction aborted (error -5) BTRFS: error (device nvme0n1p3: state A) in btrfs_finish_ordered_io:3343: errno=-5 IO failure BTRFS info (device nvme0n1p3: state EA): forced readonly [CAUSE] The reporter has already bisected to commit 947a629988f1 ("btrfs: move tree block parentness check into validate_extent_buffer()"). And with extra debugging, it shows we can have btrfs_tree_parent_check filled with all zeros in the following call trace: submit_one_bio+0xd4/0xe0 submit_extent_page+0x142/0x550 read_extent_buffer_pages+0x584/0x9c0 ? __pfx_end_bio_extent_readpage+0x10/0x10 ? folio_unlock+0x1d/0x50 btrfs_read_extent_buffer+0x98/0x150 read_tree_block+0x43/0xa0 read_block_for_search+0x266/0x370 btrfs_search_slot+0x351/0xd30 ? lock_is_held_type+0xe8/0x140 btrfs_lookup_csum+0x63/0x150 btrfs_csum_file_blocks+0x197/0x6c0 ? sched_clock_cpu+0x9f/0xc0 ? lock_release+0x14b/0x440 ? _raw_read_unlock+0x29/0x50 btrfs_finish_ordered_io+0x441/0x860 btrfs_work_helper+0xfe/0x400 ? lock_is_held_type+0xe8/0x140 process_one_work+0x294/0x5b0 worker_thread+0x4f/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xf5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 Currently we only copy the btrfs_tree_parent_check structure into bbio at read_extent_buffer_pages() after we have assembled the bbio. But as shown above, submit_extent_page() itself can already submit the bbio, leaving the bbio->parent_check uninitialized, and cause the false alert. [FIX] Instead of copying @check into bbio after bbio is assembled, we pass @check in btrfs_bio_ctrl::parent_check, and copy the content of parent_check in submit_one_bio() for metadata read. By this we should be able to pass the needed info for metadata endio verification, and fix the false alert. Reported-by: Mikhail Gavrilov Link: https://lore.kernel.org/linux-btrfs/CABXGCsNzVxo4iq-tJSGm_kO1UggHXgq6CdcHDL=z5FL4njYXSQ@mail.gmail.com/ Fixes: 947a629988f1 ("btrfs: move tree block parentness check into validate_extent_buffer()") Tested-by: Mikhail Gavrilov Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 77177ed17d24ba060117bdb6efb8a01da7531676 Author: Qu Wenruo Date: Thu Dec 29 07:32:23 2022 +0800 btrfs: add error message for metadata level mismatch From a recent regression report, we found that after commit 947a629988f1 ("btrfs: move tree block parentness check into validate_extent_buffer()") if we have a level mismatch (false alert though), there is no error message at all. This makes later debugging harder. This patch will add the proper error message for such case. Link: https://lore.kernel.org/linux-btrfs/CABXGCsNzVxo4iq-tJSGm_kO1UggHXgq6CdcHDL=z5FL4njYXSQ@mail.gmail.com/ Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 946c2923e76327343e4460e8bb7ec7b4d4589397 Author: Tanmay Bhushan <007047221b@gmail.com> Date: Sat Dec 31 16:05:01 2022 +0100 btrfs: fix ASSERT em->len condition in btrfs_get_extent The em->len value is supposed to be verified in the assertion condition though we expect it to be same as the sectorsize. Fixes: a196a8944f77 ("btrfs: do not reset extent map members for inline extents read") Reviewed-by: Anand Jain Signed-off-by: Tanmay Bhushan <007047221b@gmail.com> Signed-off-by: David Sterba commit b963c1d6261eb7fba1ba14074fb447521be84add Author: Arnaldo Carvalho de Melo Date: Tue Jan 3 10:21:01 2023 -0300 perf test record_probe_libc_inet_pton: Fix failure due to extra inet_pton() backtrace in glibc >= 2.35 Starting with glibc 2.35 there are extra inet_pton() calls when doing a IPv6 ping as in one of the 'perf test' entry, which makes it fail: # perf test inet_pton 89: probe libc's inet_pton & backtrace it with ping : FAILED! # If we look at what this script is expecting (commenting out the removal of the temporary files in it): # cat /tmp/expected.aT6 ping[][0-9 \.:]+probe_libc:inet_pton: \([[:xdigit:]]+\) .*inet_pton\+0x[[:xdigit:]]+[[:space:]]\(/usr/lib64/libc.so.6|inlined\)$ getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\(/usr/lib64/libc.so.6\)$ .*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$ # And looking at what we are getting out of 'perf script', to match with the above: # cat /tmp/perf.script.IUC ping 623883 [006] 265438.471610: probe_libc:inet_pton: (7f32bcf314c0) 1314c0 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) 29510 __libc_start_call_main+0x80 (/usr/lib64/libc.so.6) ping 623883 [006] 265438.471664: probe_libc:inet_pton: (7f32bcf314c0) 1314c0 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) fa6c6 getaddrinfo+0x126 (/usr/lib64/libc.so.6) 491e [unknown] (/usr/bin/ping) # We see that its just the first call to inet_pton() that didn't came thru getaddrinfo(), so if we ignore the first the script matches what it expects, testing that using 'perf probe' + 'perf record' + 'perf script' with callchains on userspace targets is producing the expected results. Since we don't have a 'perf script --skip' to help us here, use tac + grep to do that, resulting in a one liner that makes this script work on both older glibc versions as well as with 2.35. With it, on fedora 36, x86, glibc 2.35: # perf test inet_pton 90: probe libc's inet_pton & backtrace it with ping : Ok # perf test -v inet_pton 90: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 627197 ping 627220 1 267956.962402: probe_libc:inet_pton_1: (7f488bf314c0) 1314c0 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) fa6c6 getaddrinfo+0x126 (/usr/lib64/libc.so.6) 491e n (/usr/bin/ping) test child finished with 0 ---- end ---- probe libc's inet_pton & backtrace it with ping: Ok # And on Ubuntu 22.04.1 LTS on a Libre Computer ROC-RK3399-PC arm64 system: Before this patch it works (see that the script used has no 'tac' to remove the first event): root@roc-rk3399-pc:~# dpkg -l | grep libc-bin ii libc-bin 2.35-0ubuntu3.1 arm64 GNU C Library: Binaries root@roc-rk3399-pc:~# grep -w tac ~acme/libexec/perf-core/tests/shell/record+probe_libc_inet_pton.sh root@roc-rk3399-pc:~# perf test inet_pton 86: probe libc's inet_pton & backtrace it with ping : Ok root@roc-rk3399-pc:~# perf test -v inet_pton 86: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 1375 ping 1399 [000] 4114.417450: probe_libc:inet_pton: (ffffb3e26120) 106120 inet_pton+0x0 (/usr/lib/aarch64-linux-gnu/libc.so.6) d18bc getaddrinfo+0xec (/usr/lib/aarch64-linux-gnu/libc.so.6) 2b68 [unknown] (/usr/bin/ping) test child finished with 0 ---- end ---- probe libc's inet_pton & backtrace it with ping: Ok root@roc-rk3399-pc:~# And after it continues to work: root@roc-rk3399-pc:~# grep -w tac ~acme/libexec/perf-core/tests/shell/record+probe_libc_inet_pton.sh perf script -i $perf_data | tac | grep -m1 ^ping -B9 | tac > $perf_script root@roc-rk3399-pc:~# perf test inet_pton 86: probe libc's inet_pton & backtrace it with ping : Ok root@roc-rk3399-pc:~# perf test -v inet_pton 86: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 6995 ping 7019 [005] 4832.160741: probe_libc:inet_pton: (ffffa62e6120) 106120 inet_pton+0x0 (/usr/lib/aarch64-linux-gnu/libc.so.6) d18bc getaddrinfo+0xec (/usr/lib/aarch64-linux-gnu/libc.so.6) 2b68 [unknown] (/usr/bin/ping) test child finished with 0 ---- end ---- probe libc's inet_pton & backtrace it with ping: Ok root@roc-rk3399-pc:~# Reported-by: Thomas Richter Cc: Adrian Hunter Cc: Heiko Carstens Cc: Ian Rogers Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: http://lore.kernel.org/lkml/Y7QyPkPlDYip3cZH@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 69555549cfa42e10f2fdd2699ed4e34d9d4f392b Author: Dmitry Osipenko Date: Wed Nov 23 03:13:03 2022 +0300 drm/scheduler: Fix lockup in drm_sched_entity_kill() The drm_sched_entity_kill() is invoked twice by drm_sched_entity_destroy() while userspace process is exiting or being killed. First time it's invoked when sched entity is flushed and second time when entity is released. This causes a lockup within wait_for_completion(entity_idle) due to how completion API works. Calling wait_for_completion() more times than complete() was invoked is a error condition that causes lockup because completion internally uses counter for complete/wait calls. The complete_all() must be used instead in such cases. This patch fixes lockup of Panfrost driver that is reproducible by killing any application in a middle of 3d drawing operation. Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Signed-off-by: Dmitry Osipenko Reviewed-by: Christian König Tested-by: Guilherme G. Piccoli # Steam Deck Link: https://patchwork.freedesktop.org/patch/msgid/20221123001303.533968-1-dmitry.osipenko@collabora.com commit 3a2390c6777e3f6662980c6cfc25cafe9e4fef98 Author: Hui Tang Date: Mon Nov 14 08:49:58 2022 +0800 reset: uniphier-glue: Fix possible null-ptr-deref It will cause null-ptr-deref when resource_size(res) invoked, if platform_get_resource() returns NULL. Fixes: 499fef09a323 ("reset: uniphier: add USB3 core reset control") Signed-off-by: Hui Tang Reviewed-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20221114004958.258513-1-tanghui20@huawei.com Signed-off-by: Philipp Zabel commit 13678f3feb3009b23aab424864fd0dac0765c83e Author: Randy Dunlap Date: Sat Oct 29 22:56:36 2022 -0700 reset: ti-sci: honor TI_SCI_PROTOCOL setting when not COMPILE_TEST There is a build error when COMPILE_TEST=y, TI_SCI_PROTOCOL=m, and RESET_TI_SCI=y: drivers/reset/reset-ti-sci.o: in function `ti_sci_reset_probe': reset-ti-sci.c:(.text+0x22c): undefined reference to `devm_ti_sci_get_handle' Fix this by making RESET_TI_SCI honor the Kconfig setting of TI_SCI_PROTOCOL when COMPILE_TEST is not set. When COMPILE_TEST is set, TI_SCI_PROTOCOL must be disabled (=n). Fixes: a6af504184c9 ("reset: ti-sci: Allow building under COMPILE_TEST") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Nishanth Menon Cc: Tero Kristo Cc: Santosh Shilimkar Cc: linux-arm-kernel@lists.infradead.org Cc: Philipp Zabel Reviewed-by: Nishanth Menon Link: https://lore.kernel.org/r/20221030055636.3139-1-rdunlap@infradead.org Signed-off-by: Philipp Zabel commit f3cb80804b8295323919e031281768ba3bf5f8da Author: Randy Dunlap Date: Mon Jan 2 19:28:49 2023 -0800 time: Fix various kernel-doc problems Clean up kernel-doc complaints about function names and non-kernel-doc comments in kernel/time/. Fixes these warnings: kernel/time/time.c:479: warning: expecting prototype for set_normalized_timespec(). Prototype was for set_normalized_timespec64() instead kernel/time/time.c:553: warning: expecting prototype for msecs_to_jiffies(). Prototype was for __msecs_to_jiffies() instead kernel/time/timekeeping.c:1595: warning: contents before sections kernel/time/timekeeping.c:1705: warning: This comment starts with '/**', but isn't a kernel-doc comment. * We have three kinds of time sources to use for sleep time kernel/time/timekeeping.c:1726: warning: This comment starts with '/**', but isn't a kernel-doc comment. * 1) can be determined whether to use or not only when doing kernel/time/tick-oneshot.c:21: warning: missing initial short description on line: * tick_program_event kernel/time/tick-oneshot.c:107: warning: expecting prototype for tick_check_oneshot_mode(). Prototype was for tick_oneshot_mode_active() instead Signed-off-by: Randy Dunlap Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230103032849.12723-1-rdunlap@infradead.org commit b0803ba72b558957fdcfe845939ee788b7ce5919 Author: Marc Zyngier Date: Tue Dec 20 14:49:30 2022 +0000 KVM: arm64: Convert FSC_* over to ESR_ELx_FSC_* The former is an AArch32 legacy, so let's move over to the verbose (and strictly identical) version. This involves moving some of the #defines that were private to KVM into the more generic esr.h. Signed-off-by: Marc Zyngier commit b8f8d190fa8fa1909dda12d771df67125d6fbf0c Author: Marc Zyngier Date: Thu Dec 22 09:26:31 2022 +0000 KVM: arm64: Document the behaviour of S1PTW faults on RO memslots Although the KVM API says that a write to a RO memslot must result in a KVM_EXIT_MMIO describing the write, the arm64 architecture doesn't provide the *data* written by a Stage-1 page table walk (we only get the address). Since there isn't much userspace can do with so little information anyway, document the fact that such an access results in a guest exception, not an exit. This is consistent with the guest being terminally broken anyway. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 406504c7b0405d74d74c15a667cd4c4620c3e7a9 Author: Marc Zyngier Date: Tue Dec 20 14:03:52 2022 +0000 KVM: arm64: Fix S1PTW handling on RO memslots A recent development on the EFI front has resulted in guests having their page tables baked in the firmware binary, and mapped into the IPA space as part of a read-only memslot. Not only is this legitimate, but it also results in added security, so thumbs up. It is possible to take an S1PTW translation fault if the S1 PTs are unmapped at stage-2. However, KVM unconditionally treats S1PTW as a write to correctly handle hardware AF/DB updates to the S1 PTs. Furthermore, KVM injects an exception into the guest for S1PTW writes. In the aforementioned case this results in the guest taking an abort it won't recover from, as the S1 PTs mapping the vectors suffer from the same problem. So clearly our handling is... wrong. Instead, switch to a two-pronged approach: - On S1PTW translation fault, handle the fault as a read - On S1PTW permission fault, handle the fault as a write This is of no consequence to SW that *writes* to its PTs (the write will trigger a non-S1PTW fault), and SW that uses RO PTs will not use HW-assisted AF/DB anyway, as that'd be wrong. Only in the case described in c4ad98e4b72c ("KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch") do we end-up with two back-to-back faults (page being evicted and faulted back). I don't think this is a case worth optimising for. Fixes: c4ad98e4b72c ("KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch") Reviewed-by: Oliver Upton Reviewed-by: Ard Biesheuvel Regression-tested-by: Ard Biesheuvel Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit e006ac3003080177cf0b673441a4241f77aaecce Author: Ding Hui Date: Tue Dec 27 23:09:36 2022 +0800 efi: fix userspace infinite retry read efivars after EFI runtime services page fault After [1][2], if we catch exceptions due to EFI runtime service, we will clear EFI_RUNTIME_SERVICES bit to disable EFI runtime service, then the subsequent routine which invoke the EFI runtime service should fail. But the userspace cat efivars through /sys/firmware/efi/efivars/ will stuck and infinite loop calling read() due to efivarfs_file_read() return -EINTR. The -EINTR is converted from EFI_ABORTED by efi_status_to_err(), and is an improper return value in this situation, so let virt_efi_xxx() return EFI_DEVICE_ERROR and converted to -EIO to invoker. Cc: Fixes: 3425d934fc03 ("efi/x86: Handle page faults occurring while running EFI runtime services") Fixes: 23715a26c8d8 ("arm64: efi: Recover from synchronous exceptions occurring in firmware") Signed-off-by: Ding Hui Signed-off-by: Ard Biesheuvel commit 703c13fe3c9af557d312f5895ed6a5fda2711104 Author: Johan Hovold Date: Mon Dec 19 10:10:04 2022 +0100 efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer. Fixes: 98086df8b70c ("efi: add missed destroy_workqueue when efisubsys_init fails") Cc: stable@vger.kernel.org Cc: Li Heng Signed-off-by: Johan Hovold Signed-off-by: Ard Biesheuvel commit c7dd13805f8b8fc1ce3b6d40f6aff47e66b72ad2 Author: Szymon Heidrich Date: Tue Jan 3 10:17:09 2023 +0100 usb: rndis_host: Secure rndis_query check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently the response pointer will be referring to a location past the expected buffer boundaries allowing information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID. Fixes: ddda08624013 ("USB: rndis_host, various cleanups") Signed-off-by: Szymon Heidrich Signed-off-by: David S. Miller commit 7dc61838541928895abae6d2355258e02a251bba Author: Sean Anderson Date: Tue Jan 3 01:50:38 2023 -0500 net: dpaa: Fix dtsec check for PCS availability We want to fail if the PCS is not available, not if it is available. Fix this condition. Fixes: 5d93cfcf7360 ("net: dpaa: Convert to phylink") Reported-by: Christian Zigotzky Signed-off-by: Sean Anderson Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 4af1b64f80fbe1275fb02c5f1c0cef099a4a231f Author: Geetha sowjanya Date: Tue Jan 3 09:20:12 2023 +0530 octeontx2-pf: Fix lmtst ID used in aura free Current code uses per_cpu pointer to get the lmtst_id mapped to the core on which aura_free() is executed. Using per_cpu pointer without preemption disable causing mismatch between lmtst_id and core on which pointer gets freed. This patch fixes the issue by disabling preemption around aura_free. Fixes: ef6c8da71eaf ("octeontx2-pf: cn10K: Reserve LMTST lines per core") Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Signed-off-by: David S. Miller commit 9c807965483f42df1d053b7436eedd6cf28ece6f Author: Daniil Tatianin Date: Mon Jan 2 12:53:35 2023 +0300 drivers/net/bonding/bond_3ad: return when there's no aggregator Otherwise we would dereference a NULL aggregator pointer when calling __set_agg_ports_ready on the line below. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Daniil Tatianin Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit d57609fad9579f20bbc21f73f7d507937118a79b Merge: 588ab2dc25f60 5e29dc36bd5e2 Author: David S. Miller Date: Tue Jan 3 09:12:22 2023 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Use signed integer in ipv6_skip_exthdr() called from nf_confirm(). Reported by static analysis tooling, patch from Florian Westphal. 2) Missing set type checks in nf_tables: Validate that set declaration matches the an existing set type, otherwise bail out with EEXIST. Currently, nf_tables silently accepts the re-declaration with a different type but it bails out later with EINVAL when the user adds entries to the set. This fix is relatively large because it requires two preparation patches that are included in this batch. 3) Do not ignore updates of timeout and gc_interval parameters in existing sets. 4) Fix a hang when 0/0 subnets is added to a hash:net,port,net type of ipset. Except hash:net,port,net and hash:net,iface, the set types don't support 0/0 and the auxiliary functions rely on this fact. So 0/0 needs a special handling in hash:net,port,net which was missing (hash:net,iface was not affected by this bug), from Jozsef Kadlecsik. 5) When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can result in soft lockup errors. This patch is a complete rework of the previous version in order to use a smaller internal batch limit and at the same time removing the external hard limit to add arbitrary number of elements in one step. Also from Jozsef Kadlecsik. Except for patch #1, which fixes a bug introduced in the previous net-next development cycle, anything else has been broken for several releases. ==================== Signed-off-by: David S. Miller commit 2c55d703391acf7e9101da596d0c15ee03b318a3 Merge: 92d43bd3bc972 88603b6dc4194 Author: Maxime Ripard Date: Tue Jan 3 08:32:12 2023 +0100 Merge drm/drm-fixes into drm-misc-fixes Let's start the fixes cycle. Signed-off-by: Maxime Ripard commit af82425c6a2d2f347c79b63ce74fca6dc6be157f Author: Jens Axboe Date: Mon Jan 2 16:49:46 2023 -0700 io_uring/io-wq: free worker if task_work creation is canceled If we cancel the task_work, the worker will never come into existance. As this is the last reference to it, ensure that we get it freed appropriately. Cc: stable@vger.kernel.org Reported-by: 진호 Signed-off-by: Jens Axboe commit 69b41ac87e4a664de78a395ff97166f0b2943210 Merge: 0226635c304cf fee4c19937439 Author: Linus Torvalds Date: Mon Jan 2 11:06:18 2023 -0800 Merge tag 'for-6.2-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "First batch of regression and regular fixes: - regressions: - fix error handling after conversion to qstr for paths - fix raid56/scrub recovery caused by uninitialized variable after conversion to error bitmaps - restore qgroup backref lookup behaviour after recent refactoring - fix leak of device lists at module exit time - fix resolving backrefs for inline extent followed by prealloc - reset defrag ioctl buffer on memory allocation error" * tag 'for-6.2-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix fscrypt name leak after failure to join log transaction btrfs: scrub: fix uninitialized return value in recover_scrub_rbio btrfs: fix resolving backrefs for inline extent followed by prealloc btrfs: fix trace event name typo for FLUSH_DELAYED_REFS btrfs: restore BTRFS_SEQ_LAST when looking up qgroup backref lookup btrfs: fix leak of fs devices after removing btrfs module btrfs: fix an error handling path in btrfs_defrag_leaves() btrfs: fix an error handling path in btrfs_rename() commit 0226635c304cfd5c9db9b78c259cb713819b057e Author: Tetsuo Handa Date: Mon Jan 2 23:05:33 2023 +0900 fs/ntfs3: don't hold ni_lock when calling truncate_setsize() syzbot is reporting hung task at do_user_addr_fault() [1], for there is a silent deadlock between PG_locked bit and ni_lock lock. Since filemap_update_page() calls filemap_read_folio() after calling folio_trylock() which will set PG_locked bit, ntfs_truncate() must not call truncate_setsize() which will wait for PG_locked bit to be cleared when holding ni_lock lock. Link: https://lore.kernel.org/all/00000000000060d41f05f139aa44@google.com/ Link: https://syzkaller.appspot.com/bug?extid=bed15dbf10294aa4f2ae [1] Reported-by: syzbot Debugged-by: Linus Torvalds Co-developed-by: Hillf Danton Signed-off-by: Hillf Danton Signed-off-by: Tetsuo Handa Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Linus Torvalds commit d00dd2f2645dca04cf399d8fc692f3f69b6dd996 Author: Takashi Iwai Date: Tue Nov 22 12:51:22 2022 +0100 x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"), freeing image->elf_headers in the error path of crash_load_segments() is not needed because kimage_file_post_load_cleanup() will take care of that later. And not clearing it could result in a double-free. Drop the superfluous vfree() call at the error path of crash_load_segments(). Fixes: b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer") Signed-off-by: Takashi Iwai Signed-off-by: Borislav Petkov (AMD) Acked-by: Baoquan He Acked-by: Vlastimil Babka Cc: Link: https://lore.kernel.org/r/20221122115122.13937-1-tiwai@suse.de commit 5b24ac2dfd3eb3e36f794af3aa7f2828b19035bd Author: Max Filippov Date: Thu Dec 22 23:28:21 2022 -0800 kcsan: test: don't put the expect array on the stack Size of the 'expect' array in the __report_matches is 1536 bytes, which is exactly the default frame size warning limit of the xtensa architecture. As a result allmodconfig xtensa kernel builds with the gcc that does not support the compiler plugins (which otherwise would push the said warning limit to 2K) fail with the following message: kernel/kcsan/kcsan_test.c:257:1: error: the frame size of 1680 bytes is larger than 1536 bytes Fix it by dynamically allocating the 'expect' array. Signed-off-by: Max Filippov Reviewed-by: Marco Elver Tested-by: Marco Elver commit 77fe30fed1c0cd282eadb0728999ea3d3350e0b0 Author: Arnaldo Carvalho de Melo Date: Mon Jan 2 13:06:45 2023 -0300 perf tools: Fix segfault when trying to process tracepoints in perf.data and not linked with libtraceevent When we have a perf.data file with tracepoints, such as: # perf evlist -f probe_perf:lzma_decompress_to_file # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events # We end up segfaulting when using perf built with NO_LIBTRACEEVENT=1 by trying to find an evsel with a NULL 'event_name' variable: (gdb) run report --stdio -f Starting program: /root/bin/perf report --stdio -f Program received signal SIGSEGV, Segmentation fault. 0x000000000055219d in find_evsel (evlist=0xfda7b0, event_name=0x0) at util/sort.c:2830 warning: Source file is more recent than executable. 2830 if (event_name[0] == '%') { Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.8-11.fc36.x86_64 cyrus-sasl-lib-2.1.27-18.fc36.x86_64 elfutils-debuginfod-client-0.188-3.fc36.x86_64 elfutils-libelf-0.188-3.fc36.x86_64 elfutils-libs-0.188-3.fc36.x86_64 glibc-2.35-20.fc36.x86_64 keyutils-libs-1.6.1-4.fc36.x86_64 krb5-libs-1.19.2-12.fc36.x86_64 libbrotli-1.0.9-7.fc36.x86_64 libcap-2.48-4.fc36.x86_64 libcom_err-1.46.5-2.fc36.x86_64 libcurl-7.82.0-12.fc36.x86_64 libevent-2.1.12-6.fc36.x86_64 libgcc-12.2.1-4.fc36.x86_64 libidn2-2.3.4-1.fc36.x86_64 libnghttp2-1.51.0-1.fc36.x86_64 libpsl-0.21.1-5.fc36.x86_64 libselinux-3.3-4.fc36.x86_64 libssh-0.9.6-4.fc36.x86_64 libstdc++-12.2.1-4.fc36.x86_64 libunistring-1.0-1.fc36.x86_64 libunwind-1.6.2-2.fc36.x86_64 libxcrypt-4.4.33-4.fc36.x86_64 libzstd-1.5.2-2.fc36.x86_64 numactl-libs-2.0.14-5.fc36.x86_64 opencsd-1.2.0-1.fc36.x86_64 openldap-2.6.3-1.fc36.x86_64 openssl-libs-3.0.5-2.fc36.x86_64 slang-2.3.2-11.fc36.x86_64 xz-libs-5.2.5-9.fc36.x86_64 zlib-1.2.11-33.fc36.x86_64 (gdb) bt #0 0x000000000055219d in find_evsel (evlist=0xfda7b0, event_name=0x0) at util/sort.c:2830 #1 0x0000000000552416 in add_dynamic_entry (evlist=0xfda7b0, tok=0xffb6eb "trace", level=2) at util/sort.c:2976 #2 0x0000000000552d26 in sort_dimension__add (list=0xf93e00 , tok=0xffb6eb "trace", evlist=0xfda7b0, level=2) at util/sort.c:3193 #3 0x0000000000552e1c in setup_sort_list (list=0xf93e00 , str=0xffb6eb "trace", evlist=0xfda7b0) at util/sort.c:3227 #4 0x00000000005532fa in __setup_sorting (evlist=0xfda7b0) at util/sort.c:3381 #5 0x0000000000553cdc in setup_sorting (evlist=0xfda7b0) at util/sort.c:3608 #6 0x000000000042eb9f in cmd_report (argc=0, argv=0x7fffffffe470) at builtin-report.c:1596 #7 0x00000000004aee7e in run_builtin (p=0xf64ca0 , argc=3, argv=0x7fffffffe470) at perf.c:330 #8 0x00000000004af0f2 in handle_internal_command (argc=3, argv=0x7fffffffe470) at perf.c:384 #9 0x00000000004af241 in run_argv (argcp=0x7fffffffe29c, argv=0x7fffffffe290) at perf.c:428 #10 0x00000000004af5fc in main (argc=3, argv=0x7fffffffe470) at perf.c:562 (gdb) So check if we have tracepoint events in add_dynamic_entry() and bail out instead: # perf report --stdio -f This perf binary isn't linked with libtraceevent, can't process probe_perf:lzma_decompress_to_file Error: Unknown --sort key: `trace' # Fixes: 378ef0f5d9d7f465 ("perf build: Use libtraceevent from the system") Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/Y7MDb7kRaHZB6APC@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit cad853374d85fe678d721512cecfabd7636e51f3 Author: Jeff Layton Date: Tue Dec 13 13:08:26 2022 -0500 nfsd: fix handling of readdir in v4root vs. mount upcall timeout If v4 READDIR operation hits a mountpoint and gets back an error, then it will include that entry in the reply and set RDATTR_ERROR for it to the error. That's fine for "normal" exported filesystems, but on the v4root, we need to be more careful to only expose the existence of dentries that lead to exports. If the mountd upcall times out while checking to see whether a mountpoint on the v4root is exported, then we have no recourse other than to fail the whole operation. Cc: Steve Dickson Link: https://bugzilla.kernel.org/show_bug.cgi?id=216777 Reported-by: JianHong Yin Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever Cc: commit f24fb53984cfba42ff72a47466eabfd772da647b Author: Ahelenia Ziemiańska Date: Tue Dec 27 21:58:00 2022 +0100 perf tools: Don't include signature in version strings This explodes the build if HEAD is signed, since the generated version is gpg: Signature made Mon 26 Dec 2022 20:34:48 CET, then a few more lines, then the SHA. Signed-off-by: Ahelenia Ziemiańska Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/7c9637711271f50ec2341fb8a7c29585335dab04.1672174189.git.nabijaczleweli@nabijaczleweli.xyz Signed-off-by: Arnaldo Carvalho de Melo commit 92d43bd3bc9728c1fb114d7011d46f5ea9489e28 Author: Philipp Zabel Date: Tue Nov 8 15:14:20 2022 +0100 drm/imx: ipuv3-plane: Fix overlay plane width ipu_src_rect_width() was introduced to support odd screen resolutions such as 1366x768 by internally rounding up primary plane width to a multiple of 8 and compensating with reduced horizontal blanking. This also caused overlay plane width to be rounded up, which was not intended. Fix overlay plane width by limiting the rounding up to the primary plane. drm_rect_width(&new_state->src) >> 16 is the same value as drm_rect_width(dst) because there is no plane scaling support. Fixes: 94dfec48fca7 ("drm/imx: Add 8 pixel alignment fix") Reviewed-by: Lucas Stach Link: https://lore.kernel.org/r/20221108141420.176696-1-p.zabel@pengutronix.de Signed-off-by: Philipp Zabel Link: https://patchwork.freedesktop.org/patch/msgid/20221108141420.176696-1-p.zabel@pengutronix.de Tested-by: Ian Ray (cherry picked from commit 4333472f8d7befe62359fecb1083cd57a6e07bfc) Signed-off-by: Philipp Zabel commit 8509419758f2cc28dd05370385af0d91573b76b4 Author: Samuel Holland Date: Tue Aug 9 21:25:09 2022 -0500 mmc: sunxi-mmc: Fix clock refcount imbalance during unbind If the controller is suspended by runtime PM, the clock is already disabled, so do not try to disable it again during removal. Use pm_runtime_disable() to flush any pending runtime PM transitions. Fixes: 9a8e1e8cc2c0 ("mmc: sunxi: Add runtime_pm support") Signed-off-by: Samuel Holland Acked-by: Jernej Skrabec Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220810022509.43743-1-samuel@sholland.org Signed-off-by: Ulf Hansson commit 55c41f2e4f7e81e48f3ecc9fba1e316e770213f2 Author: Yang Jihong Date: Mon Dec 26 08:57:03 2022 +0000 perf help: Use HAVE_LIBTRACEEVENT to filter out unsupported commands Commands such as kmem, kwork, lock, sched, trace and timechart depend on libtraceevent, these commands need to be isolated using HAVE_LIBTRACEEVENT macro when cmdlist generation. The output of the generate-cmdlist.sh script is as follows: # ./util/generate-cmdlist.sh /* Automatically generated by ./util/generate-cmdlist.sh */ struct cmdname_help { char name[16]; char help[80]; }; static struct cmdname_help common_cmds[] = { {"annotate", "Read perf.data (created by perf record) and display annotated code"}, {"archive", "Create archive with object files with build-ids found in perf.data file"}, {"bench", "General framework for benchmark suites"}, {"buildid-cache", "Manage build-id cache."}, {"buildid-list", "List the buildids in a perf.data file"}, {"c2c", "Shared Data C2C/HITM Analyzer."}, {"config", "Get and set variables in a configuration file."}, {"daemon", "Run record sessions on background"}, {"data", "Data file related processing"}, {"diff", "Read perf.data files and display the differential profile"}, {"evlist", "List the event names in a perf.data file"}, {"ftrace", "simple wrapper for kernel's ftrace functionality"}, {"inject", "Filter to augment the events stream with additional information"}, {"iostat", "Show I/O performance metrics"}, {"kallsyms", "Searches running kernel for symbols"}, {"kvm", "Tool to trace/measure kvm guest os"}, {"list", "List all symbolic event types"}, {"mem", "Profile memory accesses"}, {"record", "Run a command and record its profile into perf.data"}, {"report", "Read perf.data (created by perf record) and display the profile"}, {"script", "Read perf.data (created by perf record) and display trace output"}, {"stat", "Run a command and gather performance counter statistics"}, {"test", "Runs sanity tests."}, {"top", "System profiling tool."}, {"version", "display the version of perf binary"}, #ifdef HAVE_LIBELF_SUPPORT {"probe", "Define new dynamic tracepoints"}, #endif /* HAVE_LIBELF_SUPPORT */ #if defined(HAVE_LIBTRACEEVENT) && (defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE_SUPPORT)) {"trace", "strace inspired tool"}, #endif /* HAVE_LIBTRACEEVENT && (HAVE_LIBAUDIT_SUPPORT || HAVE_SYSCALL_TABLE_SUPPORT) */ #ifdef HAVE_LIBTRACEEVENT {"kmem", "Tool to trace/measure kernel memory properties"}, {"kwork", "Tool to trace/measure kernel work properties (latencies)"}, {"lock", "Analyze lock events"}, {"sched", "Tool to trace/measure scheduler properties (latencies)"}, {"timechart", "Tool to visualize total system behavior during a workload"}, #endif /* HAVE_LIBTRACEEVENT */ }; Fixes: 378ef0f5d9d7f465 ("perf build: Use libtraceevent from the system") Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221226085703.95081-1-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit a8f54d940196c8bd9aced9c82557fdc63baefb02 Author: Eric Lin Date: Sat Dec 31 05:27:31 2022 +0000 perf tools riscv: Fix build error on riscv due to missing header for 'struct perf_sample' Since the definition of 'struct perf_sample' has been moved to sample.h, we need to include this header file to fix the build error as follows: arch/riscv/util/unwind-libdw.c: In function 'libdw__arch_set_initial_registers': arch/riscv/util/unwind-libdw.c:12:50: error: invalid use of undefined type 'struct perf_sample' 12 | struct regs_dump *user_regs = &ui->sample->user_regs; | ^~ Fixes: 9823147da6c893d9 ("perf tools: Move 'struct perf_sample' to a separate header file to disentangle headers") Signed-off-by: Eric Lin Cc: Alexander Shishkin Cc: greentime.hu@sifive.com Cc: Jiri Olsa Cc: linux-riscv@lists.infradead.org Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Vincent Chen Link: https://lore.kernel.org/r/20221231052731.24908-1-eric.lin@sifive.com Signed-off-by: Arnaldo Carvalho de Melo commit f685dd7a8025f2554f73748cfdb8143a21fb92c7 Author: Paul Menzel Date: Mon Jan 2 14:57:30 2023 +0100 fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB Commit 62d89a7d49af ("video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen") accidently decreases the maximum memory size for the Matrox G200eW (102b:0532) from 8 MB to 1 MB by missing one zero. This caused the driver initialization to fail with the messages below, as the minimum required VRAM size is 2 MB: [ 9.436420] matroxfb: Matrox MGA-G200eW (PCI) detected [ 9.444502] matroxfb: cannot determine memory size [ 9.449316] matroxfb: probe of 0000:0a:03.0 failed with error -1 So, add the missing 0 to make it the intended 16 MB. Successfully tested on the Dell PowerEdge R910/0KYD3D, BIOS 2.10.0 08/29/2013, that the warning is gone. While at it, add a leading 0 to the maxdisplayable entry, so it’s aligned properly. The value could probably also be increased from 8 MB to 16 MB, as the G200 uses the same values, but I have not checked any datasheet. Note, matroxfb is obsolete and superseded by the maintained DRM driver mga200, which is used by default on most systems where both drivers are available. Therefore, on most systems it was only a cosmetic issue. Fixes: 62d89a7d49af ("video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen") Link: https://lore.kernel.org/linux-fbdev/972999d3-b75d-5680-fcef-6e6905c52ac5@suse.de/T/#mb6953a9995ebd18acc8552f99d6db39787aec775 Cc: it+linux-fbdev@molgen.mpg.de Cc: Z. Liu Cc: Rich Felker Cc: stable@vger.kernel.org Signed-off-by: Paul Menzel Signed-off-by: Helge Deller commit 0a6564ebd953c4590663c9a3c99a3ea9920ade6f Author: Miaoqian Lin Date: Thu Dec 29 13:09:00 2022 +0400 perf tools: Fix resources leak in perf_data__open_dir() In perf_data__open_dir(), opendir() opens the directory stream. Add missing closedir() to release it after use. Fixes: eb6176709b235b96 ("perf data: Add perf_data__open_dir_data function") Reviewed-by: Adrian Hunter Signed-off-by: Miaoqian Lin Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221229090903.1402395-1-linmq006@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 03dec92c4f788c54a7c01b40a018f601eb8a6c52 Author: Dmitry Osipenko Date: Wed Nov 23 03:13:03 2022 +0300 drm/scheduler: Fix lockup in drm_sched_entity_kill() The drm_sched_entity_kill() is invoked twice by drm_sched_entity_destroy() while userspace process is exiting or being killed. First time it's invoked when sched entity is flushed and second time when entity is released. This causes a lockup within wait_for_completion(entity_idle) due to how completion API works. Calling wait_for_completion() more times than complete() was invoked is a error condition that causes lockup because completion internally uses counter for complete/wait calls. The complete_all() must be used instead in such cases. This patch fixes lockup of Panfrost driver that is reproducible by killing any application in a middle of 3d drawing operation. Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Signed-off-by: Dmitry Osipenko Reviewed-by: Christian König Tested-by: Guilherme G. Piccoli # Steam Deck Link: https://patchwork.freedesktop.org/patch/msgid/20221123001303.533968-1-dmitry.osipenko@collabora.com commit a764da46cd15f8b40292d2c0b29c4bf9a3e66c7e Author: Xiu Jianfeng Date: Wed Nov 9 17:19:05 2022 +0800 drm/virtio: Fix memory leak in virtio_gpu_object_create() The virtio_gpu_object_shmem_init() will alloc memory and save it in @ents, so when virtio_gpu_array_alloc() fails, this memory should be freed, this patch fixes it. Fixes: e7fef0923303 ("drm/virtio: Simplify error handling of virtio_gpu_object_create()") Signed-off-by: Xiu Jianfeng Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20221109091905.55451-1-xiujianfeng@huawei.com commit 5e29dc36bd5e2166b834ceb19990d9e68a734d7d Author: Jozsef Kadlecsik Date: Fri Dec 30 13:24:38 2022 +0100 netfilter: ipset: Rework long task execution when adding/deleting entries When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can result in soft lockup errors. The patch 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete") tried to fix it by limiting the max elements to process at all. However it was not enough, it is still possible that we get hung tasks. Lowering the limit is not reasonable, so the approach in this patch is as follows: rely on the method used at resizing sets and save the state when we reach a smaller internal batch limit, unlock/lock and proceed from the saved state. Thus we can avoid long continuous tasks and at the same time removed the limit to add/delete large number of elements in one step. The nfnl mutex is held during the whole operation which prevents one to issue other ipset commands in parallel. Fixes: 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete") Reported-by: syzbot+9204e7399656300bf271@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit a31d47be64b9b74f8cfedffe03e0a8a1f9e51f23 Author: Jozsef Kadlecsik Date: Fri Dec 30 13:24:37 2022 +0100 netfilter: ipset: fix hash:net,port,net hang with /0 subnet The hash:net,port,net set type supports /0 subnets. However, the patch commit 5f7b51bf09baca8e titled "netfilter: ipset: Limit the maximal range of consecutive elements to add/delete" did not take into account it and resulted in an endless loop. The bug is actually older but the patch 5f7b51bf09baca8e brings it out earlier. Handle /0 subnets properly in hash:net,port,net set types. Fixes: 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete") Reported-by: Марк Коренберг Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 588ab2dc25f60efeb516b4abedb6c551949cc185 Author: Horatiu Vultur Date: Mon Jan 2 13:12:15 2023 +0100 net: sparx5: Fix reading of the MAC address There is an issue with the checking of the return value of 'of_get_mac_address', which returns 0 on success and negative value on failure. The driver interpretated the result the opposite way. Therefore if there was a MAC address defined in the DT, then the driver was generating a random MAC address otherwise it would use address 0. Fix this by checking correctly the return value of 'of_get_mac_address' Fixes: b74ef9f9cb91 ("net: sparx5: Do not use mac_addr uninitialized in mchp_sparx5_probe()") Signed-off-by: Horatiu Vultur Signed-off-by: David S. Miller commit 06bf62944144a92d83dd14fd1378d2a288259561 Author: Ido Schimmel Date: Mon Jan 2 08:55:56 2023 +0200 vxlan: Fix memory leaks in error path The memory allocated by vxlan_vnigroup_init() is not freed in the error path, leading to memory leaks [1]. Fix by calling vxlan_vnigroup_uninit() in the error path. The leaks can be reproduced by annotating gro_cells_init() with ALLOW_ERROR_INJECTION() and then running: # echo "100" > /sys/kernel/debug/fail_function/probability # echo "1" > /sys/kernel/debug/fail_function/times # echo "gro_cells_init" > /sys/kernel/debug/fail_function/inject # printf %#x -12 > /sys/kernel/debug/fail_function/gro_cells_init/retval # ip link add name vxlan0 type vxlan dstport 4789 external vnifilter RTNETLINK answers: Cannot allocate memory [1] unreferenced object 0xffff88810db84a00 (size 512): comm "ip", pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): f8 d5 76 0e 81 88 ff ff 01 00 00 00 00 00 00 02 ..v............. 03 00 04 00 48 00 00 00 00 00 00 01 04 00 01 00 ....H........... backtrace: [] kmalloc_trace+0x2a/0x60 [] vxlan_vnigroup_init+0x4c/0x160 [] vxlan_init+0x1ae/0x280 [] register_netdevice+0x57a/0x16d0 [] __vxlan_dev_create+0x7c7/0xa50 [] vxlan_newlink+0xd6/0x130 [] __rtnl_newlink+0x112b/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43f/0xd40 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x958/0xe70 [] ____sys_sendmsg+0x78f/0xa90 [] ___sys_sendmsg+0x13a/0x1e0 [] __sys_sendmsg+0x11c/0x1f0 [] do_syscall_64+0x38/0x80 unreferenced object 0xffff88810e76d5f8 (size 192): comm "ip", pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): 04 00 00 00 00 00 00 00 db e1 4f e7 00 00 00 00 ..........O..... 08 d6 76 0e 81 88 ff ff 08 d6 76 0e 81 88 ff ff ..v.......v..... backtrace: [] __kmalloc_node+0x4e/0x90 [] kvmalloc_node+0xa6/0x1f0 [] bucket_table_alloc.isra.0+0x83/0x460 [] rhashtable_init+0x43b/0x7c0 [] vxlan_vnigroup_init+0x6c/0x160 [] vxlan_init+0x1ae/0x280 [] register_netdevice+0x57a/0x16d0 [] __vxlan_dev_create+0x7c7/0xa50 [] vxlan_newlink+0xd6/0x130 [] __rtnl_newlink+0x112b/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43f/0xd40 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x958/0xe70 [] ____sys_sendmsg+0x78f/0xa90 Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Signed-off-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 43d253781f6321c6a07a5fe4ee72103a679a5f6b Author: Randy Dunlap Date: Sun Jan 1 23:17:37 2023 -0800 net: sched: htb: fix htb_classify() kernel-doc Fix W=1 kernel-doc warning: net/sched/sch_htb.c:214: warning: expecting prototype for htb_classify(). Prototype was for HTB_DIRECT() instead by moving the HTB_DIRECT() macro above the function. Add kernel-doc notation for function parameters as well. Signed-off-by: Randy Dunlap Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Signed-off-by: David S. Miller commit 819fcf4adfbd55e81c4325e11eccae16ccad4106 Merge: 91e2286160edd caa4b35b4317d Author: David S. Miller Date: Mon Jan 2 13:32:43 2023 +0000 Merge branch 'cls_drop-fix' Jamal Hadi Salim says: ==================== net: dont intepret cls results when asked to drop It is possible that an error in processing may occur in tcf_classify() which will result in res.classid being some garbage value. Example of such a code path is when the classifier goes into a loop due to bad policy. See patch 1/2 for a sample splat. While the core code reacts correctly and asks the caller to drop the packet (by returning TC_ACT_SHOT) some callers first intepret the res.class as a pointer to memory and end up dropping the packet only after some activity with the pointer. There is likelihood of this resulting in an exploit. So lets fix all the known qdiscs that behave this way. ==================== Signed-off-by: David S. Miller commit caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12 Author: Jamal Hadi Salim Date: Sun Jan 1 16:57:44 2023 -0500 net: sched: cbq: dont intepret cls results when asked to drop If asked to drop a packet via TC_ACT_SHOT it is unsafe to assume that res.class contains a valid pointer Sample splat reported by Kyle Zeng [ 5.405624] 0: reclassify loop, rule prio 0, protocol 800 [ 5.406326] ================================================================== [ 5.407240] BUG: KASAN: slab-out-of-bounds in cbq_enqueue+0x54b/0xea0 [ 5.407987] Read of size 1 at addr ffff88800e3122aa by task poc/299 [ 5.408731] [ 5.408897] CPU: 0 PID: 299 Comm: poc Not tainted 5.10.155+ #15 [ 5.409516] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 5.410439] Call Trace: [ 5.410764] dump_stack+0x87/0xcd [ 5.411153] print_address_description+0x7a/0x6b0 [ 5.411687] ? vprintk_func+0xb9/0xc0 [ 5.411905] ? printk+0x76/0x96 [ 5.412110] ? cbq_enqueue+0x54b/0xea0 [ 5.412323] kasan_report+0x17d/0x220 [ 5.412591] ? cbq_enqueue+0x54b/0xea0 [ 5.412803] __asan_report_load1_noabort+0x10/0x20 [ 5.413119] cbq_enqueue+0x54b/0xea0 [ 5.413400] ? __kasan_check_write+0x10/0x20 [ 5.413679] __dev_queue_xmit+0x9c0/0x1db0 [ 5.413922] dev_queue_xmit+0xc/0x10 [ 5.414136] ip_finish_output2+0x8bc/0xcd0 [ 5.414436] __ip_finish_output+0x472/0x7a0 [ 5.414692] ip_finish_output+0x5c/0x190 [ 5.414940] ip_output+0x2d8/0x3c0 [ 5.415150] ? ip_mc_finish_output+0x320/0x320 [ 5.415429] __ip_queue_xmit+0x753/0x1760 [ 5.415664] ip_queue_xmit+0x47/0x60 [ 5.415874] __tcp_transmit_skb+0x1ef9/0x34c0 [ 5.416129] tcp_connect+0x1f5e/0x4cb0 [ 5.416347] tcp_v4_connect+0xc8d/0x18c0 [ 5.416577] __inet_stream_connect+0x1ae/0xb40 [ 5.416836] ? local_bh_enable+0x11/0x20 [ 5.417066] ? lock_sock_nested+0x175/0x1d0 [ 5.417309] inet_stream_connect+0x5d/0x90 [ 5.417548] ? __inet_stream_connect+0xb40/0xb40 [ 5.417817] __sys_connect+0x260/0x2b0 [ 5.418037] __x64_sys_connect+0x76/0x80 [ 5.418267] do_syscall_64+0x31/0x50 [ 5.418477] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 5.418770] RIP: 0033:0x473bb7 [ 5.418952] Code: 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 18 89 54 24 0c 48 89 34 24 89 [ 5.420046] RSP: 002b:00007fffd20eb0f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 5.420472] RAX: ffffffffffffffda RBX: 00007fffd20eb578 RCX: 0000000000473bb7 [ 5.420872] RDX: 0000000000000010 RSI: 00007fffd20eb110 RDI: 0000000000000007 [ 5.421271] RBP: 00007fffd20eb150 R08: 0000000000000001 R09: 0000000000000004 [ 5.421671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 5.422071] R13: 00007fffd20eb568 R14: 00000000004fc740 R15: 0000000000000002 [ 5.422471] [ 5.422562] Allocated by task 299: [ 5.422782] __kasan_kmalloc+0x12d/0x160 [ 5.423007] kasan_kmalloc+0x5/0x10 [ 5.423208] kmem_cache_alloc_trace+0x201/0x2e0 [ 5.423492] tcf_proto_create+0x65/0x290 [ 5.423721] tc_new_tfilter+0x137e/0x1830 [ 5.423957] rtnetlink_rcv_msg+0x730/0x9f0 [ 5.424197] netlink_rcv_skb+0x166/0x300 [ 5.424428] rtnetlink_rcv+0x11/0x20 [ 5.424639] netlink_unicast+0x673/0x860 [ 5.424870] netlink_sendmsg+0x6af/0x9f0 [ 5.425100] __sys_sendto+0x58d/0x5a0 [ 5.425315] __x64_sys_sendto+0xda/0xf0 [ 5.425539] do_syscall_64+0x31/0x50 [ 5.425764] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 5.426065] [ 5.426157] The buggy address belongs to the object at ffff88800e312200 [ 5.426157] which belongs to the cache kmalloc-128 of size 128 [ 5.426955] The buggy address is located 42 bytes to the right of [ 5.426955] 128-byte region [ffff88800e312200, ffff88800e312280) [ 5.427688] The buggy address belongs to the page: [ 5.427992] page:000000009875fabc refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe312 [ 5.428562] flags: 0x100000000000200(slab) [ 5.428812] raw: 0100000000000200 dead000000000100 dead000000000122 ffff888007843680 [ 5.429325] raw: 0000000000000000 0000000000100010 00000001ffffffff ffff88800e312401 [ 5.429875] page dumped because: kasan: bad access detected [ 5.430214] page->mem_cgroup:ffff88800e312401 [ 5.430471] [ 5.430564] Memory state around the buggy address: [ 5.430846] ffff88800e312180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 5.431267] ffff88800e312200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 5.431705] >ffff88800e312280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 5.432123] ^ [ 5.432391] ffff88800e312300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 5.432810] ffff88800e312380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 5.433229] ================================================================== [ 5.433648] Disabling lock debugging due to kernel taint Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Kyle Zeng Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit a2965c7be0522eaa18808684b7b82b248515511b Author: Jamal Hadi Salim Date: Sun Jan 1 16:57:43 2023 -0500 net: sched: atm: dont intepret cls results when asked to drop If asked to drop a packet via TC_ACT_SHOT it is unsafe to assume res.class contains a valid pointer Fixes: b0188d4dbe5f ("[NET_SCHED]: sch_atm: Lindent") Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 490748874ebf1875420fc29b335bba2075dd1b5e Author: Miaoqian Lin Date: Sat Dec 31 13:58:48 2022 +0400 soc: imx8m: Fix incorrect check for of_clk_get_by_name() of_clk_get_by_name() returns error pointers instead of NULL. Use IS_ERR() checks the return value to catch errors. Fixes: 836fb30949d9 ("soc: imx8m: Enable OCOTP clock before reading the register") Signed-off-by: Miaoqian Lin Signed-off-by: Shawn Guo commit ae066f374687d7dd06bb8c732f66d6ab3c3fd480 Author: Tim Harvey Date: Wed Dec 28 12:26:06 2022 -0800 arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity The GW7901 has USB2 routed to a USB VBUS supply with over-current protection via an active-low pin. Define the OC pin polarity properly. Fixes: 2b1649a83afc ("arm64: dts: imx: Add i.mx8mm Gateworks gw7901 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 Author: Jiasheng Jiang Date: Tue Nov 22 21:48:23 2022 +0800 HID: intel_ish-hid: Add check for ishtp_dma_tx_map As the kcalloc may return NULL pointer, it should be better to check the ishtp_dma_tx_map before use in order to avoid NULL pointer dereference. Fixes: 3703f53b99e4 ("HID: intel_ish-hid: ISH Transport layer") Signed-off-by: Jiasheng Jiang Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 1e336aa0c0250ec84c6f16efac40c9f0138e367d Author: Haibo Chen Date: Wed Dec 7 19:23:15 2022 +0800 mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting Current code logic may be impacted by the setting of ROM/Bootloader, so unmask these bits first, then setting these bits accordingly. Fixes: 2b16cf326b70 ("mmc: sdhci-esdhc-imx: move tuning static configuration into hwinit function") Signed-off-by: Haibo Chen Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221207112315.1812222-1-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 694175cd8a1643cde3acb45c9294bca44a8e08e9 Author: Miaoqian Lin Date: Mon Jan 2 12:20:39 2023 +0400 gpio: sifive: Fix refcount leak in sifive_gpio_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 96868dce644d ("gpio/sifive: Add GPIO driver for SiFive SoCs") Signed-off-by: Miaoqian Lin Signed-off-by: Bartosz Golaszewski commit 8e1858710d9a71d88acd922f2e95d1eddb90eea0 Author: Xiubo Li Date: Thu Nov 17 10:57:53 2022 +0800 ceph: avoid use-after-free in ceph_fl_release_lock() When ceph releasing the file_lock it will try to get the inode pointer from the fl->fl_file, which the memory could already be released by another thread in filp_close(). Because in VFS layer the fl->fl_file doesn't increase the file's reference counter. Will switch to use ceph dedicate lock info to track the inode. And in ceph_fl_release_lock() we should skip all the operations if the fl->fl_u.ceph.inode is not set, which should come from the request file_lock. And we will set fl->fl_u.ceph.inode when inserting it to the inode lock list, which is when copying the lock. Link: https://tracker.ceph.com/issues/57986 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 461ab10ef7e6ea9b41a0571a7fc6a72af9549a3c Author: Xiubo Li Date: Thu Nov 17 10:43:21 2022 +0800 ceph: switch to vfs_inode_has_locks() to fix file lock bug For the POSIX locks they are using the same owner, which is the thread id. And multiple POSIX locks could be merged into single one, so when checking whether the 'file' has locks may fail. For a file where some openers use locking and others don't is a really odd usage pattern though. Locks are like stoplights -- they only work if everyone pays attention to them. Just switch ceph_get_caps() to check whether any locks are set on the inode. If there are POSIX/OFD/FLOCK locks on the file at the time, we should set CHECK_FILELOCK, regardless of what fd was used to set the lock. Fixes: ff5d913dfc71 ("ceph: return -EIO if read/write against filp that lost file locks") Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d19ab1f785d0b6b9f709799f0938658903821ba1 Author: Arnd Bergmann Date: Tue Dec 20 15:13:34 2022 +0100 mtd: cfi: allow building spi-intel standalone When MTD or MTD_CFI_GEOMETRY is disabled, the spi-intel driver fails to build, as it includes the shared CFI header: include/linux/mtd/cfi.h:62:2: error: #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work. [-Werror=cpp] 62 | #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work. linux/mtd/spi-nor.h does not actually need to include cfi.h, so remove the inclusion here to fix the warning. This uncovers a missing #include in spi-nor/core.c so add that there to prevent a different build issue. Fixes: e23e5a05d1fd ("mtd: spi-nor: intel-spi: Convert to SPI MEM") Signed-off-by: Arnd Bergmann Reviewed-by: Mika Westerberg Reviewed-by: Tokunori Ikegami Acked-by: Pratyush Yadav Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20221220141352.1486360-1-arnd@kernel.org commit 105c14b84d93168431abba5d55e6c26fa4b65abb Author: Mikhail Zhilkin Date: Thu Dec 8 23:28:29 2022 +0300 mtd: parsers: scpart: fix __udivdi3 undefined on mips This fixes the following compile error on mips architecture with clang version 16.0.0 reported by the 0-DAY CI Kernel Test Service: ld.lld: error: undefined symbol: __udivdi3 referenced by scpart.c mtd/parsers/scpart.o:(scpart_parse) in archive drivers/built-in.a As a workaround this makes 'offs' a 32-bit type. This is enough, because the mtd containing partition table practically does not exceed 1 MB. We can revert this when the [Link] has been resolved. Link: https://github.com/ClangBuiltLinux/linux/issues/1635 Fixes: 9b78ef0c7997 ("mtd: parsers: add support for Sercomm partitions") Reported-by: kernel test robot Suggested-by: Arnd Bergmann Signed-off-by: Mikhail Zhilkin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/805fe58e-690f-6a3f-5ebf-2f6f6e6e4599@gmail.com commit 7adde5ac25fa50dbb1fb237042316685cafe976c Author: Yuan Can Date: Thu Dec 8 11:36:20 2022 +0000 mtd: parsers: Fix potential memory leak in mtd_parser_tplink_safeloader_parse() The parts needs to be freed with all its elements, otherwise it will be leaked. Fixes: 00a3588084be ("mtd: parsers: add TP-Link SafeLoader partitions table parser") Signed-off-by: Yuan Can Reviewed-by: Dan Carpenter Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20221208113620.78855-1-yuancan@huawei.com commit 3b754ed6d1cd90017e66e5cc16f3923e4a952ffc Author: Carlo Caione Date: Mon Dec 19 09:43:05 2022 +0100 drm/meson: Reduce the FIFO lines held when AFBC is not used Having a bigger number of FIFO lines held after vsync is only useful to SoCs using AFBC to give time to the AFBC decoder to be reset, configured and enabled again. For SoCs not using AFBC this, on the contrary, is causing on some displays issues and a few pixels vertical offset in the displayed image. Conditionally increase the number of lines held after vsync only for SoCs using AFBC, leaving the default value for all the others. Fixes: 24e0d4058eff ("drm/meson: hold 32 lines after vsync to give time for AFBC start") Signed-off-by: Carlo Caione Acked-by: Martin Blumenstingl Acked-by: Neil Armstrong [narmstrong: added fixes tag] Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20221216-afbc_s905x-v1-0-033bebf780d9@baylibre.com commit cc2e9d2b26c86c1dd8687f6916e5f621bcacd6f7 Author: David Rientjes Date: Tue Dec 27 22:05:48 2022 -0800 mm, slab: periodically resched in drain_freelist() drain_freelist() can be called with a very large number of slabs to free, such as for kmem_cache_shrink(), or depending on various settings of the slab cache when doing periodic reaping. If there is a potentially long list of slabs to drain, periodically schedule to ensure we aren't saturating the cpu for too long. Signed-off-by: David Rientjes Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Vlastimil Babka commit 83dcedd5540d4ac61376ddff5362f7d9f866a6ec Author: Namjae Jeon Date: Sat Dec 31 17:32:31 2022 +0900 ksmbd: fix infinite loop in ksmbd_conn_handler_loop() If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round again, It will cause infinite loop issue. And all threads from next connections would be doing that. This patch add max retry count(2) to avoid it. kernel_recvmsg() will wait during 7sec timeout and try to retry two time if -EAGAIN is returned. And add flags of kvmalloc to __GFP_NOWARN and __GFP_NORETRY to disconnect immediately without retrying on memory alloation failure. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259 Reviewed-by: Sergey Senozhatsky Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 797805d81baa814f76cf7bdab35f86408a79d707 Author: William Liu Date: Fri Dec 30 13:03:15 2022 +0900 ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob "nt_len - CIFS_ENCPWD_SIZE" is passed directly from ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative number (or large unsigned value) used for a subsequent memcpy in ksmbd_auth_ntlvm2 and can cause a panic. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: William Liu Signed-off-by: Hrvoje Mišetić Acked-by: Namjae Jeon Signed-off-by: Steve French commit cdfb2fef522d0c3f9cf293db51de88e9b3d46846 Author: Marios Makassikis Date: Fri Dec 23 11:59:31 2022 +0100 ksmbd: send proper error response in smb2_tree_connect() Currently, smb2_tree_connect doesn't send an error response packet on error. This causes libsmb2 to skip the specific error code and fail with the following: smb2_service failed with : Failed to parse fixed part of command payload. Unexpected size of Error reply. Expected 9, got 8 Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5e9a7b9c2ea18551759833146a181b14835bfe39 Author: Trond Myklebust Date: Sun Jan 1 20:17:23 2023 -0500 NFS: Fix up a sparse warning sparse is warning about an incorrect RCU dereference. fs/nfs/dir.c:2965:56: warning: incorrect type in argument 1 (different address spaces) fs/nfs/dir.c:2965:56: expected struct cred const * fs/nfs/dir.c:2965:56: got struct cred const [noderef] __rcu *const cred Signed-off-by: Trond Myklebust commit 029085b8949f5d269ae2bbd14915407dd0c7f902 Author: Chengen Du Date: Fri Dec 30 11:04:32 2022 +0800 NFS: Judge the file access cache's timestamp in rcu path If the user's login time is newer than the cache's timestamp, we expect the cache may be stale and need to clear. The stale cache will remain in the list's tail if no other users operate on that inode. Once the user accesses the inode, the stale cache will be returned in rcu path. Signed-off-by: Chengen Du Signed-off-by: Trond Myklebust commit 000bca8d706d1bf7cca01af75787247c5a2fdedf Author: Brian Norris Date: Fri Dec 30 22:15:45 2022 -0800 ASoC: qcom: lpass-cpu: Fix fallback SD line index handling These indices should reference the ID placed within the dai_driver array, not the indices of the array itself. This fixes commit 4ff028f6c108 ("ASoC: qcom: lpass-cpu: Make I2S SD lines configurable"), which among others, broke IPQ8064 audio (sound/soc/qcom/lpass-ipq806x.c) because it uses ID 4 but we'd stop initializing the mi2s_playback_sd_mode and mi2s_capture_sd_mode arrays at ID 0. Fixes: 4ff028f6c108 ("ASoC: qcom: lpass-cpu: Make I2S SD lines configurable") Cc: Signed-off-by: Brian Norris Reviewed-by: Stephan Gerhold Link: https://lore.kernel.org/r/20221231061545.2110253-1-computersforpeace@gmail.com Signed-off-by: Mark Brown commit 88603b6dc419445847923fcb7fe5080067a30f98 Author: Linus Torvalds Date: Sun Jan 1 13:53:16 2023 -0800 Linux 6.2-rc2 commit 150aae354b817f540848476bace2b2ba9931b197 Merge: 5b129817aedb0 0a041ebca4956 Author: Linus Torvalds Date: Sun Jan 1 11:27:00 2023 -0800 Merge tag 'perf_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Pass only an initialized perf event attribute to the LSM hook - Fix a use-after-free on the perf syscall's error path - A potential integer overflow fix in amd_core_pmu_init() - Fix the cgroup events tracking after the context handling rewrite - Return the proper value from the inherit_event() function on error * tag 'perf_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Call LSM hook after copying perf_event_attr perf: Fix use-after-free in error path perf/x86/amd: fix potential integer overflow on shift of a int perf/core: Fix cgroup events tracking perf core: Return error pointer if inherit_event() fails to find pmu_ctx commit 5b129817aedb03d94fb960e7a34d0f5eaa20a2f2 Merge: 95d248d16f9cb 63dc6325ff41e Author: Linus Torvalds Date: Sun Jan 1 11:19:50 2023 -0800 Merge tag 'x86_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Two fixes to correct how kprobes handles INT3 now that they're added by other functionality like the rethunks and not only kgdb - Remove __init section markings of two functions which are referenced by a function in the .text section * tag 'x86_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK x86/calldepth: Fix incorrect init section references commit 95d248d16f9cb42de717367832cffa0f83e97fde Merge: 8b41948296b76 94cd8fa09f5f1 Author: Linus Torvalds Date: Sun Jan 1 11:15:05 2023 -0800 Merge tag 'locking_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Borislav Petkov: - Prevent the leaking of a debug timer in futex_waitv() - A preempt-RT mutex locking fix, adding the proper acquire semantics * tag 'locking_urgent_for_v6.2_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix futex_waitv() hrtimer debug object leak on kcalloc error rtmutex: Add acquire semantics for rtmutex lock acquisition slow path commit 8b41948296b76588f5ebaf7cbc5be5c803ece70a Merge: e4cf7c25bae5c a9f5a752e86f1 Author: Linus Torvalds Date: Sun Jan 1 11:11:13 2023 -0800 Merge tag 'drm-fixes-2023-01-01' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "I'm just back from the mountains, and Dave is out at the beach and should be back in a week again. Just i915 fixes and since Rodrigo bothered to make the pull last week I figured I should warm up gpg and forward this in a nice signed tag as a new years present! - i915 fixes for newer platforms - i915 locking rework to not give up in vm eviction fallback path too early" * tag 'drm-fixes-2023-01-01' of git://anongit.freedesktop.org/drm/drm: drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence drm/i915/uc: Fix two issues with over-size firmware files drm/i915: improve the catch-all evict to handle lock contention drm/i915: Remove __maybe_unused from mtl_info drm/i915: fix TLB invalidation for Gen12.50 video and compute engines commit 91e2286160edd29d3fea8efff2dcda7df321878d Author: Michał Grzelak Date: Thu Dec 29 15:22:19 2022 +0100 dt-bindings: net: marvell,orion-mdio: Fix examples As stated in marvell-orion-mdio.txt deleted in commit 0781434af811f ("dt-bindings: net: orion-mdio: Convert to JSON schema") if 'interrupts' property is present, width of 'reg' should be 0x84. Otherwise, width of 'reg' should be 0x4. Fix 'examples:' and add constraints checking whether 'interrupts' property is present and validate it against fixed values in reg. Signed-off-by: Michał Grzelak Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit a3542b0ccd58f9fd42f34afa9daea435279a7c1c Author: Samuel Holland Date: Sat Dec 31 16:05:46 2022 -0600 dt-bindings: net: sun8i-emac: Add phy-supply property This property has always been supported by the Linux driver; see commit 9f93ac8d4085 ("net-next: stmmac: Add dwmac-sun8i"). In fact, the original driver submission includes the phy-supply code but no mention of it in the binding, so the omission appears to be accidental. In addition, the property is documented in the binding for the previous hardware generation, allwinner,sun7i-a20-gmac. Document phy-supply in the binding to fix devicetree validation for the 25+ boards that already use this property. Fixes: 0441bde003be ("dt-bindings: net-next: Add DT bindings documentation for Allwinner dwmac-sun8i") Acked-by: Rob Herring Reviewed-by: Andre Przywara Signed-off-by: Samuel Holland Signed-off-by: David S. Miller commit d9d71a89f28d27ac772c429b37d52668d011df7a Author: Alex Elder Date: Fri Dec 30 16:33:04 2022 -0600 net: ipa: use proper endpoint mask for suspend It is now possible for a system to have more than 32 endpoints. As a result, registers related to endpoint suspend are parameterized, with 32 endpoints represented in one more registers. In ipa_interrupt_suspend_control(), the IPA_SUSPEND_EN register offset is determined properly, but the bit mask used still assumes the number of enpoints won't exceed 32. This is a bug. Fix it. Fixes: f298ba785e2d ("net: ipa: add a parameter to suspend registers") Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 1c429c10192c930fd358b0c9a777c222a352d945 Merge: 6d4cfcf97986c 1856628baa170 Author: David S. Miller Date: Sun Jan 1 11:59:53 2023 +0000 Merge branch 'selftests-fix' Po-Hsu Lin says: ==================== selftests: net: fix for arp_ndisc_evict_nocarrier test This patchset will fix a false-positive issue caused by the command in cleanup_v6() of the arp_ndisc_evict_nocarrier test. Also, it will make the test to return a non-zero value for any failure reported in the test for us to avoid false-negative results. ==================== Signed-off-by: David S. Miller commit 1856628baa17032531916984808d1bdfd62700d4 Author: Po-Hsu Lin Date: Fri Dec 30 17:18:29 2022 +0800 selftests: net: return non-zero for failures reported in arp_ndisc_evict_nocarrier Return non-zero return value if there is any failure reported in this script during the test. Otherwise it can only reflect the status of the last command. Fixes: f86ca07eb531 ("selftests: net: add arp_ndisc_evict_nocarrier") Signed-off-by: Po-Hsu Lin Signed-off-by: David S. Miller commit 9c4d7f45d60745a1cea0e841fa5e3444c398d2f1 Author: Po-Hsu Lin Date: Fri Dec 30 17:18:28 2022 +0800 selftests: net: fix cleanup_v6() for arp_ndisc_evict_nocarrier The cleanup_v6() will cause the arp_ndisc_evict_nocarrier script exit with 255 (No such file or directory), even the tests are good: # selftests: net: arp_ndisc_evict_nocarrier.sh # run arp_evict_nocarrier=1 test # RTNETLINK answers: File exists # ok # run arp_evict_nocarrier=0 test # RTNETLINK answers: File exists # ok # run all.arp_evict_nocarrier=0 test # RTNETLINK answers: File exists # ok # run ndisc_evict_nocarrier=1 test # ok # run ndisc_evict_nocarrier=0 test # ok # run all.ndisc_evict_nocarrier=0 test # ok not ok 1 selftests: net: arp_ndisc_evict_nocarrier.sh # exit=255 This is because it's trying to modify the parameter for ipv4 instead. Also, tests for ipv6 (run_ndisc_evict_nocarrier_enabled() and run_ndisc_evict_nocarrier_disabled() are working on veth1, reflect this fact in cleanup_v6(). Fixes: f86ca07eb531 ("selftests: net: add arp_ndisc_evict_nocarrier") Signed-off-by: Po-Hsu Lin Signed-off-by: David S. Miller commit 6d4cfcf97986cc67635630a2bc1f8d5c92ecdbba Author: Sean Anderson Date: Thu Dec 29 15:21:20 2022 -0500 net: phy: Update documentation for get_rate_matching Now that phylink no longer calls phy_get_rate_matching with PHY_INTERFACE_MODE_NA, phys no longer need to support it. Remove the documentation mandating support. Fixes: 7642cc28fd37 ("net: phylink: fix PHY validation with rate adaption") Signed-off-by: Sean Anderson Signed-off-by: David S. Miller commit a9f5a752e86f1897c3b377b6b861576a4c1a2ff0 Merge: 1b929c02afd37 6217e9f05a74d Author: Daniel Vetter Date: Sun Jan 1 11:52:11 2023 +0100 Merge tag 'drm-intel-fixes-2022-12-30' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - fix TLB invalidation for DG2 and newer platforms. (Andrzej) - Remove __maybe_unused from mtl_info (Lucas) - improve the catch-all evict to handle lock contention (Matt Auld) - Fix two issues with over-size (GuC/HuC) firmware files (John) - Fix DSI resume issues on ICL+ (Jani) Signed-off-by: Daniel Vetter From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y662ijDHrZCjTFla@intel.com commit d02b8256183f3e6ebde5f685effabfbcd1d33cf6 Merge: d039535850ee4 a4165830ca237 Author: David S. Miller Date: Sun Jan 1 09:27:12 2023 +0000 Merge branch 'dsa-qca8k-fixes' Christian Marangi says: ==================== net: dsa: qca8k: multiple fix on mdio read/write Due to some problems in reading the Documentation and elaborating it some wrong assumption were done. The error was reported and notice only now due to how things are setup in the code flow. First 2 patch fix mgmt eth where the lenght calculation is very confusing and in step of word size. (the related commit description have an extensive description about how this mess works) Last 3 patch revert the broken mdio cache and apply a correct version that should still save some extra mdio in phy poll secnario. These 5 patch fix each related problem and apply what the Documentation actually say. Changes v2: - Add cover letter - Fix typo in revert patch ==================== Signed-off-by: David S. Miller commit a4165830ca237f2b3318faf62562bce8ce12a389 Author: Christian Marangi Date: Thu Dec 29 17:33:36 2022 +0100 net: dsa: qca8k: improve mdio master read/write by using single lo/hi Improve mdio master read/write by using singe mii read/write lo/hi. In a read and write we need to poll the mdio master regs in a busy loop to check for a specific bit present in the upper half of the reg. We can ignore the other half since it won't contain useful data. This will save an additional useless read for each read and write operation. In a read operation the returned data is present in the mdio master reg lower half. We can ignore the other half since it won't contain useful data. This will save an additional useless read for each read operation. In a read operation it's needed to just set the hi half of the mdio master reg as the lo half will be replaced by the result. This will save an additional useless write for each read operation. Tested-by: Ronald Wahl Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit cfbd6de588ef659c198083205dc954a6d3ed2aec Author: Christian Marangi Date: Thu Dec 29 17:33:35 2022 +0100 net: dsa: qca8k: introduce single mii read/write lo/hi It may be useful to read/write just the lo or hi half of a reg. This is especially useful for phy poll with the use of mdio master. The mdio master reg is composed by the first 16 bit related to setup and the other half with the returned data or data to write. Refactor the mii function to permit single mii read/write of lo or hi half of the reg. Tested-by: Ronald Wahl Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit 03cb9e6d0b32b768e3d9d473c5c4ca1100877664 Author: Christian Marangi Date: Thu Dec 29 17:33:34 2022 +0100 Revert "net: dsa: qca8k: cache lo and hi for mdio write" This reverts commit 2481d206fae7884cd07014fd1318e63af35e99eb. The Documentation is very confusing about the topic. The cache logic for hi and lo is wrong and actually miss some regs to be actually written. What the Documentation actually intended was that it's possible to skip writing hi OR lo if half of the reg is not needed to be written or read. Revert the change in favor of a better and correct implementation. Reported-by: Ronald Wahl Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: David S. Miller commit d9dba91be71f03cc75bcf39fc0d5d99ff33f1ae0 Author: Christian Marangi Date: Thu Dec 29 17:33:33 2022 +0100 net: dsa: tag_qca: fix wrong MGMT_DATA2 size It was discovered that MGMT_DATA2 can contain up to 28 bytes of data instead of the 12 bytes written in the Documentation by accounting the limit of 16 bytes declared in Documentation subtracting the first 4 byte in the packet header. Update the define with the real world value. Tested-by: Ronald Wahl Fixes: c2ee8181fddb ("net: dsa: tag_qca: add define for handling mgmt Ethernet packet") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: David S. Miller commit 9807ae69746196ee4bbffe7d22d22ab2b61c6ed0 Author: Christian Marangi Date: Thu Dec 29 17:33:32 2022 +0100 net: dsa: qca8k: fix wrong length value for mgmt eth packet The assumption that Documentation was right about how this value work was wrong. It was discovered that the length value of the mgmt header is in step of word size. As an example to process 4 byte of data the correct length to set is 2. To process 8 byte 4, 12 byte 6, 16 byte 8... Odd values will always return the next size on the ack packet. (length of 3 (6 byte) will always return 8 bytes of data) This means that a value of 15 (0xf) actually means reading/writing 32 bytes of data instead of 16 bytes. This behaviour is totally absent and not documented in the switch Documentation. In fact from Documentation the max value that mgmt eth can process is 16 byte of data while in reality it can process 32 bytes at once. To handle this we always round up the length after deviding it for word size. We check if the result is odd and we round another time to align to what the switch will provide in the ack packet. The workaround for the length limit of 15 is still needed as the length reg max value is 0xf(15) Reported-by: Ronald Wahl Tested-by: Ronald Wahl Fixes: 90386223f44e ("net: dsa: qca8k: add support for larger read/write size with mgmt Ethernet") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: David S. Miller commit 8de8482fe5732fbef4f5af82bc0c0362c804cd1f Author: Maor Gottlieb Date: Wed Dec 28 14:56:10 2022 +0200 RDMA/mlx5: Fix validation of max_rd_atomic caps for DC Currently, when modifying DC, we validate max_rd_atomic user attribute against the RC cap, validate against DC. RC and DC QP types have different device limitations. This can cause userspace created DC QPs to malfunction. Fixes: c32a4f296e1d ("IB/mlx5: Add support for DC Initiator QP") Link: https://lore.kernel.org/r/0c5aee72cea188c3bb770f4207cce7abc9b6fc74.1672231736.git.leonro@nvidia.com Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky commit 38b50aa44495d5eb4218f0b82fc2da76505cec53 Author: Shay Drory Date: Wed Dec 28 14:56:09 2022 +0200 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct counters, but, port_num is being passed down the stack without any change. Also, some functions assume that port_num >=1. As a result, the following oops can occur. BUG: unable to handle page fault for address: ffff89510294f1a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP CPU: 8 PID: 1382 Comm: devlink Tainted: G W 6.1.0-rc4_for_upstream_base_2022_11_10_16_12 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:_raw_spin_lock+0xc/0x20 Call Trace: mlx5_ib_get_native_port_mdev+0x73/0xe0 [mlx5_ib] do_get_hw_stats.constprop.0+0x109/0x160 [mlx5_ib] mlx5_ib_get_hw_stats+0xad/0x180 [mlx5_ib] ib_setup_device_attrs+0xf0/0x290 [ib_core] ib_register_device+0x3bb/0x510 [ib_core] ? atomic_notifier_chain_register+0x67/0x80 __mlx5_ib_add+0x2b/0x80 [mlx5_ib] mlx5r_probe+0xb8/0x150 [mlx5_ib] ? auxiliary_match_id+0x6a/0x90 auxiliary_bus_probe+0x3c/0x70 ? driver_sysfs_add+0x6b/0x90 really_probe+0xcd/0x380 __driver_probe_device+0x80/0x170 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 ? driver_allows_async_probing+0x60/0x60 ? driver_allows_async_probing+0x60/0x60 bus_for_each_drv+0x7b/0xc0 __device_attach+0xbc/0x200 bus_probe_device+0x87/0xa0 device_add+0x404/0x940 ? dev_set_name+0x53/0x70 __auxiliary_device_add+0x43/0x60 add_adev+0x99/0xe0 [mlx5_core] mlx5_attach_device+0xc8/0x120 [mlx5_core] mlx5_load_one_devl_locked+0xb2/0xe0 [mlx5_core] devlink_reload+0x133/0x250 devlink_nl_cmd_reload+0x480/0x570 ? devlink_nl_pre_doit+0x44/0x2b0 genl_family_rcv_msg_doit.isra.0+0xc2/0x110 genl_rcv_msg+0x180/0x2b0 ? devlink_nl_cmd_region_read_dumpit+0x540/0x540 ? devlink_reload+0x250/0x250 ? devlink_put+0x50/0x50 ? genl_family_rcv_msg_doit.isra.0+0x110/0x110 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1f6/0x2c0 netlink_sendmsg+0x237/0x490 sock_sendmsg+0x33/0x40 __sys_sendto+0x103/0x160 ? handle_mm_fault+0x10e/0x290 ? do_user_addr_fault+0x1c0/0x5f0 __x64_sys_sendto+0x25/0x30 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fix it by setting port_num to 1 in order to get device status and remove unused variable. Fixes: aac4492ef23a ("IB/mlx5: Update counter implementation for dual port RoCE") Link: https://lore.kernel.org/r/98b82994c3cd3fa593b8a75ed3f3901e208beb0f.1672231736.git.leonro@nvidia.com Signed-off-by: Shay Drory Reviewed-by: Patrisious Haddad Signed-off-by: Leon Romanovsky commit 9a65c759e4666476a6642ad87b4db8a67cb957d0 Author: Marco Felsch Date: Sun Jan 1 12:50:42 2023 +0800 arm64: dts: imx8mp-evk: pcie0-refclk cosmetic cleanup Use the correct indention. Fixes: d50650500064 ("arm64: dts: imx8mp-evk: Add PCIe support") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit 10e2f328bd900787fd2db24e474f87e1d525ccc4 Author: Adam Ford Date: Sat Dec 17 12:08:49 2022 -0600 arm64: dts: imx8mp: Fix power-domain typo dt_binding_check detects an issue with the pgc_hsiomix power domain: pgc: 'power-domains@17' does not match any of the regexes This is because 'power-domains' should be 'power-domain' Fixes: 2ae42e0c0b67 ("arm64: dts: imx8mp: add HSIO power-domains") Signed-off-by: Adam Ford Reviewed-by: Laurent Pinchart Signed-off-by: Shawn Guo commit b3b75ace2085aca623c57e04ea7218ae690090fb Author: Adam Ford Date: Sat Dec 17 12:08:48 2022 -0600 arm64: dts: imx8mp: Fix missing GPC Interrupt The GPC node references an interrupt parent, but it doesn't state the interrupt itself. According to the TRM, this IRQ is 87. This also eliminate an error detected from dt_binding_check Fixes: fc0f05124621 ("arm64: dts: imx8mp: add GPC node with GPU power domains") Signed-off-by: Adam Ford Reviewed-by: Laurent Pinchart Signed-off-by: Shawn Guo commit 21b84ebeee79d91e405f87f051e9489ef30ecad6 Author: Lucas Stach Date: Fri Aug 26 21:13:03 2022 +0200 soc: imx: imx8mp-blk-ctrl: don't set power device name Setting the device name after it has been registered confuses the sysfs cleanup paths. This has already been fixed for the imx8m-blk-ctrl driver in b64b46fbaa1d ("Revert "soc: imx: imx8m-blk-ctrl: set power device name""), but the same problem exists in imx8mp-blk-ctrl. Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Signed-off-by: Lucas Stach Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit c10a5855488bbd9912ddae3ad2d1f2e4b1a3c275 Author: Marek Vasut Date: Fri Dec 16 01:05:26 2022 +0100 arm64: dts: imx8mm: Drop xtal clock specifier from eDM SBC The clk_xtal32k have clock-cells = <0>, drop the bogus specifier. Fixes: 9509593f327a ("arm64: dts: imx8mm: Model PMIC to SNVS RTC clock path on Data Modul i.MX8M Mini eDM SBC") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit e4cf7c25bae5c3b5089a3c23a897f450149caef2 Merge: e39d9b9f89f2e 6a5e25fc3e0b9 Author: Linus Torvalds Date: Sat Dec 31 10:21:47 2022 -0800 Merge tag 'kbuild-fixes-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix broken BuildID - Add srcrpm-pkg to the help message - Fix the option order for modpost built with musl libc - Fix the build dependency of rpm-pkg for openSUSE * tag 'kbuild-fixes-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: fixdep: remove unneeded inclusion kbuild: sort single-targets alphabetically again kbuild: rpm-pkg: add libelf-devel as alternative for BuildRequires kbuild: Fix running modpost with musl libc kbuild: add a missing line for help message .gitignore: ignore *.rpm arch: fix broken BuildID for arm64 and riscv kconfig: Add static text for search information in help menu commit e39d9b9f89f2efd653212064f941de6f53c3c060 Merge: c8451c141e07a 37e14e4f37154 Author: Linus Torvalds Date: Sat Dec 31 10:01:44 2022 -0800 Merge tag 'ata-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: "A single fix to address an issue with wake from suspend with PCS adapters, from Adam" * tag 'ata-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: ahci: Fix PCS quirk application for suspend commit 87b30c4b0efb6a194a7b8eac2568a3da520d905f Author: Dario Binacchi Date: Thu Dec 8 17:54:03 2022 +0100 ARM: imx: add missing of_node_put() Calling of_find_compatible_node() returns a node pointer with refcount incremented. Use of_node_put() on it when done. The patch fixes the same problem on different i.MX platforms. Fixes: 8b88f7ef31dde ("ARM: mx25: Retrieve IIM base from dt") Fixes: 94b2bec1b0e05 ("ARM: imx27: Retrieve the SYSCTRL base address from devicetree") Fixes: 3172225d45bd9 ("ARM: imx31: Retrieve the IIM base address from devicetree") Fixes: f68ea682d1da7 ("ARM: imx35: Retrieve the IIM base address from devicetree") Fixes: ee18a7154ee08 ("ARM: imx5: retrieve iim base from device tree") Signed-off-by: Dario Binacchi Reviewed-by: Fabio Estevam Reviewed-by: Martin Kaiser Signed-off-by: Shawn Guo commit 62f0147fd4d86620853bee027800f988d3013656 Author: Haibo Chen Date: Thu Dec 8 17:06:58 2022 +0800 arm64: dts: imx93-11x11-evk: correct clock and strobe pad setting For clock and strobe pad of usdhc, need to config as pull down. Current pad config set these pad as both pull up and pull down, this is wrong, so fix it here. Find this issue when enable HS400ES mode on one Micron eMMC chip, CMD8 always meet CRC error in HS400ES/HS400 mode. Fixes: e37907bd8294 ("arm64: dts: freescale: add i.MX93 11x11 EVK basic support") Signed-off-by: Haibo Chen Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 6c620a30515c494b5eeb3dc0e40d3220ea04c53b Author: Emanuele Ghidoli Date: Wed Dec 7 11:27:49 2022 +0100 arm64: dts: verdin-imx8mm: fix dev board audio playback Set optional `simple-audio-card,mclk-fs` parameter to ensure a proper clock to the nau8822 audio codec. Without this change with an audio stream rate of 44.1 kHz the playback is faster. Set the MCLK at the right frequency, codec can properly use it to generate 44.1 kHz I2S-FS. Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Emanuele Ghidoli Signed-off-by: Francesco Dolcini Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit ef10d57936ead5e817ef7cea6a87531085e77773 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:44:17 2022 +0100 arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI There is no "no-emmc" property, so intention for SD/SDIO only nodes was to use "no-mmc". Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 5225ba9db112ec4ed67da5e4d8b72e618573955e Author: Adam Ford Date: Fri Dec 2 13:10:37 2022 -0600 arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux Early hardware did not support hardware handshaking on the UART, but final production hardware did. When the hardware was updated the chip select was changed to facilitate hardware handshaking on UART3. Fix the ecspi2 pin mux to eliminate a pin conflict with UART3 and allow the EEPROM to operate again. Fixes: 4ce01ce36d77 ("arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit b025b4f5c288e29bbea421613a5b4eacf9261fbb Author: Geert Uytterhoeven Date: Fri Dec 2 17:49:22 2022 +0100 arm64: dts: freescale: Fix pca954x i2c-mux node names "make dtbs_check": arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dtb: pca9547@77: $nodename:0: 'pca9547@77' does not match '^(i2c-?)?mux' From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dtb: pca9547@77: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@4' were unexpected) From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml ... Fix this by renaming PCA954x nodes to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification. Signed-off-by: Geert Uytterhoeven Signed-off-by: Shawn Guo commit 42825d1f269355d63554ab3c3762611e4d8053e9 Author: Geert Uytterhoeven Date: Fri Dec 2 17:49:21 2022 +0100 ARM: dts: vf610: Fix pca9548 i2c-mux node names "make dtbs_check": arch/arm/boot/dts/vf610-zii-dev-rev-b.dtb: tca9548@70: $nodename:0: 'tca9548@70' does not match '^(i2c-?)?mux' From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml arch/arm/boot/dts/vf610-zii-dev-rev-b.dtb: tca9548@70: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@0', 'i2c@1', 'i2c@2', 'i2c@3', 'i2c@4' were unexpected) From schema: /scratch/geert/linux/linux-renesas/Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml ... Fix this by renaming PCA9548 nodes to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification. Signed-off-by: Geert Uytterhoeven Signed-off-by: Shawn Guo commit f78985f9f58380eec37f82c8a2c765aa7670fc29 Author: Geert Uytterhoeven Date: Fri Dec 2 17:49:18 2022 +0100 ARM: dts: imx: Fix pca9547 i2c-mux node name "make dtbs_check": arch/arm/boot/dts/imx53-ppd.dtb: i2c-switch@70: $nodename:0: 'i2c-switch@70' does not match '^(i2c-?)?mux' From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml arch/arm/boot/dts/imx53-ppd.dtb: i2c-switch@70: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@0', 'i2c@1', 'i2c@2', 'i2c@3', 'i2c@4', 'i2c@5', 'i2c@6', 'i2c@7' were unexpected) From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml Fix this by renaming the PCA9547 node to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification. Signed-off-by: Geert Uytterhoeven Signed-off-by: Shawn Guo commit 0d1d030f00f3f3eea04017cbd50ffe44a2842ebc Author: Emanuele Ghidoli Date: Thu Dec 1 13:55:48 2022 +0100 arm64: dts: verdin-imx8mm: fix dahlia audio playback Set optional `simple-audio-card,mclk-fs` parameter to ensure a proper clock to the wm8904 audio codec. Without this change with an audio stream rate of 44.1 kHz the playback is completely distorted. Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Emanuele Ghidoli Signed-off-by: Francesco Dolcini Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 9dfbc72256b5de608ad10989bcbafdbbd1ac8d4e Author: Fabio Estevam Date: Mon Nov 21 17:22:59 2022 -0300 ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' The following build warning is seen when running: make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml arch/arm/boot/dts/imx6dl-gw560x.dtb: serial@2020000: rts-gpios: False schema does not allow [[20, 1, 0]] From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml The imx6qdl-gw560x board does not expose the UART RTS and CTS as native UART pins, so 'uart-has-rtscts' should not be used. Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination detected by serial.yaml. Fix the problem by removing the incorrect 'uart-has-rtscts' property. Fixes: b8a559feffb2 ("ARM: dts: imx: add Gateworks Ventana GW5600 support") Signed-off-by: Fabio Estevam Acked-by: Tim Harvey Signed-off-by: Shawn Guo commit f4dd0845c4f1f5371f1e06fef0e4a1734a2db964 Author: Fabio Estevam Date: Mon Nov 21 13:31:24 2022 -0300 ARM: dts: imx7d-pico: Use 'clock-frequency' 'clock_frequency' is not a valid property. Use the correct 'clock-frequency' instead. Fixes: 8b646cfb84c3 ("ARM: dts: imx7d-pico: Add support for the dwarf baseboard") Fixes: 6418fd92417f ("ARM: dts: imx7d-pico: Add support for the nymph baseboard") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 94e2cf1e0db5b06c7a6ae0878c5cbec925819a8a Author: Fabio Estevam Date: Mon Nov 21 13:31:23 2022 -0300 ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' 'clock_frequency' is not a valid property. Use the correct 'clock-frequency' instead. Fixes: 47246fafef84 ("ARM: dts: imx6ul-pico: Add support for the dwarf baseboard") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit cfd04dd1c4b6c33afc2a934b957d71cf8ddd1539 Author: Fabio Estevam Date: Mon Nov 21 13:29:11 2022 -0300 arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property 'regulator-compatible' is not a valid property according to nxp,pca9450-regulator.yaml and causes the following warning: DTC_CHK arch/arm64/boot/dts/freescale/imx8mp-dhcom-pdk2.dtb ... pmic@25: regulators:LDO1: Unevaluated properties are not allowed ('regulator-compatible' was unexpected) Remove the invalid 'regulator-compatible' property. Cc: Teresa Remmet Fixes: 88f7f6bcca37 ("arm64: dts: freescale: Add support for phyBOARD-Pollux-i.MX8MP") Signed-off-by: Fabio Estevam Reviewed-by: Teresa Remmet Signed-off-by: Shawn Guo commit 8a1ed98fe0f2e7669f0409de0f46f317b275f8be Author: Li Jun Date: Fri Sep 30 22:54:23 2022 +0800 arm64: dts: imx8mp: correct usb clocks After commit cf7f3f4fa9e5 ("clk: imx8mp: fix usb_root_clk parent"), usb_root_clk is no longer for suspend clock so update dts accordingly to use right bus clock and suspend clock. Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes") Cc: stable@vger.kernel.org # ed1f4ccfe947: clk: imx: imx8mp: add shared clk gate for usb suspend clk Cc: stable@vger.kernel.org # v5.19+ Reviewed-by: Peng Fan Tested-by: Alexander Stein Signed-off-by: Li Jun Signed-off-by: Shawn Guo commit b814eda949c324791580003303aa608761cfde3f Author: Lucas Stach Date: Sat Dec 31 13:40:25 2022 +0800 soc: imx: imx8mp-blk-ctrl: enable global pixclk with HDMI_TX_PHY PD NXP internal information shows that the PHY refclk is gated by the GLOBAL_TX_PIX_CLK_EN bit, so to allow the PHY PLL to lock without the LCDIF being already active, tie this bit to the HDMI_TX_PHY power domain. Fixes: e3442022f543 ("soc: imx: add i.MX8MP HDMI blk-ctrl") Signed-off-by: Lucas Stach Signed-off-by: Shawn Guo commit b878d3ba9bb41cddb73ba4b56e5552f0a638daca Author: Srinivas Pandruvada Date: Tue Dec 27 16:10:05 2022 -0800 thermal: int340x: Add missing attribute for data rate base Commit 473be51142ad ("thermal: int340x: processor_thermal: Add RFIM driver")' added rfi_restriction_data_rate_base string, mmio details and documentation, but missed adding attribute to sysfs. Add missing sysfs attribute. Fixes: 473be51142ad ("thermal: int340x: processor_thermal: Add RFIM driver") Cc: 5.11+ # v5.11+ Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit c8451c141e07a8d05693f6c8d0e418fbb4b68bb7 Merge: 262eef26e3501 0948a9ef1d59d Author: Linus Torvalds Date: Fri Dec 30 10:47:25 2022 -0800 Merge tag 'acpi-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These are new ACPI IRQ override quirks, low-power S0 idle (S0ix) support adjustments and ACPI backlight handling fixes, mostly for platforms using AMD chips. Specifics: - Add ACPI IRQ override quirks for Asus ExpertBook B2502, Lenovo 14ALC7, and XMG Core 15 (Hans de Goede, Adrian Freund, Erik Schumacher). - Adjust ACPI video detection fallback path to prevent non-operational ACPI backlight devices from being created on systems where the native driver does not detect a suitable panel (Mario Limonciello). - Fix Apple GMUX backlight detection (Hans de Goede). - Add a low-power S0 idle (S0ix) handling quirk for HP Elitebook 865 and stop using AMD-specific low-power S0 idle code path for systems with Rembrandt chips and newer (Mario Limonciello)" * tag 'acpi-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 ACPI: video: Fix Apple GMUX backlight detection ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks ACPI: resource: do IRQ override on Lenovo 14ALC7 ACPI: resource: do IRQ override on XMG Core 15 ACPI: video: Don't enable fallback path for creating ACPI backlight by default drm/amd/display: Report to ACPI video if no panels were found ACPI: video: Allow GPU drivers to report no panels commit 262eef26e350181f8067072571f4918cad3c5e87 Merge: bff687b3dad6e 090ddad4c7a9f Author: Linus Torvalds Date: Fri Dec 30 10:30:54 2022 -0800 Merge tag 'sound-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a few small fixes: - A regression fix for HDMI audio on HD-audio AMD codecs - Fixes for LINE6 MIDI handling - HD-audio quirk for Dell laptops" * tag 'sound-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/hdmi: Static PCM mapping again with AMD HDMI codecs ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops ALSA: line6: fix stack overflow in line6_midi_transmit ALSA: line6: correct midi status byte when receiving data from podxt commit a1c7a7cde6c92e42eb2cc8a04a9529c3fe8f19c8 Merge: 6b1c374c45605 d347a951906b5 Author: Martin K. Petersen Date: Fri Dec 30 16:31:44 2022 +0000 Merge branch '6.2/mpt-mpi' into 6.2/scsi-fixes Pull in Broadcom MPI/MPT fixes that conflicted with patch resolution upstream. Signed-off-by: Martin K. Petersen commit 6b1c374c45605504ed32e855c4e0f9b652a1978e Merge: 1b929c02afd37 1a5665fc8d7a0 Author: Martin K. Petersen Date: Fri Dec 30 16:29:34 2022 +0000 Merge branch '6.2/scsi-queue' into 6.2/scsi-fixes Pull in remaining patches from the 6.2 queue. Signed-off-by: Martin K. Petersen commit 0948a9ef1d59d1bc7fae29f32058e463bbff4a6c Merge: e555c85792bd5 7203481fd12b1 3cf3b7f012f3e Author: Rafael J. Wysocki Date: Fri Dec 30 16:59:10 2022 +0100 Merge branches 'acpi-resource' and 'acpi-video' Merge ACPI resource handling quirks and ACPI backlight handling fixes for 6.2-rc2: - Add ACPI IRQ override quirks for Asus ExpertBook B2502, Lenovo 14ALC7, and XMG Core 15 (Hans de Goede, Adrian Freund, Erik Schumacher). - Adjust ACPI video detection fallback path to prevent non-operational ACPI backlight devices from being created on systems where the native driver does not detect a suitable panel (Mario Limonciello). - Fix Apple GMUX backlight detection (Hans de Goede). * acpi-resource: ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks ACPI: resource: do IRQ override on Lenovo 14ALC7 ACPI: resource: do IRQ override on XMG Core 15 * acpi-video: ACPI: video: Fix Apple GMUX backlight detection ACPI: video: Don't enable fallback path for creating ACPI backlight by default drm/amd/display: Report to ACPI video if no panels were found ACPI: video: Allow GPU drivers to report no panels commit 9883ddf9d68db5332f08dfc7283db69f69f8d6d2 Author: Cixi Geng Date: Thu Dec 29 22:55:45 2022 +0800 gpio: sprd: Make the irqchip immutable Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the new helper functions, and call the appropriate gpiolib functions. Signed-off-by: Cixi Geng Reported-by: kernel test robot Reported-by: Julia Lawall Reviewed-by: Baolin Wang Signed-off-by: Bartosz Golaszewski commit be43eea7de5a3977ac3d13fbfb9e505fab475e97 Author: Cixi Geng Date: Thu Dec 29 22:55:44 2022 +0800 gpio: pmic-eic-sprd: Make the irqchip immutable Remove the irq_chip from pmic_eic structure, use the various calls by defining the statically irq_chip structure. Signed-off-by: Cixi Geng Reviewed-by: Baolin Wang Signed-off-by: Bartosz Golaszewski commit 2788938b794633fc1865c805764bed196e01f97e Author: Cixi Geng Date: Thu Dec 29 22:55:43 2022 +0800 gpio: eic-sprd: Make the irqchip immutable Remove the irq_chip from pmic_eic structure, use the various calls by defining the statically irq_chip structure. Signed-off-by: Cixi Geng Reviewed-by: Baolin Wang Signed-off-by: Bartosz Golaszewski commit e84077437902ec99eba0a6b516df772653f142c7 Author: Eliav Farber Date: Thu Oct 20 12:44:58 2022 +0000 EDAC/device: Fix period calculation in edac_device_reset_delay_period() Fix period calculation in case user sets a value of 1000. The input of round_jiffies_relative() should be in jiffies and not in milli-seconds. [ bp: Use the same code pattern as in edac_device_workq_setup() for clarity. ] Fixes: c4cf3b454eca ("EDAC: Rework workqueue handling") Signed-off-by: Eliav Farber Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/20221020124458.22153-1-farbere@amazon.com commit 90fee3dd5bfc1b9f4c8c0ba6cd2a35c9d79ca4de Author: Haibo Chen Date: Sun Dec 11 00:05:58 2022 +0200 gpio: pca953x: avoid to use uninitialized value pinctrl There is a variable pinctrl declared without initializer. And then has the case (switch operation chose the default case) to directly use this uninitialized value, this is not a safe behavior. So here initialize the pinctrl as 0 to avoid this issue. This is reported by Coverity. Fixes: 13c5d4ce8060 ("gpio: pca953x: Add support for PCAL6534") Signed-off-by: Haibo Chen Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit ba2dc1cb5491712a6946d0595cf11ba463f50e64 Author: Hans de Goede Date: Thu Dec 29 17:45:01 2022 +0100 gpiolib: Fix using uninitialized lookup-flags on ACPI platforms Commit 8eb1f71e7acc ("gpiolib: consolidate GPIO lookups") refactors fwnode_get_named_gpiod() and gpiod_get_index() into a unified gpiod_find_and_request() helper. The old functions both initialized their local lookupflags variable to GPIO_LOOKUP_FLAGS_DEFAULT, but the new code leaves it uninitialized. This is a problem for at least ACPI platforms, where acpi_find_gpio() only does a bunch of *lookupflags |= GPIO_* statements and thus relies on the variable being initialized. The variable not being initialized leads to: 1. Potentially the wrong flags getting used 2. The check for conflicting lookup flags in gpiod_configure_flags(): "multiple pull-up, pull-down or pull-disable enabled, invalid config" sometimes triggering, making the GPIO unavailable Restore the initialization of lookupflags to GPIO_LOOKUP_FLAGS_DEFAULT to fix this. Fixes: 8eb1f71e7acc ("gpiolib: consolidate GPIO lookups") Signed-off-by: Hans de Goede Signed-off-by: Bartosz Golaszewski commit 736f88689c6912f05d0116917910603a7ba97de7 Author: Tianjia Zhang Date: Wed Dec 21 15:32:32 2022 +0800 crypto: arm64/sm4 - fix possible crash with CFI enabled The SM4 CCM/GCM assembly functions for encryption and decryption is called via indirect function calls. Therefore they need to use SYM_TYPED_FUNC_START instead of SYM_FUNC_START to cause its type hash to be emitted when the kernel is built with CONFIG_CFI_CLANG=y. Otherwise, the code crashes with a CFI failure (if the compiler didn't happen to optimize out the indirect call). Fixes: 67fa3a7fdf80 ("crypto: arm64/sm4 - add CE implementation for CCM mode") Fixes: ae1b83c7d572 ("crypto: arm64/sm4 - add CE implementation for GCM mode") Signed-off-by: Tianjia Zhang Signed-off-by: Herbert Xu commit a23529989a8f56d23680c4f2d14011bc9c9457c9 Author: Nikolaus Voss Date: Tue Dec 20 09:17:50 2022 +0100 crypto: caam - fix CAAM io mem access in blob_gen IO memory access has to be done with accessors defined in caam/regs.h as there are little-endian architectures with a big-endian CAAM unit. Fixes: 6a83830f649a ("crypto: caam - warn if blob_gen key is insecure") Signed-off-by: Nikolaus Voss Reviewed-by: Ahmad Fatoum Signed-off-by: Herbert Xu commit 6217e9f05a74df48c77ee68993d587cdfdb1feb7 Author: Jani Nikula Date: Tue Dec 20 16:01:05 2022 +0200 drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index Due to copy-paste fail, MIPI_BKLT_EN_1 would always use PPS index 1, never 0. Fix the sloppiest commit in recent memory. Fixes: 963bbdb32b47 ("drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence") Reported-by: Ville Syrjälä Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20221220140105.313333-1-jani.nikula@intel.com (cherry picked from commit a561933c571798868b5fa42198427a7e6df56c09) Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Rodrigo Vivi commit 963bbdb32b47cfa67a449e715e1dcc525fbd01fc Author: Jani Nikula Date: Mon Dec 19 12:59:55 2022 +0200 drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence Starting from ICL, the default for MIPI GPIO sequences seems to be using native GPIOs i.e. GPIOs available in the GPU. These native GPIOs reuse many pins that quite frankly seem scary to poke based on the VBT sequences. We pretty much have to trust that the board is configured such that the relevant HPD, PP_CONTROL and GPIO bits aren't used for anything else. MIPI sequence v4 also adds a flag to fall back to non-native sequences. v5: - Wrap SHOTPLUG_CTL_DDI modification in spin_lock() in icp_irq_handler() too (Ville) - References instead of Closes issue 6131 because this does not fix everything v4: - Wrap SHOTPLUG_CTL_DDI modification in spin_lock_irq() (Ville) v3: - Fix -Wbitwise-conditional-parentheses (kernel test robot ) v2: - Fix HPD pin output set (impacts GPIOs 0 and 5) - Fix GPIO data output direction set (impacts GPIOs 4 and 9) - Reduce register accesses to single intel_de_rwm() References: https://gitlab.freedesktop.org/drm/intel/-/issues/6131 Cc: Ville Syrjälä Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20221219105955.4014451-1-jani.nikula@intel.com (cherry picked from commit f087cfe6fcff58044f7aa3b284965af47f472fb0) Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Rodrigo Vivi commit 6a5e25fc3e0b94301734e8abb1d311a1e02d360d Author: Masahiro Yamada Date: Fri Dec 30 17:16:42 2022 +0900 fixdep: remove unneeded inclusion This is unneeded since commit 69304379ff03 ("fixdep: use fflush() and ferror() to ensure successful write to files"). Signed-off-by: Masahiro Yamada commit aa4847dbcdabfe80a1cff96480e4b3c8076a0356 Author: Masahiro Yamada Date: Thu Dec 29 21:16:42 2022 +0900 kbuild: sort single-targets alphabetically again This was previously alphabetically sorted. Sort it again. Signed-off-by: Masahiro Yamada Reviewed-by: Miguel Ojeda Reviewed-by: Nathan Chancellor commit 02a893bc99757d75b7abb43b74f210dfa3df8c4b Author: Masahiro Yamada Date: Thu Dec 29 04:10:14 2022 +0900 kbuild: rpm-pkg: add libelf-devel as alternative for BuildRequires Guoqing Jiang reports that openSUSE cannot compile the kernel rpm due to "BuildRequires: elfutils-libelf-devel" added by commit 8818039f959b ("kbuild: add ability to make source rpm buildable using koji"). The relevant package name in openSUSE is libelf-devel. Add it as an alternative package. BTW, if it is impossible to solve the build requirement, the final resort would be: $ make RPMOPTS=--nodeps rpm-pkg This passes --nodeps to the rpmbuild command so it will not verify build dependencies. This is useful to test rpm builds on non-rpm system. On Debian/Ubuntu, for example, you can install rpmbuild by 'apt-get install rpm'. NOTE1: Likewise, it is possible to bypass the build dependency check for debian package builds: $ make DPKG_FLAGS=-d deb-pkg NOTE2: The 'or' operator is supported since RPM 4.13. So, old distros such as CentOS 7 will break. I suggest installing newer rpmbuild in such cases. Link: https://lore.kernel.org/linux-kbuild/ee227d24-9c94-bfa3-166a-4ee6b5dfea09@linux.dev/T/#u Fixes: 8818039f959b ("kbuild: add ability to make source rpm buildable using koji") Reported-by: Guoqing Jiang Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Tested-by: Guoqing Jiang Acked-by: Jonathan Toppins commit 63ffe00d8c939eda1a8fa87484ca4537e13a20b7 Author: Samuel Holland Date: Tue Dec 27 15:48:21 2022 -0600 kbuild: Fix running modpost with musl libc commit 3d57e1b7b1d4 ("kbuild: refactor the prerequisites of the modpost rule") moved 'vmlinux.o' inside modpost-args, possibly before some of the other options. However, getopt() in musl libc follows POSIX and stops looking for options upon reaching the first non-option argument. As a result, the '-T' option is misinterpreted as a positional argument, and the build fails: make -f ./scripts/Makefile.modpost scripts/mod/modpost -E -o Module.symvers vmlinux.o -T modules.order -T: No such file or directory make[1]: *** [scripts/Makefile.modpost:137: Module.symvers] Error 1 make: *** [Makefile:1960: modpost] Error 2 The fix is to move all options before 'vmlinux.o' in modpost-args. Fixes: 3d57e1b7b1d4 ("kbuild: refactor the prerequisites of the modpost rule") Signed-off-by: Samuel Holland Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 9c9b55a59416a87fc73c479d78cb3218076dbc30 Author: Jun ASAKA Date: Tue Dec 27 17:21:57 2022 +0800 kbuild: add a missing line for help message The help message line for building the source RPM package was missing. Added it. Signed-off-by: Jun ASAKA Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 924d28b39e3b62ad5e97751585aed7c89f8c43ee Author: Masahiro Yamada Date: Tue Dec 27 03:54:44 2022 +0900 .gitignore: ignore *.rpm Previously, *.rpm files were created under $HOME/rpmbuild/, but since commit 8818039f959b ("kbuild: add ability to make source rpm buildable using koji"), srcrpm-pkg creates the source rpm in the kernel tree because it sets '_srcrpmdir'. Signed-off-by: Masahiro Yamada commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 Author: Masahiro Yamada Date: Tue Dec 27 03:45:37 2022 +0900 arch: fix broken BuildID for arm64 and riscv Dennis Gilmore reports that the BuildID is missing in the arm64 vmlinux since commit 994b7ac1697b ("arm64: remove special treatment for the link order of head.o"). The issue is that the type of .notes section, which contains the BuildID, changed from NOTES to PROGBITS. Ard Biesheuvel figured out that whichever object gets linked first gets to decide the type of a section. The PROGBITS type is the result of the compiler emitting .note.GNU-stack as PROGBITS rather than NOTE. While Ard provided a fix for arm64, I want to fix this globally because the same issue is happening on riscv since commit 2348e6bf4421 ("riscv: remove special treatment for the link order of head.o"). This problem will happen in general for other architectures if they start to drop unneeded entries from scripts/head-object-list.txt. Discard .note.GNU-stack in include/asm-generic/vmlinux.lds.h. Link: https://lore.kernel.org/lkml/CAABkxwuQoz1CTbyb57n0ZX65eSYiTonFCU8-LCQc=74D=xE=rA@mail.gmail.com/ Fixes: 994b7ac1697b ("arm64: remove special treatment for the link order of head.o") Fixes: 2348e6bf4421 ("riscv: remove special treatment for the link order of head.o") Reported-by: Dennis Gilmore Suggested-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada Acked-by: Palmer Dabbelt commit 11ce8fd8fd8718247f17475802639cd7e2d3765c Author: John Harrison Date: Wed Dec 21 11:30:31 2022 -0800 drm/i915/uc: Fix two issues with over-size firmware files In the case where a firmware file is too large (e.g. someone downloaded a web page ASCII dump from github...), the firmware object is released but the pointer is not zerod. If no other firmware file was found then release would be called again leading to a double kfree. Also, the size check was only being applied to the initial firmware load not any of the subsequent attempts. So move the check into a wrapper that is used for all loads. Fixes: 016241168dc5 ("drm/i915/uc: use different ggtt pin offsets for uc loads") Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Rodrigo Vivi Cc: Matt Roper Cc: Jani Nikula Cc: Matthew Auld Cc: "Thomas Hellström" Link: https://patchwork.freedesktop.org/patch/msgid/20221221193031.687266-4-John.C.Harrison@Intel.com (cherry picked from commit 4071d98b296a5bc5fd4b15ec651bd05800ec9510) Signed-off-by: Rodrigo Vivi commit 3f882f2d4f689627c1566c2c92087bc3ff734953 Author: Matthew Auld Date: Fri Dec 16 11:34:56 2022 +0000 drm/i915: improve the catch-all evict to handle lock contention The catch-all evict can fail due to object lock contention, since it only goes as far as trylocking the object, due to us already holding the vm->mutex. Doing a full object lock here can deadlock, since the vm->mutex is always our inner lock. Add another execbuf pass which drops the vm->mutex and then tries to grab the object will the full lock, before then retrying the eviction. This should be good enough for now to fix the immediate regression with userspace seeing -ENOSPC from execbuf due to contended object locks during GTT eviction. v2 (Mani) - Also revamp the docs for the different passes. Testcase: igt@gem_ppgtt@shrink-vs-evict-* Fixes: 7e00897be8bf ("drm/i915: Add object locking to i915_gem_evict_for_node and i915_gem_evict_something, v2.") References: https://gitlab.freedesktop.org/drm/intel/-/issues/7627 References: https://gitlab.freedesktop.org/drm/intel/-/issues/7570 References: https://bugzilla.mozilla.org/show_bug.cgi?id=1779558 Signed-off-by: Matthew Auld Cc: Maarten Lankhorst Cc: Thomas Hellström Cc: Tvrtko Ursulin Cc: Andrzej Hajda Cc: Mani Milani Cc: # v5.18+ Reviewed-by: Mani Milani Tested-by: Mani Milani Link: https://patchwork.freedesktop.org/patch/msgid/20221216113456.414183-1-matthew.auld@intel.com (cherry picked from commit 801fa7a81f6da533cc5442fc40e32c72b76cd42a) Signed-off-by: Rodrigo Vivi commit fff758698842fb6722be37498d8773e0fb47f000 Author: Lucas De Marchi Date: Wed Dec 14 11:49:44 2022 -0800 drm/i915: Remove __maybe_unused from mtl_info The attribute __maybe_unused should remain only until the respective info is not in the pciidlist. The info can't be added together with its definition because that would cause the driver to automatically probe for the device, while it's still not ready for that. However once pciidlist contains it, the attribute can be removed. Fixes: 7835303982d1 ("drm/i915/mtl: Add MeteorLake PCI IDs") Signed-off-by: Lucas De Marchi Reviewed-by: Radhakrishna Sripada Link: https://patchwork.freedesktop.org/patch/msgid/20221214194944.3670344-1-lucas.demarchi@intel.com (cherry picked from commit 50490ce05b7a50b0bd4108fa7d6db3ca2972fa83) Signed-off-by: Rodrigo Vivi commit c5bc073668206c73c20798eb6d978b5e9db5b16f Author: Andrzej Hajda Date: Wed Dec 14 08:54:39 2022 +0100 drm/i915: fix TLB invalidation for Gen12.50 video and compute engines In case of Gen12.50 video and compute engines, TLB_INV registers are masked - to modify one bit, corresponding bit in upper half of the register must be enabled, otherwise nothing happens. Fixes: 77fa9efc16a9 ("drm/i915/xehp: Create separate reg definitions for new MCR registers") Signed-off-by: Andrzej Hajda Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20221214075439.402485-1-andrzej.hajda@intel.com (cherry picked from commit 4d5cf7b1680a1e6db327e3c935ef58325cbedb2c) Signed-off-by: Rodrigo Vivi commit d039535850ee47079d59527e96be18d8e0daa84b Author: Miaoqian Lin Date: Thu Dec 29 10:29:25 2022 +0400 net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore. Fixes: ab4e6ee578e8 ("net: phy: xgmiitorgmii: Check phy_driver ready before accessing") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller commit 72f299b0ca3be44650a5607368329a5d9666c0e3 Merge: 1573c6882018f a8ee104f986e7 Author: David S. Miller Date: Fri Dec 30 07:43:44 2022 +0000 Merge branch 'ena-fixes' David Arinzon says: ==================== ENA driver bug fixes ==================== Signed-off-by: David S. Miller commit a8ee104f986e720cea52133885cc822d459398c7 Author: David Arinzon Date: Thu Dec 29 07:30:11 2022 +0000 net: ena: Update NUMA TPH hint register upon NUMA node update The device supports a PCIe optimization hint, which indicates on which NUMA the queue is currently processed. This hint is utilized by PCIe in order to reduce its access time by accessing the correct NUMA resources and maintaining cache coherence. The driver calls the register update for the hint (called TPH - TLP Processing Hint) during the NAPI loop. Though the update is expected upon a NUMA change (when a queue is moved from one NUMA to the other), the current logic performs a register update when the queue is moved to a different CPU, but the CPU is not necessarily in a different NUMA. The changes include: 1. Performing the TPH update only when the queue has switched a NUMA node. 2. Moving the TPH update call to be triggered only when NAPI was scheduled from interrupt context, as opposed to a busy-polling loop. This is due to the fact that during busy-polling, the frequency of CPU switches for a particular queue is significantly higher, thus, the likelihood to switch NUMA is much higher. Therefore, providing the frequent updates to the device upon a NUMA update are unlikely to be beneficial. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit e712f3e4920b3a1a5e6b536827d118e14862896c Author: David Arinzon Date: Thu Dec 29 07:30:10 2022 +0000 net: ena: Set default value for RX interrupt moderation RX ring can be NULL in XDP use cases where only TX queues are configured. In this scenario, the RX interrupt moderation value sent to the device remains in its default value of 0. In this change, setting the default value of the RX interrupt moderation to be the same as of the TX. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit c7062aaee099f2f43d6f07a71744b44b94b94b34 Author: David Arinzon Date: Thu Dec 29 07:30:09 2022 +0000 net: ena: Fix rx_copybreak value update Make the upper bound on rx_copybreak tighter, by making sure it is smaller than the minimum of mtu and ENA_PAGE_SIZE. With the current upper bound of mtu, rx_copybreak can be larger than a page. Such large rx_copybreak will not bring any performance benefit to the user and therefore makes no sense. In addition, the value update was only reflected in the adapter structure, but not applied for each ring, causing it to not take effect. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Osama Abboud Signed-off-by: Arthur Kiyanovski Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit 59811faa2c54dbcf44d575b5a8f6e7077da88dc2 Author: David Arinzon Date: Thu Dec 29 07:30:08 2022 +0000 net: ena: Use bitmask to indicate packet redirection Redirecting packets with XDP Redirect is done in two phases: 1. A packet is passed by the driver to the kernel using xdp_do_redirect(). 2. After finishing polling for new packets the driver lets the kernel know that it can now process the redirected packet using xdp_do_flush_map(). The packets' redirection is handled in the napi context of the queue that called xdp_do_redirect() To avoid calling xdp_do_flush_map() each time the driver first checks whether any packets were redirected, using xdp_flags |= xdp_verdict; and if (xdp_flags & XDP_REDIRECT) xdp_do_flush_map() essentially treating XDP instructions as a bitmask, which isn't the case: enum xdp_action { XDP_ABORTED = 0, XDP_DROP, XDP_PASS, XDP_TX, XDP_REDIRECT, }; Given the current possible values of xdp_action, the current design doesn't have a bug (since XDP_REDIRECT = 100b), but it is still flawed. This patch makes the driver use a bitmask instead, to avoid future issues. Fixes: a318c70ad152 ("net: ena: introduce XDP redirect implementation") Signed-off-by: Shay Agroskin Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit c7f5e34d906320fdc996afa616676161c029cc02 Author: David Arinzon Date: Thu Dec 29 07:30:07 2022 +0000 net: ena: Account for the number of processed bytes in XDP The size of packets that were forwarded or dropped by XDP wasn't added to the total processed bytes statistic. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit 9c9e539956fa67efb8a65e32b72a853740b33445 Author: David Arinzon Date: Thu Dec 29 07:30:06 2022 +0000 net: ena: Don't register memory info on XDP exchange Since the queues aren't destroyed when we only exchange XDP programs, there's no need to re-register them again. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit 332b49ff637d6c1a75b971022a8b992cf3c57db1 Author: David Arinzon Date: Thu Dec 29 07:30:05 2022 +0000 net: ena: Fix toeplitz initial hash value On driver initialization, RSS hash initial value is set to zero, instead of the default value. This happens because we pass NULL as the RSS key parameter, which caused us to never initialize the RSS hash value. This patch fixes it by making sure the initial value is set, no matter what the value of the RSS key is. Fixes: 91a65b7d3ed8 ("net: ena: fix potential crash when rxfh key is NULL") Signed-off-by: Nati Koler Signed-off-by: David Arinzon Signed-off-by: David S. Miller commit 1573c6882018f69991aead951d09423ce978adac Author: Po-Hsu Lin Date: Thu Dec 29 13:41:06 2022 +0800 selftests: net: fix cmsg_so_mark.sh test hang This cmsg_so_mark.sh test will hang on non-amd64 systems because of the infinity loop for argument parsing in cmsg_sender. Variable "o" in cs_parse_args() for taking getopt() should be an int, otherwise it will be 255 when getopt() returns -1 on non-amd64 system and thus causing infinity loop. Link: https://lore.kernel.org/lkml/CA+G9fYsM2k7mrF7W4V_TrZ-qDauWM394=8yEJ=-t1oUg8_40YA@mail.gmail.com/t/ Signed-off-by: Po-Hsu Lin Signed-off-by: David S. Miller commit a512807c24bc561f5892ae05abdf360482fb3fe2 Merge: d530ece70f16f 4d1c1379d7177 Author: David S. Miller Date: Fri Dec 30 07:33:55 2022 +0000 Merge tag 'mlx5-fixes-2022-12-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-fixes-2022-12-28 commit d530ece70f16f912e1d1bfeea694246ab78b0a4b Author: Jiguang Xiao Date: Wed Dec 28 16:14:47 2022 +0800 net: amd-xgbe: add missed tasklet_kill The driver does not call tasklet_kill in several places. Add the calls to fix it. Fixes: 85b85c853401 ("amd-xgbe: Re-issue interrupt if interrupt status not cleared") Signed-off-by: Jiguang Xiao Signed-off-by: David S. Miller commit fec7352117fa301bfbc31bacc14bb9a579376b36 Author: Jian Shen Date: Wed Dec 28 14:27:49 2022 +0800 net: hns3: refine the handling for VF heartbeat Currently, the PF check the VF alive by the KEEP_ALVE mailbox from VF. VF keep sending the mailbox per 2 seconds. Once PF lost the mailbox for more than 8 seconds, it will regards the VF is abnormal, and stop notifying the state change to VF, include link state, vf mac, reset, even though it receives the KEEP_ALIVE mailbox again. It's inreasonable. This patch fixes it. PF will record the state change which need to notify VF when lost the VF's KEEP_ALIVE mailbox. And notify VF when receive the mailbox again. Introduce a new flag HCLGE_VPORT_STATE_INITED, used to distinguish the case whether VF driver loaded or not. For VF will query these states when initializing, so it's unnecessary to notify it in this case. Fixes: aa5c4f175be6 ("net: hns3: add reset handling for VF when doing PF reset") Signed-off-by: Jian Shen Signed-off-by: Hao Lan Reported-by: kernel test robot Signed-off-by: David S. Miller commit af691c94d022440476b76560d310d6fea790cc60 Author: Uwe Kleine-König Date: Tue Dec 27 22:45:08 2022 +0100 net: ethernet: freescale: enetc: Drop empty platform remove function A remove callback just returning 0 is equivalent to no remove callback at all. So drop the useless function. Signed-off-by: Uwe Kleine-König Signed-off-by: David S. Miller commit 6b57bffa5f675a01c7981ed271e8521e87441abd Author: Uwe Kleine-König Date: Tue Dec 27 22:45:07 2022 +0100 net: ethernet: broadcom: bcm63xx_enet: Drop empty platform remove function A remove callback just returning 0 is equivalent to no remove callback at all. So drop the useless function. Signed-off-by: Uwe Kleine-König Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 0798311cfd8739bbfba0b454dc828fe35dfa4d72 Merge: 40cab44b9089a 2c042e8e54efb Author: David S. Miller Date: Fri Dec 30 07:25:53 2022 +0000 Merge branch 'tcp-bhash2-fixes' Kuniyuki Iwashima says: =================== tcp: Fix bhash2 and TIME_WAIT regression. We forgot to add twsk to bhash2. Therefore TIME_WAIT sockets cannot prevent bind() to the same local address and port. Changes: v1: * Patch 1: * Add tw_bind2_node in inet_timewait_sock instead of moving sk_bind2_node from struct sock to struct sock_common. ==================== Signed-off-by: David S. Miller commit 2c042e8e54efb2b8e25ed0cb28224e79948dc8ce Author: Kuniyuki Iwashima Date: Mon Dec 26 22:27:53 2022 +0900 tcp: Add selftest for bind() and TIME_WAIT. bhash2 split the bind() validation logic into wildcard and non-wildcard cases. Let's add a test to catch future regression. Before the previous patch: # ./bind_timewait TAP version 13 1..2 # Starting 2 tests from 3 test cases. # RUN bind_timewait.localhost.1 ... # bind_timewait.c:87:1:Expected ret (0) == -1 (-1) # 1: Test terminated by assertion # FAIL bind_timewait.localhost.1 not ok 1 bind_timewait.localhost.1 # RUN bind_timewait.addrany.1 ... # OK bind_timewait.addrany.1 ok 2 bind_timewait.addrany.1 # FAILED: 1 / 2 tests passed. # Totals: pass:1 fail:1 xfail:0 xpass:0 skip:0 error:0 After: # ./bind_timewait TAP version 13 1..2 # Starting 2 tests from 3 test cases. # RUN bind_timewait.localhost.1 ... # OK bind_timewait.localhost.1 ok 1 bind_timewait.localhost.1 # RUN bind_timewait.addrany.1 ... # OK bind_timewait.addrany.1 ok 2 bind_timewait.addrany.1 # PASSED: 2 / 2 tests passed. # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima Acked-by: Joanne Koong Signed-off-by: David S. Miller commit 936a192f974018b4f6040f6f77b1cc1e75bd8666 Author: Kuniyuki Iwashima Date: Mon Dec 26 22:27:52 2022 +0900 tcp: Add TIME_WAIT sockets in bhash2. Jiri Slaby reported regression of bind() with a simple repro. [0] The repro creates a TIME_WAIT socket and tries to bind() a new socket with the same local address and port. Before commit 28044fc1d495 ("net: Add a bhash2 table hashed by port and address"), the bind() failed with -EADDRINUSE, but now it succeeds. The cited commit should have put TIME_WAIT sockets into bhash2; otherwise, inet_bhash2_conflict() misses TIME_WAIT sockets when validating bind() requests if the address is not a wildcard one. The straight option is to move sk_bind2_node from struct sock to struct sock_common to add twsk to bhash2 as implemented as RFC. [1] However, the binary layout change in the struct sock could affect performances moving hot fields on different cachelines. To avoid that, we add another TIME_WAIT list in inet_bind2_bucket and check it while validating bind(). [0]: https://lore.kernel.org/netdev/6b971a4e-c7d8-411e-1f92-fda29b5b2fb9@kernel.org/ [1]: https://lore.kernel.org/netdev/20221221151258.25748-2-kuniyu@amazon.com/ Fixes: 28044fc1d495 ("net: Add a bhash2 table hashed by port and address") Reported-by: Jiri Slaby Suggested-by: Paolo Abeni Signed-off-by: Kuniyuki Iwashima Acked-by: Joanne Koong Signed-off-by: David S. Miller commit 60ce26d10e5850f33cc76fce52f5377045e75a15 Author: Ilpo Järvinen Date: Wed Dec 14 16:49:52 2022 +0200 fpga: m10bmc-sec: Fix probe rollback Handle probe error rollbacks properly to avoid leaks. Fixes: 5cd339b370e2 ("fpga: m10bmc-sec: add max10 secure update functions") Reviewed-by: Matthew Gerlach Reviewed-by: Russ Weight Reviewed-by: Marco Pagani Signed-off-by: Ilpo Järvinen Cc: stable@vger.kernel.org Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20221214144952.8392-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Xu Yilun commit 65ea840afd508194b0ee903256162aa87e46ec30 Author: Zheng Yongjun Date: Sat Nov 26 07:14:30 2022 +0000 fpga: stratix10-soc: Fix return value check in s10_ops_write_init() In case of error, the function stratix10_svc_allocate_memory() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver") Signed-off-by: Zheng Yongjun Reviewed-by: Russ Weight Cc: stable@vger.kernel.org Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20221126071430.19540-1-zhengyongjun3@huawei.com Signed-off-by: Xu Yilun commit bff687b3dad6e0e56b27f4d3ed8a9695f35c7b1a Merge: ac787ffa5a246 1551ed5a178ca Author: Linus Torvalds Date: Thu Dec 29 16:57:29 2022 -0800 Merge tag 'block-6.2-2022-12-29' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Mostly just NVMe, but also a single fixup for BFQ for a regression that happened during the merge window. In detail: - NVMe pull requests via Christoph: - Fix doorbell buffer value endianness (Klaus Jensen) - Fix Linux vs NVMe page size mismatch (Keith Busch) - Fix a potential use memory access beyong the allocation limit (Keith Busch) - Fix a multipath vs blktrace NULL pointer dereference (Yanjun Zhang) - Fix various problems in handling the Command Supported and Effects log (Christoph Hellwig) - Don't allow unprivileged passthrough of commands that don't transfer data but modify logical block content (Christoph Hellwig) - Add a features and quirks policy document (Christoph Hellwig) - Fix some really nasty code that was correct but made smatch complain (Sagi Grimberg) - Use-after-free regression in BFQ from this merge window (Yu)" * tag 'block-6.2-2022-12-29' of git://git.kernel.dk/linux: nvme-auth: fix smatch warning complaints nvme: consult the CSE log page for unprivileged passthrough nvme: also return I/O command effects from nvme_command_effects nvmet: don't defer passthrough commands with trivial effects to the workqueue nvmet: set the LBCC bit for commands that modify data nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition docs, nvme: add a feature and quirk policy document nvme-pci: update sqsize when adjusting the queue depth nvme: fix setting the queue depth in nvme_alloc_io_tag_set block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq nvme: fix multipath crash caused by flush request when blktrace is enabled nvme-pci: fix page size checks nvme-pci: fix mempool alloc size nvme-pci: fix doorbell buffer value endianness commit ac787ffa5a246e53675ae93294420ea948600818 Merge: 69fb073b5ba6d 9eb803402a2a8 Author: Linus Torvalds Date: Thu Dec 29 16:48:21 2022 -0800 Merge tag 'io_uring-6.2-2022-12-29' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Two fixes for mutex grabbing when the task state is != TASK_RUNNING (me) - Check for invalid opcode in io_uring_register() a bit earlier, to avoid going through the quiesce machinery just to return -EINVAL later in the process (me) - Fix for the uapi io_uring header, skipping including time_types.h when necessary (Stefan) * tag 'io_uring-6.2-2022-12-29' of git://git.kernel.dk/linux: uapi:io_uring.h: allow linux/time_types.h to be skipped io_uring: check for valid register opcode earlier io_uring/cancel: re-grab ctx mutex after finishing wait io_uring: finish waiting before flushing overflow entries commit 69fb073b5ba6d7c9358a04115ed61b78c73790ce Merge: 2258c2dc850b8 93ef83050e597 Author: Linus Torvalds Date: Thu Dec 29 16:43:25 2022 -0800 Merge tag 'linux-kselftest-kunit-fixes-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit fix from Shuah Khan: - alloc_string_stream_fragment() error path fix to free before returning a failure. * tag 'linux-kselftest-kunit-fixes-6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: alloc_string_stream_fragment error handling bug fix commit efd58edd8445685b5e7dcb81e5926e0865ece1ff Merge: 472a6309c6467 2d3dd559751ce Author: Mark Brown Date: Thu Dec 29 22:49:17 2022 +0000 Add new AMP MAX98360A for RT5682S Merge series from tongjian : Add MAX98360A for RT5682S, MAX98360A works same as rt1019. So, it can be supported. commit 472a6309c6467af89dbf660a8310369cc9cb041f Author: Emanuele Ghidoli Date: Fri Dec 23 09:02:47 2022 +0100 ASoC: wm8904: fix wrong outputs volume after power reactivation Restore volume after charge pump and PGA activation to ensure that volume settings are correctly applied when re-enabling codec from SND_SOC_BIAS_OFF state. CLASS_W, CHARGE_PUMP and POWER_MANAGEMENT_2 register configuration affect how the volume register are applied and must be configured first. Fixes: a91eb199e4dc ("ASoC: Initial WM8904 CODEC driver") Link: https://lore.kernel.org/all/c7864c35-738c-a867-a6a6-ddf9f98df7e7@gmail.com/ Signed-off-by: Emanuele Ghidoli Signed-off-by: Francesco Dolcini Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20221223080247.7258-1-francesco@dolcini.it Signed-off-by: Mark Brown commit 2258c2dc850b8605cb66b3383e50b9dddd1c6580 Merge: 1b929c02afd37 a5496886eb130 Author: Linus Torvalds Date: Thu Dec 29 10:56:13 2022 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Changes that were posted too late for 6.1, or after the release. x86: - several fixes to nested VMX execution controls - fixes and clarification to the documentation for Xen emulation - do not unnecessarily release a pmu event with zero period - MMU fixes - fix Coverity warning in kvm_hv_flush_tlb() selftests: - fixes for the ucall mechanism in selftests - other fixes mostly related to compilation with clang" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (41 commits) KVM: selftests: restore special vmmcall code layout needed by the harness Documentation: kvm: clarify SRCU locking order KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET KVM: x86/xen: Documentation updates and clarifications KVM: x86/xen: Add KVM_XEN_INVALID_GPA and KVM_XEN_INVALID_GFN to uapi KVM: x86/xen: Simplify eventfd IOCTLs KVM: x86/xen: Fix SRCU/RCU usage in readers of evtchn_ports KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly KVM: x86/xen: Fix memory leak in kvm_xen_write_hypercall_page() KVM: Delete extra block of "};" in the KVM API documentation kvm: x86/mmu: Remove duplicated "be split" in spte.h kvm: Remove the unused macro KVM_MMU_READ_{,UN}LOCK() MAINTAINERS: adjust entry after renaming the vmx hyperv files KVM: selftests: Mark correct page as mapped in virt_map() KVM: arm64: selftests: Don't identity map the ucall MMIO hole KVM: selftests: document the default implementation of vm_vaddr_populate_bitmap KVM: selftests: Use magic value to signal ucall_alloc() failure KVM: selftests: Disable "gnu-variable-sized-type-not-at-end" warning KVM: selftests: Include lib.mk before consuming $(CC) KVM: selftests: Explicitly disable builtins for mem*() overrides ... commit 1551ed5a178ca030adc92b1eb29157b5e92bf134 Merge: 88d356ca41ba1 76807fcd73b81 Author: Jens Axboe Date: Thu Dec 29 11:31:45 2022 -0700 Merge tag 'nvme-6.2-2022-12-29' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - fix various problems in handling the Command Supported and Effects log (Christoph Hellwig) - don't allow unprivileged passthrough of commands that don't transfer data but modify logical block content (Christoph Hellwig) - add a features and quirks policy document (Christoph Hellwig) - fix some really nasty code that was correct but made smatch complain (Sagi Grimberg)" * tag 'nvme-6.2-2022-12-29' of git://git.infradead.org/nvme: nvme-auth: fix smatch warning complaints nvme: consult the CSE log page for unprivileged passthrough nvme: also return I/O command effects from nvme_command_effects nvmet: don't defer passthrough commands with trivial effects to the workqueue nvmet: set the LBCC bit for commands that modify data nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition docs, nvme: add a feature and quirk policy document commit 74b91a1bdb994dfaed0074154ca7d493aeb735a6 Author: Krzysztof Kozlowski Date: Sat Dec 24 22:43:51 2022 +0100 arm64: dts: qcom: sm8350: correct SDHCI interconnect arguments The interconnect providers accept only one argument (cells == 1), so fix a copy&paste from SM8450: sm8350-hdk.dtb: mmc@8804000: interconnects: [[74, 9, 0], [75, 1, 0], [76, 2, 0], [77, 36, 0]] is too long Fixes: 60477435e4de ("arm64: dts: qcom: sm8350: Add SDHCI2") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221224214351.18215-1-krzysztof.kozlowski@linaro.org commit 810948f45d99c46b60852ef2a5a2777c12d6bb3e Author: Mars Chen Date: Wed Dec 28 18:38:12 2022 +0800 ASoC: support machine driver with max98360 Signed-off-by: Mars Chen Link: https://lore.kernel.org/r/20221228103812.450956-1-chenxiangrui@huaqin.corp-partner.google.com Signed-off-by: Mark Brown commit a0dd7fcab5cd221fa960f594c586e1f9f16c02c0 Author: Aniol Martí Date: Tue Dec 27 23:49:32 2022 +0100 ASoC: amd: yc: Add ASUS M5402RA into DMI table ASUS VivoBook 13 OLED (M5402RA) needs this quirk to get the built-in microphone working properly. Signed-off-by: Aniol Martí Link: https://lore.kernel.org/r/20221227224932.9771-1-aniol@aniolmarti.cat Signed-off-by: Mark Brown commit 7161bd540eebebae2bbe8c79de25d8caf12dbf78 Author: ChiYuan Huang Date: Thu Dec 29 16:03:53 2022 +0800 ASoC: rt9120: Make dev PM runtime bind AsoC component PM RT9120 uses PM runtime autosuspend to decrease the frequently on/off spent time. This exists one case, when pcm is closed and dev PM is waiting for autosuspend time expired to enter runtime suspend state. At the mean time, system is going to enter suspend, dev PM runtime suspend won't be called. It makes the rt9120 suspend consumption current not as expected. This patch can fix the rt9120 dev PM issue during runtime autosuspend and system suspend by binding dev PM runtime and ASoC component PM. Fixes: 80b949f332e3 ("ASoC: rt9120: Use pm_runtime and regcache to optimize 'pwdnn' logic") Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/1672301033-3675-1-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown commit 8a54f666db581bbf07494cca44a0124acbced581 Author: Allen-KH Cheng Date: Wed Dec 28 19:57:56 2022 +0800 ASoC: mediatek: mt8186: Add machine support for max98357a Add support for mt8186 with mt6366 and max98357a. Signed-off-by: Allen-KH Cheng Link: https://lore.kernel.org/r/20221228115756.28014-1-allen-kh.cheng@mediatek.com Signed-off-by: Mark Brown commit 2d3dd559751ce19ba84f9690c6c7c5a4b39129df Author: tongjian Date: Wed Dec 28 20:22:30 2022 +0800 ASoC: dt-bindings: mt8186-mt6366: add new compatible for max98360a Adds new compatible string "mt8186-mt6366-rt5682s-max98360-sound" for machines with max98360a and rt5682s. Signed-off-by: tongjian Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221228122230.3818533-3-tongjian@huaqin.corp-partner.google.com Signed-off-by: Mark Brown commit 6e1dbf694d7cd1737ee14866e9e05016ccc9ac40 Author: tongjian Date: Wed Dec 28 20:22:29 2022 +0800 ASoC: mediatek: mt8186: support rt5682s_max98360 Add support for using the rt5682s codec together with max98360a on MT8186-MT6366-RT1019-RT5682S machines. Signed-off-by: tongjian Link: https://lore.kernel.org/r/20221228122230.3818533-2-tongjian@huaqin.corp-partner.google.com Signed-off-by: Mark Brown commit 56c5dab20a6391604df9521f812c01d1e3fe1bd0 Author: Jiri Slaby (SUSE) Date: Mon Dec 12 13:04:11 2022 +0100 RDMA/srp: Move large values to a new enum for gcc13 Since gcc13, each member of an enum has the same type as the enum [1]. And that is inherited from its members. Provided these two: SRP_TAG_NO_REQ = ~0U, SRP_TAG_TSK_MGMT = 1U << 31 all other members are unsigned ints. Esp. with SRP_MAX_SGE and SRP_TSK_MGMT_SQ_SIZE and their use in min(), this results in the following warnings: include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast drivers/infiniband/ulp/srp/ib_srp.c:563:42: note: in expansion of macro 'min' include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast drivers/infiniband/ulp/srp/ib_srp.c:2369:27: note: in expansion of macro 'min' So move the large values away to a separate enum, so that they don't affect other members. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 Link: https://lore.kernel.org/r/20221212120411.13750-1-jirislaby@kernel.org Signed-off-by: Jiri Slaby (SUSE) Reviewed-by: Bart Van Assche Signed-off-by: Leon Romanovsky commit da8daff9405e55baa1f797b77a7c629a89f4d764 Author: Bhaskar Chowdhury Date: Sat Dec 17 11:21:48 2022 +0530 kconfig: Add static text for search information in help menu Add few static text to explain how one can bring up the search dialog box by pressing the forward slash key anywhere on this interface. Signed-off-by: Bhaskar Chowdhury Acked-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit 5626af8fc4322a972b59c7b1a6760767f7b58d4f Author: Arnd Bergmann Date: Thu Dec 15 17:38:10 2022 +0100 pinctrl: sp7021: fix unused function warning sppctl_gpio_inv_get is only used from the debugfs code inside of an #ifdef, so we get a warning without that: drivers/pinctrl/sunplus/sppctl.c:393:12: error: 'sppctl_gpio_inv_get' defined but not used [-Werror=unused-function] 393 | static int sppctl_gpio_inv_get(struct gpio_chip *chip, unsigned int offset) | ^~~~~~~~~~~~~~~~~~~ Replace the #ifdef with an IS_ENABLED() check that avoids the warning. Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20221215163822.542622-1-arnd@kernel.org Signed-off-by: Linus Walleij commit 45435d8da71f9f3e6860e6e6ea9667b6ec17ec64 Author: Kees Cook Date: Fri Dec 23 10:28:44 2022 -0800 bpf: Always use maximal size for copy_array() Instead of counting on prior allocations to have sized allocations to the next kmalloc bucket size, always perform a krealloc that is at least ksize(dst) in size (which is a no-op), so the size can be correctly tracked by all the various allocation size trackers (KASAN, __alloc_size, etc). Reported-by: Hyunwoo Kim Link: https://lore.kernel.org/bpf/20221223094551.GA1439509@ubuntu Fixes: ceb35b666d42 ("bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage") Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: John Fastabend Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Song Liu Cc: Yonghong Song Cc: KP Singh Cc: Stanislav Fomichev Cc: Hao Luo Cc: Jiri Olsa Cc: bpf@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221223182836.never.866-kees@kernel.org Signed-off-by: Alexei Starovoitov commit f90dd663c492124b53bb28db6ff85b50c80ccc32 Merge: 8f161ca1105a6 b7793c8db7d9b Author: Alexei Starovoitov Date: Wed Dec 28 14:11:48 2022 -0800 Merge branch 'bpf: fix the crash caused by task iterators over vma' Kui-Feng Lee says: ==================== This issue is related to task iterators over vma. A system crash can occur when a task iterator travels through vma of tasks as the death of a task will clear the pointer to its mm, even though the task_struct is still held. As a result, an unexpected crash happens due to a null pointer. To address this problem, a reference to mm is kept on the iterator to make sure that the pointer is always valid. This patch set provides a solution for this crash by properly referencing mm on task iterators over vma. The major changes from v1 are: - Fix commit logs of the test case. - Use reverse Christmas tree coding style. - Remove unnecessary error handling for time(). v1: https://lore.kernel.org/bpf/20221216015912.991616-1-kuifeng@meta.com/ ==================== Signed-off-by: Alexei Starovoitov commit b7793c8db7d9beb903bb42f52872b5b46abdcb88 Author: Kui-Feng Lee Date: Fri Dec 16 14:18:55 2022 -0800 selftests/bpf: add a test for iter/task_vma for short-lived processes When a task iterator traverses vma(s), it is possible task->mm might become invalid in the middle of traversal and this may cause kernel misbehave (e.g., crash) This test case creates iterators repeatedly and forks short-lived processes in the background to detect this bug. The test will last for 3 seconds to get the chance to trigger the issue. Signed-off-by: Kui-Feng Lee Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20221216221855.4122288-3-kuifeng@meta.com Signed-off-by: Alexei Starovoitov commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 Author: Kui-Feng Lee Date: Fri Dec 16 14:18:54 2022 -0800 bpf: keep a reference to the mm, in case the task is dead. Fix the system crash that happens when a task iterator travel through vma of tasks. In task iterators, we used to access mm by following the pointer on the task_struct; however, the death of a task will clear the pointer, even though we still hold the task_struct. That can cause an unexpected crash for a null pointer when an iterator is visiting a task that dies during the visit. Keeping a reference of mm on the iterator ensures we always have a valid pointer to mm. Co-developed-by: Song Liu Signed-off-by: Song Liu Signed-off-by: Kui-Feng Lee Reported-by: Nathan Slingerland Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com Signed-off-by: Alexei Starovoitov commit 8f161ca1105a6af6614333f13aa7be4aab8b633a Author: Alexei Starovoitov Date: Wed Dec 28 13:55:57 2022 -0800 selftests/bpf: Temporarily disable part of btf_dump:var_data test. Commit 7443b296e699 ("x86/percpu: Move cpu_number next to current_task") moved global per_cpu variable 'cpu_number' into pcpu_hot structure. Therefore this part of var_data test is no longer valid. Disable it until better solution is found. Signed-off-by: Alexei Starovoitov commit 9ed1d9aeef5842ecacb660fce933613b58af1e00 Author: Chuang Wang Date: Sat Dec 24 21:31:46 2022 +0800 bpf: Fix panic due to wrong pageattr of im->image In the scenario where livepatch and kretfunc coexist, the pageattr of im->image is rox after arch_prepare_bpf_trampoline in bpf_trampoline_update, and then modify_fentry or register_fentry returns -EAGAIN from bpf_tramp_ftrace_ops_func, the BPF_TRAMP_F_ORIG_STACK flag will be configured, and arch_prepare_bpf_trampoline will be re-executed. At this time, because the pageattr of im->image is rox, arch_prepare_bpf_trampoline will read and write im->image, which causes a fault. as follows: insmod livepatch-sample.ko # samples/livepatch/livepatch-sample.c bpftrace -e 'kretfunc:cmdline_proc_show {}' BUG: unable to handle page fault for address: ffffffffa0206000 PGD 322d067 P4D 322d067 PUD 322e063 PMD 1297e067 PTE d428061 Oops: 0003 [#1] PREEMPT SMP PTI CPU: 2 PID: 270 Comm: bpftrace Tainted: G E K 6.1.0 #5 RIP: 0010:arch_prepare_bpf_trampoline+0xed/0x8c0 RSP: 0018:ffffc90001083ad8 EFLAGS: 00010202 RAX: ffffffffa0206000 RBX: 0000000000000020 RCX: 0000000000000000 RDX: ffffffffa0206001 RSI: ffffffffa0206000 RDI: 0000000000000030 RBP: ffffc90001083b70 R08: 0000000000000066 R09: ffff88800f51b400 R10: 000000002e72c6e5 R11: 00000000d0a15080 R12: ffff8880110a68c8 R13: 0000000000000000 R14: ffff88800f51b400 R15: ffffffff814fec10 FS: 00007f87bc0dc780(0000) GS:ffff88803e600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffa0206000 CR3: 0000000010b70000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_trampoline_update+0x25a/0x6b0 __bpf_trampoline_link_prog+0x101/0x240 bpf_trampoline_link_prog+0x2d/0x50 bpf_tracing_prog_attach+0x24c/0x530 bpf_raw_tp_link_attach+0x73/0x1d0 __sys_bpf+0x100e/0x2570 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x5b/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd With this patch, when modify_fentry or register_fentry returns -EAGAIN from bpf_tramp_ftrace_ops_func, the pageattr of im->image will be reset to nx+rw. Cc: stable@vger.kernel.org Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)") Signed-off-by: Chuang Wang Acked-by: Jiri Olsa Acked-by: Song Liu Link: https://lore.kernel.org/r/20221224133146.780578-1-nashuiliang@gmail.com Signed-off-by: Alexei Starovoitov commit 4d1c1379d71777ddeda3e54f8fc26e9ecbfd1009 Author: Eli Cohen Date: Thu Dec 15 14:28:34 2022 +0200 net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 ("net/mlx5: Lag, avoid lockdep warnings") accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an already destroyed work queue. Fix by restoring the call cancel_delayed_work_sync() before destroying the workqueue. This prevents call trace such as this: [ 329.230417] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 329.231444] #PF: supervisor write access in kernel mode [ 329.232233] #PF: error_code(0x0002) - not-present page [ 329.233007] PGD 0 P4D 0 [ 329.233476] Oops: 0002 [#1] SMP [ 329.234012] CPU: 5 PID: 145 Comm: kworker/u20:4 Tainted: G OE 6.0.0-rc5_mlnx #1 [ 329.235282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 329.236868] Workqueue: mlx5_cmd_0000:08:00.1 cmd_work_handler [mlx5_core] [ 329.237886] RIP: 0010:_raw_spin_lock+0xc/0x20 [ 329.238585] Code: f0 0f b1 17 75 02 f3 c3 89 c6 e9 6f 3c 5f ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 31 c0 ba 01 00 00 00 0f b1 17 75 02 f3 c3 89 c6 e9 45 3c 5f ff 0f 1f 44 00 00 0f 1f [ 329.241156] RSP: 0018:ffffc900001b0e98 EFLAGS: 00010046 [ 329.241940] RAX: 0000000000000000 RBX: ffffffff82374ae0 RCX: 0000000000000000 [ 329.242954] RDX: 0000000000000001 RSI: 0000000000000014 RDI: 0000000000000000 [ 329.243974] RBP: ffff888106ccf000 R08: ffff8881004000c8 R09: ffff888100400000 [ 329.244990] R10: 0000000000000000 R11: ffffffff826669f8 R12: 0000000000002000 [ 329.246009] R13: 0000000000000005 R14: ffff888100aa7ce0 R15: ffff88852ca80000 [ 329.247030] FS: 0000000000000000(0000) GS:ffff88852ca80000(0000) knlGS:0000000000000000 [ 329.248260] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 329.249111] CR2: 0000000000000000 CR3: 000000016d675001 CR4: 0000000000770ee0 [ 329.250133] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 329.251152] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 329.252176] PKRU: 55555554 Fixes: 0d4e8ed139d8 ("net/mlx5: Lag, avoid lockdep warnings") Signed-off-by: Eli Cohen Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit e54638a8380bd9c146a883035fffd0a821813682 Author: Maor Dickman Date: Sun Aug 1 14:45:17 2021 +0300 net/mlx5e: Set geneve_tlv_option_0_exist when matching on geneve option The cited patch added support of matching on geneve option by setting geneve_tlv_option_0_data mask and key but didn't set geneve_tlv_option_0_exist bit which is required on some HWs when matching geneve_tlv_option_0_data parameter, this may cause in some cases for packets to wrongly match on rules with different geneve option. Example of such case is packet with geneve_tlv_object class=789 and data=456 will wrongly match on rule with match geneve_tlv_object class=123 and data=456. Fix it by setting geneve_tlv_option_0_exist bit when supported by the HW when matching on geneve_tlv_option_0_data parameter. Fixes: 9272e3df3023 ("net/mlx5e: Geneve, Add support for encap/decap flows offload") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 1e267ab88dc44c48f556218f7b7f14c76f7aa066 Author: Adham Faris Date: Wed Dec 14 16:02:57 2022 +0200 net/mlx5e: Fix hw mtu initializing at XDP SQ allocation Current xdp xmit functions logic (mlx5e_xmit_xdp_frame_mpwqe or mlx5e_xmit_xdp_frame), validates xdp packet length by comparing it to hw mtu (configured at xdp sq allocation) before xmiting it. This check does not account for ethernet fcs length (calculated and filled by the nic). Hence, when we try sending packets with length > (hw-mtu - ethernet-fcs-size), the device port drops it and tx_errors_phy is incremented. Desired behavior is to catch these packets and drop them by the driver. Fix this behavior in XDP SQ allocation function (mlx5e_alloc_xdpsq) by subtracting ethernet FCS header size (4 Bytes) from current hw mtu value, since ethernet FCS is calculated and written to ethernet frames by the nic. Fixes: d8bec2b29a82 ("net/mlx5e: Support bpf_xdp_adjust_head()") Signed-off-by: Adham Faris Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 2951b2e142ecf6e0115df785ba91e91b6da74602 Author: Chris Mi Date: Mon Dec 5 09:22:50 2022 +0800 net/mlx5e: Always clear dest encap in neigh-update-del The cited commit introduced a bug for multiple encapsulations flow. If one dest encap becomes invalid, the flow is set slow path flag. But when other dests encap become invalid, they are not cleared due to slow path flag of the flow. When neigh-update-add is running, it will use invalid encap. Fix it by checking slow path flag after clearing dest encap. Fixes: 9a5f9cc794e1 ("net/mlx5e: Fix possible use-after-free deleting fdb rule") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 849190e3e4ccf452fbe2240eace30a9ca83fb8d2 Author: Chris Mi Date: Mon Nov 28 13:54:29 2022 +0800 net/mlx5e: CT: Fix ct debugfs folder name Need to use sprintf to build a string instead of sscanf. Otherwise dirname is null and both "ct_nic" and "ct_fdb" won't be created. But its redundant anyway as driver could be in switchdev mode but still add nic rules. So use "ct" as folder name. Fixes: 77422a8f6f61 ("net/mlx5e: CT: Add ct driver counters") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit f8c18a5749cf917096f75dd59885b7a0fe9298ba Author: Tariq Toukan Date: Sun Nov 27 09:21:28 2022 +0200 net/mlx5e: Fix RX reporter for XSK RQs RX reporter mistakenly reads from the regular (inactive) RQ when XSK RQ is active. Fix it here. Fixes: 3db4c85cde7a ("net/mlx5e: xsk: Use queue indices starting from 0 for XSK queues") Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit b12d581e83e3ae1080c32ab83f123005bd89a840 Author: Dragos Tatulea Date: Mon Nov 28 15:24:21 2022 +0200 net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default mlx5e_build_nic_params will turn CQE compression on if the hardware capability is enabled and the slow_pci_heuristic condition is detected. As IPoIB doesn't support CQE compression, make sure to disable the feature in the IPoIB profile init. Please note that the feature is not exposed to the user for IPoIB interfaces, so it can't be subsequently turned on. Fixes: b797a684b0dd ("net/mlx5e: Enable CQE compression when PCI is slower than link") Signed-off-by: Dragos Tatulea Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit c4ad5f2bdad56265b23d3635494ecdb205431807 Author: Shay Drory Date: Wed Nov 9 14:42:59 2022 +0200 net/mlx5: Fix RoCE setting at HCA level mlx5 PF can disable RoCE for its VFs and SFs. In such case RoCE is marked as unsupported on those VFs/SFs. The cited patch added an option for disable (and enable) RoCE at HCA level. However, that commit didn't check whether RoCE is supported on the HCA and enabled user to try and set RoCE to on. Fix it by checking whether the HCA supports RoCE. Fixes: fbfa97b4d79f ("net/mlx5: Disable roce at HCA level") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 9078e843efec530f279a155f262793c58b0746bd Author: Shay Drory Date: Thu Nov 24 13:34:12 2022 +0200 net/mlx5: Avoid recovery in probe flows Currently, recovery is done without considering whether the device is still in probe flow. This may lead to recovery before device have finished probed successfully. e.g.: while mlx5_init_one() is running. Recovery flow is using functionality that is loaded only by mlx5_init_one(), and there is no point in running recovery without mlx5_init_one() finished successfully. Fix it by waiting for probe flow to finish and checking whether the device is probed before trying to perform recovery. Fixes: 51d138c2610a ("net/mlx5: Fix health error state handling") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 44aee8ea15ac205490a41b00cbafcccbf9f7f82b Author: Shay Drory Date: Sun Dec 18 12:42:14 2022 +0200 net/mlx5: Fix io_eq_size and event_eq_size params validation io_eq_size and event_eq_size params are of param type DEVLINK_PARAM_TYPE_U32. But, the validation callback is addressing them as DEVLINK_PARAM_TYPE_U16. This cause mismatch in validation in big-endian systems, in which values in range were rejected while 268500991 was accepted. Fix it by checking the U32 value in the validation callback. Fixes: 0844fa5f7b89 ("net/mlx5: Let user configure io_eq_size param") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 2a35b2c2e6a252eda2134aae6a756861d9299531 Author: Jiri Pirko Date: Tue Oct 18 12:51:52 2022 +0200 net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path There are two cleanup calls missing in mlx5_init_once() error path. Add them making the error path flow to be the same as mlx5_cleanup_once(). Fixes: 52ec462eca9b ("net/mlx5: Add reserved-gids support") Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section") Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit 1f0ae22ab470946143485a02cc1cd7e05c0f9120 Author: Moshe Shemesh Date: Mon Dec 12 10:42:15 2022 +0200 net/mlx5: E-Switch, properly handle ingress tagged packets on VST Fix SRIOV VST mode behavior to insert cvlan when a guest tag is already present in the frame. Previous VST mode behavior was to drop packets or override existing tag, depending on the device version. In this patch we fix this behavior by correctly building the HW steering rule with a push vlan action, or for older devices we ask the FW to stack the vlan when a vlan is already present. Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes") Fixes: dfcb1ed3c331 ("net/mlx5: E-Switch, Vport ingress/egress ACLs rules for VST mode") Signed-off-by: Moshe Shemesh Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 6c82b94d583a116faf99858379ee34844df963a1 Author: Ulf Hansson Date: Tue Nov 22 13:37:13 2022 +0100 Revert "arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state" Due to recent improvements of the cluster idle state support for Qcom based platforms, we are now able to support the deepest cluster idle state. Let's therefore revert the earlier workaround. This reverts commit cadaa773bcf1 ("arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state"), which is available from v6.1-rc6. Signed-off-by: Ulf Hansson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221122123713.65631-1-ulf.hansson@linaro.org commit bffb7d9d1a3dbd09e083b88aefd093b3b10abbfb Author: Andreas Kemnade Date: Sat Dec 17 23:13:05 2022 +0100 iio:adc:twl6030: Enable measurement of VAC VAC needs to be wired up to produce proper measurements, without this change only near zero values are reported. Reported-by: kernel test robot Reported-by: Julia Lawall Fixes: 1696f36482e7 ("iio: twl6030-gpadc: TWL6030, TWL6032 GPADC driver") Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20221217221305.671117-1-andreas@kemnade.info Signed-off-by: Jonathan Cameron commit 9d61c1820598a5ea474576ed55318a6dadee37ed Author: Carlos Song Date: Thu Dec 8 15:19:09 2022 +0800 iio: imu: fxos8700: fix ACCEL measurement range selection When device is in active mode, it fails to set an ACCEL full-scale range(2g/4g/8g) in FXOS8700_XYZ_DATA_CFG. This is not align with the datasheet, but it is a fxos8700 chip behavior. Keep the device in standby mode before setting ACCEL full-scale range into FXOS8700_XYZ_DATA_CFG in chip initialization phase and setting scale phase. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20221208071911.2405922-6-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit a53f945879c0cb9de3a4c05a665f5157884b5208 Author: Carlos Song Date: Thu Dec 8 15:19:08 2022 +0800 iio: imu: fxos8700: fix IMU data bits returned to user space ACCEL output data registers contain the X-axis, Y-axis, and Z-axis 14-bit left-justified sample data and MAGN output data registers contain the X-axis, Y-axis, and Z-axis 16-bit sample data. The ACCEL raw register output data should be divided by 4 before sent to userspace. Apply a 2 bits signed right shift to the raw data from ACCEL output data register but keep that from MAGN sensor as the origin. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20221208071911.2405922-5-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 37a94d86d7050665d6d01378b2c916c28e454f10 Author: Carlos Song Date: Thu Dec 8 15:19:07 2022 +0800 iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback The length of ACCEL and MAGN 3-axis channels output data is 6 byte individually. However block only read 3 bytes data into buffer from ACCEL or MAGN output data registers every time. It causes an incomplete ACCEL and MAGN channels readback. Set correct value count for regmap_bulk_read to get 6 bytes ACCEL and MAGN channels readback. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20221208071911.2405922-4-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit c68b44bc7d9b1469774a1c985ee71d2cbc5ebef5 Author: Carlos Song Date: Thu Dec 8 15:19:06 2022 +0800 iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback Because ACCEL and MAGN channels data register base address is swapped the accelerometer and magnetometer channels readback is swapped. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20221208071911.2405922-3-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 429e1e8ec696e0e7a0742904e3dc2f83b7b23dfb Author: Carlos Song Date: Thu Dec 8 15:19:05 2022 +0800 iio: imu: fxos8700: fix map label of channel type to MAGN sensor FXOS8700 is an IMU sensor with ACCEL sensor and MAGN sensor. Sensor type is indexed by corresponding channel type in a switch. IIO_ANGL_VEL channel type mapped to MAGN sensor has caused confusion. Fix the mapping label of "IIO_MAGN" channel type instead of "IIO_ANGL_VEL" channel type to MAGN sensor. Fixes: 84e5ddd5c46e ("iio: imu: Add support for the FXOS8700 IMU") Signed-off-by: Carlos Song Link: https://lore.kernel.org/r/20221208071911.2405922-2-carlos.song@nxp.com Cc: Signed-off-by: Jonathan Cameron commit f804bd0dc28683a93a60f271aaefb2fc5b0853dd Author: Andreas Kemnade Date: Thu Dec 1 19:16:35 2022 +0100 iio:adc:twl6030: Enable measurements of VUSB, VBAT and others Some inputs need to be wired up to produce proper measurements, without this change only near zero values are reported. Signed-off-by: Andreas Kemnade Fixes: 1696f36482e70 ("iio: twl6030-gpadc: TWL6030, TWL6032 GPADC driver") Link: https://lore.kernel.org/r/20221201181635.3522962-1-andreas@kemnade.info Cc: Signed-off-by: Jonathan Cameron commit 0fc3562a993c3dc41d1177b3983d9300d0db1d4d Author: Frank Li Date: Thu Dec 1 09:01:10 2022 -0500 iio: imx8qxp-adc: fix irq flood when call imx8qxp_adc_read_raw() irq flood happen when run cat /sys/bus/iio/devices/iio:device0/in_voltage1_raw imx8qxp_adc_read_raw() { ... enable irq /* adc start */ writel(1, adc->regs + IMX8QXP_ADR_ADC_SWTRIG); ^^^^ trigger irq flood. wait_for_completion_interruptible_timeout(); readl(adc->regs + IMX8QXP_ADR_ADC_RESFIFO); ^^^^ clear irq here. ... } There is only FIFO watermark interrupt at this ADC controller. IRQ line will be assert until software read data from FIFO. So IRQ flood happen during wait_for_completion_interruptible_timeout(). Move FIFO read into irq handle to avoid irq flood. Fixes: 1e23dcaa1a9f ("iio: imx8qxp-adc: Add driver support for NXP IMX8QXP ADC") Cc: stable@vger.kernel.org Signed-off-by: Frank Li Reviewed-by: Cai Huoqing Reviewed-by: Haibo Chen Link: https://lore.kernel.org/r/20221201140110.2653501-1-Frank.Li@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 6794ed0cfcc6ce737240eccc48b3e8190df36703 Author: Marco Pagani Date: Fri Nov 25 12:31:12 2022 +0100 iio: adc: xilinx-ams: fix devm_krealloc() return value check The clang-analyzer reported a warning: "Value stored to 'ret' is never read". Fix the return value check if devm_krealloc() fails to resize ams_channels. Fixes: d5c70627a794 ("iio: adc: Add Xilinx AMS driver") Signed-off-by: Marco Pagani Acked-by: Michal Simek Link: https://lore.kernel.org/r/20221125113112.219290-1-marpagan@redhat.com Cc: Signed-off-by: Jonathan Cameron commit cbd3a0153cd18a2cbef6bf3cf31bb406c3fc9f55 Author: Xiongfeng Wang Date: Tue Nov 29 10:03:16 2022 +0800 iio: adc: berlin2-adc: Add missing of_node_put() in error path of_get_parent() will return a device_node pointer with refcount incremented. We need to use of_node_put() on it when done. Add the missing of_node_put() in the error path of berlin2_adc_probe(); Fixes: 70f1937911ca ("iio: adc: add support for Berlin") Signed-off-by: Xiongfeng Wang Link: https://lore.kernel.org/r/20221129020316.191731-1-wangxiongfeng2@huawei.com Cc: Signed-off-by: Jonathan Cameron commit cc3304052a89ab6ac887ed9224420a27e3d354e1 Author: Olivier Moysan Date: Fri Dec 2 16:28:48 2022 +0100 iio: adc: stm32-dfsdm: fill module aliases When STM32 DFSDM driver is built as module, no modalias information is available. This prevents module to be loaded by udev. Add MODULE_DEVICE_TABLE() to fill module aliases. Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20221202152848.45585-1-olivier.moysan@foss.st.com Signed-off-by: Jonathan Cameron commit 0154252a3b87f77db1e44516d1ed2e82e2d29c30 Author: Krzysztof Kozlowski Date: Sun Dec 4 09:46:14 2022 +0100 ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI While changing node names of APQ8084 SDHCI, the ones in IFC6540 board were not updated leading to disabled and misconfigured SDHCI. Cc: Fixes: 2477d81901a2 ("ARM: dts: qcom: Fix sdhci node names - use 'mmc@'") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204084614.12193-1-krzysztof.kozlowski@linaro.org commit 76807fcd73b818eb9f245ef1035aed34ecdd9813 Author: Sagi Grimberg Date: Sun Dec 25 13:28:51 2022 +0200 nvme-auth: fix smatch warning complaints When initializing auth context, there may be no secrets passed by the user. Make return code explicit when returning successfully. smatch warnings: drivers/nvme/host/auth.c:950 nvme_auth_init_ctrl() warn: missing error code? 'ret' Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 6f99ac04c469b5d0a180a4ccea99d25d5dc9d21c Author: Christoph Hellwig Date: Tue Dec 13 16:13:38 2022 +0100 nvme: consult the CSE log page for unprivileged passthrough Commands like Write Zeros can change the contents of a namespaces without actually transferring data. To protect against this, check the Commands Supported and Effects log is supported by the controller for any unprivileg command passthrough and refuse unprivileged passthrough if the command has any effects that can change data or metadata. Note: While the Commands Support and Effects log page has only been mandatory since NVMe 2.0, it is widely supported because Windows requires it for any command passthrough from userspace. Fixes: e4fbcf32c860 ("nvme: identify-namespace without CAP_SYS_ADMIN") Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi commit 831ed60c2aca2d7c517b2da22897a90224a97d27 Author: Christoph Hellwig Date: Wed Dec 21 10:12:17 2022 +0100 nvme: also return I/O command effects from nvme_command_effects To be able to use the Commands Supported and Effects Log for allowing unprivileged passtrough, it needs to be corretly reported for I/O commands as well. Return the I/O command effects from nvme_command_effects, and also add a default list of effects for the NVM command set. For other command sets, the Commands Supported and Effects log is required to be present already. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Kanchan Joshi commit 2a459f6933e1c459bffb7cc73fd6c900edc714bd Author: Christoph Hellwig Date: Wed Dec 21 09:51:19 2022 +0100 nvmet: don't defer passthrough commands with trivial effects to the workqueue Mask out the "Command Supported" and "Logical Block Content Change" bits and only defer execution of commands that have non-trivial effects to the workqueue for synchronous execution. This allows to execute admin commands asynchronously on controllers that provide a Command Supported and Effects log page, and will keep allowing to execute Write commands asynchronously once command effects on I/O commands are taken into account. Fixes: c1fef73f793b ("nvmet: add passthru code to process commands") Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi commit f2d1421391bba0b15684d2379a47a089f0e561d0 Author: Christoph Hellwig Date: Mon Dec 12 15:20:56 2022 +0100 nvmet: set the LBCC bit for commands that modify data Write, Write Zeroes, Zone append and a Zone Reset through Zone Management Send modify the logical block content of a namespace, so make sure the LBCC bit is reported for them. Fixes: b5d0b38c0475 ("nvmet: add Command Set Identifier support") Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni commit 61f37154c599cf9f2f84dcbd9be842f8645a7099 Author: Christoph Hellwig Date: Mon Dec 12 15:20:04 2022 +0100 nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it Use NVME_CMD_EFFECTS_CSUPP instead of open coding it and assign a single value to multiple array entries instead of repeated assignments. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni commit 685e6311637e46f3212439ce2789f8a300e5050f Author: Christoph Hellwig Date: Wed Dec 21 10:30:45 2022 +0100 nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition 3 << 16 does not generate the correct mask for bits 16, 17 and 18. Use the GENMASK macro to generate the correct mask instead. Fixes: 84fef62d135b ("nvme: check admin passthru command effects") Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi commit 8ca4fc323d2e4ab9dabbdd57633af40b0c7e6af9 Author: Christoph Hellwig Date: Mon Dec 12 11:09:55 2022 +0100 docs, nvme: add a feature and quirk policy document This adds a document about what specification features are supported by the Linux NVMe driver, and what qualifies for a quirk if an implementation has problems following the specification. Signed-off-by: Jens Axboe Signed-off-by: Keith Busch Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Reviewed-by: Randy Dunlap Acked-by: Jonathan Corbet commit 090ddad4c7a9fefd647c762093a555870a19c8b2 Author: Takashi Iwai Date: Wed Dec 28 13:57:14 2022 +0100 ALSA: hda/hdmi: Static PCM mapping again with AMD HDMI codecs The recent code refactoring for HD-audio HDMI codec driver caused a regression on AMD/ATI HDMI codecs; namely, PulseAudioand pipewire don't recognize HDMI outputs any longer while the direct output via ALSA raw access still works. The problem turned out that, after the code refactoring, the driver assumes only the dynamic PCM assignment, and when a PCM stream that still isn't assigned to any pin gets opened, the driver tries to assign any free converter to the PCM stream. This behavior is OK for Intel and other codecs, as they have arbitrary connections between pins and converters. OTOH, on AMD chips that have a 1:1 mapping between pins and converters, this may end up with blocking the open of the next PCM stream for the pin that is tied with the formerly taken converter. Also, with the code refactoring, more PCM streams are exposed than necessary as we assume all converters can be used, while this isn't true for AMD case. This may change the PCM stream assignment and confuse users as well. This patch fixes those problems by: - Introducing a flag spec->static_pcm_mapping, and if it's set, the driver applies the static mapping between pins and converters at the probe time - Limiting the number of PCM streams per pins, too; this avoids the superfluous PCM streams Fixes: ef6f5494faf6 ("ALSA: hda/hdmi: Use only dynamic PCM device allocation") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=216836 Co-developed-by: Jaroslav Kysela Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20221228125714.16329-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a5496886eb130ea08b1a5cd5c284543909bde749 Merge: 1b929c02afd37 129c48cde6c9e Author: Paolo Bonzini Date: Wed Dec 28 06:26:36 2022 -0500 Merge branch 'kvm-late-6.1-fixes' into HEAD x86: * several fixes to nested VMX execution controls * fixes and clarification to the documentation for Xen emulation * do not unnecessarily release a pmu event with zero period * MMU fixes * fix Coverity warning in kvm_hv_flush_tlb() selftests: * fixes for the ucall mechanism in selftests * other fixes mostly related to compilation with clang commit 129c48cde6c9e519d033305649665427c6cac494 Author: Paolo Bonzini Date: Wed Nov 30 13:11:47 2022 -0500 KVM: selftests: restore special vmmcall code layout needed by the harness Commit 8fda37cf3d41 ("KVM: selftests: Stuff RAX/RCX with 'safe' values in vmmcall()/vmcall()", 2022-11-21) broke the svm_nested_soft_inject_test because it placed a "pop rbp" instruction after vmmcall. While this is correct and mimics what is done in the VMX case, this particular test expects a ud2 instruction right after the vmmcall, so that it can skip over it in the L1 part of the test. Inline a suitably-modified version of vmmcall() to restore the functionality of the test. Fixes: 8fda37cf3d41 ("KVM: selftests: Stuff RAX/RCX with 'safe' values in vmmcall()/vmcall()" Cc: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini Reviewed-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Reviewed-by: Maxim Levitsky Message-Id: <20221130181147.9911-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 40cab44b9089a41f71bbd0eff753eb91d5dafd68 Author: Pedro Tammela Date: Tue Dec 27 11:04:59 2022 -0300 net/sched: fix retpoline wrapper compilation on configs without tc filters Rudi reports a compilation failure on x86_64 when CONFIG_NET_CLS or CONFIG_NET_CLS_ACT is not set but CONFIG_RETPOLINE is set. A misplaced '#endif' was causing the issue. Fixes: 7f0e810220e2 ("net/sched: add retpoline wrapper for tc") Tested-by: Rudi Heitbaum Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit c2052189f19bd98c80b5d46dc6e42330d2b3b35d Author: Xuezhi Zhang Date: Tue Dec 27 19:03:52 2022 +0800 s390/qeth: convert sysfs snprintf to sysfs_emit Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: Xuezhi Zhang Signed-off-by: David S. Miller commit 0e3d18359ac117f2285c41bdf791cdc76b0fb0bb Merge: e71460d4468fb bb41c13c05c23 Author: David S. Miller Date: Wed Dec 28 11:58:08 2022 +0000 Merge branch 'r8169-fixes' Chunhao Lin says: ==================== r8169: fix dmar pte write access is not set error This series fixes dmar pte write access is not set error. Chunhao Lin (2): r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() r8169: fix dmar pte write access is not set error v2: -update commit message -adjust the code according to current kernel code v3: -update title and commit message -split the patch ==================== Signed-off-by: David S. Miller commit bb41c13c05c23d9bc46b4e37d8914078c6a40e3a Author: Chunhao Lin Date: Mon Dec 26 20:31:53 2022 +0800 r8169: fix dmar pte write access is not set error When close device, if wol is enabled, rx will be enabled. When open device it will cause rx packet to be dma to the wrong memory address after pci_set_master() and system log will show blow messages. DMAR: DRHD: handling fault status reg 3 DMAR: [DMA Write] Request device [02:00.0] PASID ffffffff fault addr ffdd4000 [fault reason 05] PTE Write access is not set In this patch, driver disable tx/rx when close device. If wol is enabled, only enable rx filter and disable rxdv_gate(if support) to let hardware only receive packet to fifo but not to dma it. Signed-off-by: Chunhao Lin Reviewed-by: Heiner Kallweit Signed-off-by: David S. Miller commit ad425666a1f05d9b215a84cf010c3789b2ea8206 Author: Chunhao Lin Date: Mon Dec 26 20:31:52 2022 +0800 r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() There is no functional change. Moving these two functions for following patch "r8169: fix dmar pte write access is not set error". Signed-off-by: Chunhao Lin Reviewed-by: Heiner Kallweit Signed-off-by: David S. Miller commit e71460d4468fbd923b07056d7d18fd85f29c6ae2 Merge: 8ac718cc0e36e 201ed315f9676 Author: David S. Miller Date: Wed Dec 28 11:55:24 2022 +0000 Merge branch 'ethtool_gert_phy_stats-fixes' Daniil Tatianin says: ==================== net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers This series fixes a potential NULL dereference in ethtool_get_phy_stats while also attempting to refactor/split said function into multiple helpers so that it's easier to reason about what's going on. I've taken Andrew Lunn's suggestions on the previous version of this patch and added a bit of my own. Changes since v1: - Remove an extra newline in the first patch - Move WARN_ON_ONCE into the if check as it already returns the result of the comparison - Actually split ethtool_get_phy_stats instead of attempting to refactor it ==================== Signed-off-by: David S. Miller commit 201ed315f9676809cd5b20a39206e964106d4f27 Author: Daniil Tatianin Date: Mon Dec 26 14:48:25 2022 +0300 net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers So that it's easier to follow and make sense of the branching and various conditions. Stats retrieval has been split into two separate functions ethtool_get_phy_stats_phydev & ethtool_get_phy_stats_ethtool. The former attempts to retrieve the stats using phydev & phy_ops, while the latter uses ethtool_ops. Actual n_stats validation & array allocation has been moved into a new ethtool_vzalloc_stats_array helper. This also fixes a potential NULL dereference of ops->get_ethtool_phy_stats where it was getting called in an else branch unconditionally without making sure it was actually present. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Daniil Tatianin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit fd4778581d61d8848b532f8cdc9b325138748437 Author: Daniil Tatianin Date: Mon Dec 26 14:48:24 2022 +0300 net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats Now that we always early return if we don't have any stats we can remove these checks as they're no longer necessary. Signed-off-by: Daniil Tatianin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 9deb1e9fb88b1120a908676fa33bdf9e2eeaefce Author: Daniil Tatianin Date: Mon Dec 26 14:48:23 2022 +0300 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats It's not very useful to copy back an empty ethtool_stats struct and return 0 if we didn't actually have any stats. This also allows for further simplification of this function in the future commits. Signed-off-by: Daniil Tatianin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit f96a483f8e131de50ebf30589ffba1a4f6bd12f7 Author: Jie Hai Date: Sat Nov 26 14:49:38 2022 +0800 MAINTAINERS: update Jie Hai's email address Signed-off-by: Jie Hai Link: https://lore.kernel.org/r/20221126064938.50685-1-haijie1@huawei.com Signed-off-by: Vinod Koul commit efab25894a41a920d9581183741e7fadba00719c Author: Jayesh Choudhary Date: Mon Nov 28 14:20:05 2022 +0530 dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG PSIL_EP_NATIVE endpoints may not have PEER registers for BCNT and thus udma_decrement_byte_counters() should not try to decrement these counters. This fixes the issue of crypto IPERF testing where the client side (EVM) hangs without transfer of packets to the server side, seen since this function was added. Fixes: 7c94dcfa8fcf ("dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow") Signed-off-by: Jayesh Choudhary Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20221128085005.489964-1-j-choudhary@ti.com Signed-off-by: Vinod Koul commit 02d9a04da453984b16f4a585ad808cf961df495e Author: Paolo Bonzini Date: Wed Dec 28 06:00:22 2022 -0500 Documentation: kvm: clarify SRCU locking order Currently only the locking order of SRCU vs kvm->slots_arch_lock and kvm->slots_lock is documented. Extend this to kvm->lock since Xen emulation got it terribly wrong. Signed-off-by: Paolo Bonzini commit 6744a030d81e456883bfbb627ac1f30465c1a989 Author: Reinette Chatre Date: Wed Dec 7 14:52:22 2022 -0800 dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable On driver unload any pending descriptors are flushed and pending DMA descriptors are explicitly completed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs() -> idxd_dma_complete_txd() With this done during driver unload any remaining descriptor is likely stuck and can be dropped. Even so, the descriptor may still have a callback set that could no longer be accessible. An example of such a problem is when the dmatest fails and the dmatest module is unloaded. The failure of dmatest leaves descriptors with dma_async_tx_descriptor::callback pointing to code that no longer exist. This causes a page fault as below at the time the IDXD driver is unloaded when it attempts to run the callback: BUG: unable to handle page fault for address: ffffffffc0665190 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page Fix this by clearing the callback pointers on the transmit descriptors only when workqueue is disabled. Fixes: 403a2e236538 ("dmaengine: idxd: change MSIX allocation based on per wq activation") Signed-off-by: Reinette Chatre Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/37d06b772aa7f8863ca50f90930ea2fd80b38fc3.1670452419.git.reinette.chatre@intel.com Signed-off-by: Vinod Koul commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 Author: Reinette Chatre Date: Wed Dec 7 14:52:21 2022 -0800 dmaengine: idxd: Prevent use after free on completion memory On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device. Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations") Suggested-by: Dave Jiang Signed-off-by: Reinette Chatre Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.1670452419.git.reinette.chatre@intel.com Signed-off-by: Vinod Koul commit b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f Author: Reinette Chatre Date: Wed Dec 7 14:52:20 2022 -0800 dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling. Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove. Some examples of problematic flows: (a) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully. idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq(). (b) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0. idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref: BUG: kernel NULL pointer dereference, address: 0000000000000010 Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully. Fixes: 1f2bb40337f0 ("dmaengine: idxd: move wq_enable() to device.c") Signed-off-by: Reinette Chatre Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/e8d8116e5efa0fd14fadc5adae6ffd319f0e5ff1.1670452419.git.reinette.chatre@intel.com Signed-off-by: Vinod Koul commit a79b53aaaab53de017517bf9579b6106397a523c Author: Paolo Bonzini Date: Wed Dec 28 05:33:41 2022 -0500 KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET While KVM_XEN_EVTCHN_RESET is usually called with no vCPUs running, if that happened it could cause a deadlock. This is due to kvm_xen_eventfd_reset() doing a synchronize_srcu() inside a kvm->lock critical section. To avoid this, first collect all the evtchnfd objects in an array and free all of them once the kvm->lock critical section is over and th SRCU grace period has expired. Reported-by: Michal Luczaj Cc: David Woodhouse Signed-off-by: Paolo Bonzini commit a26116c1e74028914f281851488546c91cbae57d Author: Rafael Mendonca Date: Fri Oct 21 17:41:26 2022 -0300 virtio_blk: Fix signedness bug in virtblk_prep_rq() The virtblk_map_data() function returns negative error codes, however, the 'nents' field of vbr->sg_table is an unsigned int, which causes the error handling not to work correctly. Cc: stable@vger.kernel.org Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()") Signed-off-by: Rafael Mendonca Message-Id: <20221021204126.927603-1-rafaelmendsr@gmail.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Reviewed-by: Suwan Kim Reviewed-by: Stefan Hajnoczi Acked-by: Jason Wang commit 72455a1142527e607e1d69439f3ffa2ef6d09e26 Author: Cindy Lu Date: Wed Dec 14 13:43:06 2022 +0800 vdpa_sim_net: should not drop the multicast/broadcast packet In the receive_filter(), should not drop the packet with the broadcast/multicast address. Add the check for this Signed-off-by: Cindy Lu Message-Id: <20221214054306.24145-1-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 0b7a04a30eef20e6b24926a45c0ce7906ae85bd6 Author: Jason Wang Date: Tue Dec 13 17:07:17 2022 +0800 vdpasim: fix memory leak when freeing IOTLBs After commit bda324fd037a ("vdpasim: control virtqueue support"), vdpasim->iommu became an array of IOTLB, so we should clean the mappings of each free one by one instead of just deleting the ranges in the first IOTLB which may leak maps. Fixes: bda324fd037a ("vdpasim: control virtqueue support") Cc: Gautam Dawar Signed-off-by: Jason Wang Message-Id: <20221213090717.61529-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Gautam Dawar commit 1c96d5457f7251d1c62aacc04921557d56fc049a Author: Jason Wang Date: Wed Sep 7 14:01:10 2022 +0800 vdpa: conditionally fill max max queue pair for stats For the device without multiqueue feature, we will read 0 as max_virtqueue_pairs from the config. So if we fill VDPA_ATTR_DEV_NET_CFG_MAX_VQP with the value we read from the config we will confuse the user. Fixing this by only filling the value when multiqueue is offered by the device so userspace can assume 1 when the attr is not provided. Fixes: 13b00b135665c("vdpa: Add support for querying vendor statistics") Cc: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20220907060110.4511-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Eli Cohen commit ed843d6ed7310a27cf7c8ee0a82a482eed0cb4a6 Author: Rong Wang Date: Wed Dec 7 20:08:13 2022 +0800 vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove In vp_vdpa_remove(), the code kfree(&vp_vdpa_mgtdev->mgtdev.id_table) uses a reference of pointer as the argument of kfree, which is the wrong pointer and then may hit crash like this: Unable to handle kernel paging request at virtual address 00ffff003363e30c Internal error: Oops: 96000004 [#1] SMP Call trace: rb_next+0x20/0x5c ext4_readdir+0x494/0x5c4 [ext4] iterate_dir+0x168/0x1b4 __se_sys_getdents64+0x68/0x170 __arm64_sys_getdents64+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Code: 54000220 f9400441 b4000161 aa0103e0 (f9400821) SMP: stopping secondary CPUs Starting crashdump kernel... Fixes: ffbda8e9df10 ("vdpa/vp_vdpa : add vdpa tool support in vp_vdpa") Signed-off-by: Rong Wang Signed-off-by: Nanyong Sun Message-Id: <20221207120813.2837529-1-sunnanyong@huawei.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Cindy Lu Acked-by: Jason Wang commit 937c783aa3d8d77963ec91918d3298edb45b9161 Author: Harshit Mogalapalli Date: Mon Nov 28 07:57:15 2022 -0800 vduse: Validate vq_num in vduse_validate_config() Add a limit to 'config->vq_num' which is user controlled data which comes from an vduse_ioctl to prevent large memory allocations. Micheal says - This limit is somewhat arbitrary. However, currently virtio pci and ccw are limited to a 16 bit vq number. While MMIO isn't it is also isn't used with lots of VQs due to current lack of support for per-vq interrupts. Thus, the 0xffff limit on number of VQs corresponding to a 16-bit VQ number seems sufficient for now. This is found using static analysis with smatch. Suggested-by: Michael S. Tsirkin Signed-off-by: Harshit Mogalapalli Message-Id: <20221128155717.2579992-1-harshit.m.mogalapalli@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 81931012bd7dc52fadf2b720605fce8a7148d4a7 Author: Davidlohr Bueso Date: Sun Nov 27 19:43:47 2022 -0800 tools/virtio: remove smp_read_barrier_depends() This gets rid of the last references to smp_read_barrier_depends() which for the kernel side was removed in v5.9. The serialization required for Alpha is done inside READ_ONCE() instead of having users deal with it. Simply use a full barrier, the architecture does not have rmb in the first place. Signed-off-by: Davidlohr Bueso Message-Id: <20221128034347.990-3-dave@stgolabs.net> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 8aeac42d60936046a00e67cdf7d27b061df2962f Author: Davidlohr Bueso Date: Sun Nov 27 19:43:46 2022 -0800 tools/virtio: remove stray characters __read_once_size() is not a macro, remove those '/'s. Signed-off-by: Davidlohr Bueso Message-Id: <20221128034347.990-2-dave@stgolabs.net> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit e794070af224ade46db368271896b2685ff4f96b Author: Cindy Lu Date: Mon Dec 19 15:33:31 2022 +0800 vhost_vdpa: fix the crash in unmap a large memory While testing in vIOMMU, sometimes Guest will unmap very large memory, which will cause the crash. To fix this, add a new function vhost_vdpa_general_unmap(). This function will only unmap the memory that saved in iotlb. Call Trace: [ 647.820144] ------------[ cut here ]------------ [ 647.820848] kernel BUG at drivers/iommu/intel/iommu.c:1174! [ 647.821486] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 647.822082] CPU: 10 PID: 1181 Comm: qemu-system-x86 Not tainted 6.0.0-rc1home_lulu_2452_lulu7_vhost+ #62 [ 647.823139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qem4 [ 647.824365] RIP: 0010:domain_unmap+0x48/0x110 [ 647.825424] Code: 48 89 fb 8d 4c f6 1e 39 c1 0f 4f c8 83 e9 0c 83 f9 3f 7f 18 48 89 e8 48 d3 e8 48 85 c0 75 59 [ 647.828064] RSP: 0018:ffffae5340c0bbf0 EFLAGS: 00010202 [ 647.828973] RAX: 0000000000000001 RBX: ffff921793d10540 RCX: 000000000000001b [ 647.830083] RDX: 00000000080000ff RSI: 0000000000000001 RDI: ffff921793d10540 [ 647.831214] RBP: 0000000007fc0100 R08: ffffae5340c0bcd0 R09: 0000000000000003 [ 647.832388] R10: 0000007fc0100000 R11: 0000000000100000 R12: 00000000080000ff [ 647.833668] R13: ffffae5340c0bcd0 R14: ffff921793d10590 R15: 0000008000100000 [ 647.834782] FS: 00007f772ec90640(0000) GS:ffff921ce7a80000(0000) knlGS:0000000000000000 [ 647.836004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 647.836990] CR2: 00007f02c27a3a20 CR3: 0000000101b0c006 CR4: 0000000000372ee0 [ 647.838107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 647.839283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 647.840666] Call Trace: [ 647.841437] [ 647.842107] intel_iommu_unmap_pages+0x93/0x140 [ 647.843112] __iommu_unmap+0x91/0x1b0 [ 647.844003] iommu_unmap+0x6a/0x95 [ 647.844885] vhost_vdpa_unmap+0x1de/0x1f0 [vhost_vdpa] [ 647.845985] vhost_vdpa_process_iotlb_msg+0xf0/0x90b [vhost_vdpa] [ 647.847235] ? _raw_spin_unlock+0x15/0x30 [ 647.848181] ? _copy_from_iter+0x8c/0x580 [ 647.849137] vhost_chr_write_iter+0xb3/0x430 [vhost] [ 647.850126] vfs_write+0x1e4/0x3a0 [ 647.850897] ksys_write+0x53/0xd0 [ 647.851688] do_syscall_64+0x3a/0x90 [ 647.852508] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 647.853457] RIP: 0033:0x7f7734ef9f4f [ 647.854408] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 76 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c8 [ 647.857217] RSP: 002b:00007f772ec8f040 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 647.858486] RAX: ffffffffffffffda RBX: 00000000fef00000 RCX: 00007f7734ef9f4f [ 647.859713] RDX: 0000000000000048 RSI: 00007f772ec8f090 RDI: 0000000000000010 [ 647.860942] RBP: 00007f772ec8f1a0 R08: 0000000000000000 R09: 0000000000000000 [ 647.862206] R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000000010 [ 647.863446] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff01100000 [ 647.864692] [ 647.865458] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs v] [ 647.874688] ---[ end trace 0000000000000000 ]--- Cc: stable@vger.kernel.org Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") Signed-off-by: Cindy Lu Message-Id: <20221219073331.556140-1-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin commit c8e82e3877028381969779a86972d9a4f57a9ea0 Author: Dawei Li Date: Fri Nov 25 00:12:14 2022 +0800 virtio: Implementing attribute show with sysfs_emit Replace sprintf with sysfs_emit or its variants for their built-in PAGE_SIZE awareness. Signed-off-by: Dawei Li Message-Id: Signed-off-by: Michael S. Tsirkin commit b1d65f717cd6305a396a8738e022c6f7c65cfbe8 Author: Wei Yongjun Date: Mon Nov 14 11:07:40 2022 +0000 virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() 'vc_ctrl_req' is alloced in virtio_crypto_alg_skcipher_close_session(), and should be freed in the invalid ctrl_status->status error handling case. Otherwise there is a memory leak. Fixes: 0756ad15b1fe ("virtio-crypto: use private buffer for control request") Signed-off-by: Wei Yongjun Message-Id: <20221114110740.537276-1-weiyongjun@huaweicloud.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Gonglei Acked-by: zhenwei pi Acked-by: Jason Wang commit a4722f64f924a9992efc08d141c21b2da02b70f3 Author: wangjianli Date: Sun Nov 13 15:07:42 2022 +0800 tools/virtio: Variable type completion Replace "unsigned" with "unsigned int" Signed-off-by: wangjianli Message-Id: <20221113070742.48271-1-wangjianli@cdjrlc.com> Signed-off-by: Michael S. Tsirkin commit 794ec498c9fa79e6bfd71b931410d5897a9c00d4 Author: Stefano Garzarella Date: Thu Nov 10 15:13:35 2022 +0100 vdpa_sim: fix vringh initialization in vdpasim_queue_ready() When we initialize vringh, we should pass the features and the number of elements in the virtqueue negotiated with the driver, otherwise operations with vringh may fail. This was discovered in a case where the driver sets a number of elements in the virtqueue different from the value returned by .get_vq_num_max(). In vdpasim_vq_reset() is safe to initialize the vringh with default values, since the virtqueue will not be used until vdpasim_queue_ready() is called again. Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") Signed-off-by: Stefano Garzarella Message-Id: <20221110141335.62171-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Eugenio Pérez commit f4e468f708386ce5fa6878a7ef43a9818ceeaecf Author: Angus Chen Date: Thu Nov 10 11:01:23 2022 +0800 virtio_blk: use UINT_MAX instead of -1U We use UINT_MAX to limit max_discard_sectors in virtblk_probe, we can use UINT_MAX to limit max_hw_sectors for consistencies. No functional change intended. Signed-off-by: Angus Chen Message-Id: <20221110030124.1986-1-angus.chen@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit c070c1912a83432530cbb4271d5b9b11fa36b67a Author: Stefano Garzarella Date: Wed Nov 9 16:42:13 2022 +0100 vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release. We partially fixed this with commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes: unreferenced object 0xffff888007fbaa30 (size 16): comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s) hex dump (first 16 bytes): 40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA............. backtrace: [<0000000087736d2a>] kmem_cache_alloc_trace+0x142/0x1c0 [<0000000060740f50>] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa] [<0000000083e8e205>] vhost_chr_write_iter+0xc0/0x4a0 [vhost] [<000000008f2f414a>] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa] [<00000000de1cd4a0>] vfs_write+0x216/0x4b0 [<00000000a2850200>] ksys_write+0x71/0xf0 [<00000000de8e720b>] __x64_sys_write+0x19/0x20 [<0000000018b12cbb>] do_syscall_64+0x3f/0x90 [<00000000986ec465>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup() since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap(). vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap() on the whole range removes all the entries. The kmemleak log reported was observed with a vDPA device that has `use_va` set to true (e.g. VDUSE). This patch has been tested with both types of devices. Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") Fixes: 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") Signed-off-by: Stefano Garzarella Message-Id: <20221109154213.146789-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 98047313cdb46828093894d0ac8b1183b8b317f9 Author: Stefano Garzarella Date: Wed Nov 9 11:25:03 2022 +0100 vhost: fix range used in translate_desc() vhost_iotlb_itree_first() requires `start` and `last` parameters to search for a mapping that overlaps the range. In translate_desc() we cyclically call vhost_iotlb_itree_first(), incrementing `addr` by the amount already translated, so rightly we move the `start` parameter passed to vhost_iotlb_itree_first(), but we should hold the `last` parameter constant. Let's fix it by saving the `last` parameter value before incrementing `addr` in the loop. Fixes: a9709d6874d5 ("vhost: convert pre sorted vhost memory array to interval tree") Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20221109102503.18816-3-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit f85efa9b0f5381874f727bd98f56787840313f0b Author: Stefano Garzarella Date: Wed Nov 9 11:25:02 2022 +0100 vringh: fix range used in iotlb_translate() vhost_iotlb_itree_first() requires `start` and `last` parameters to search for a mapping that overlaps the range. In iotlb_translate() we cyclically call vhost_iotlb_itree_first(), incrementing `addr` by the amount already translated, so rightly we move the `start` parameter passed to vhost_iotlb_itree_first(), but we should hold the `last` parameter constant. Let's fix it by saving the `last` parameter value before incrementing `addr` in the loop. Fixes: 9ad9c49cfe97 ("vringh: IOTLB support") Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20221109102503.18816-2-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 7a4efe182ca61fb3e5307e69b261c57cbf434cd4 Author: Yuan Can Date: Tue Nov 8 10:17:05 2022 +0000 vhost/vsock: Fix error handling in vhost_vsock_init() A problem about modprobe vhost_vsock failed is triggered with the following log given: modprobe: ERROR: could not insert 'vhost_vsock': Device or resource busy The reason is that vhost_vsock_init() returns misc_register() directly without checking its return value, if misc_register() failed, it returns without calling vsock_core_unregister() on vhost_transport, resulting the vhost_vsock can never be installed later. A simple call graph is shown as below: vhost_vsock_init() vsock_core_register() # register vhost_transport misc_register() device_create_with_groups() device_create_groups_vargs() dev = kzalloc(...) # OOM happened # return without unregister vhost_transport Fix by calling vsock_core_unregister() when misc_register() returns error. Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko") Signed-off-by: Yuan Can Message-Id: <20221108101705.45981-1-yuancan@huawei.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Acked-by: Jason Wang commit aeca7ff254843d49a8739f07f7dab1341450111d Author: ruanjinjie Date: Thu Nov 10 16:23:48 2022 +0800 vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() Inject fault while probing module, if device_register() fails in vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). (vdpa_sim_net) unreferenced object 0xffff88807eebc370 (size 16): comm "modprobe", pid 3848, jiffies 4362982860 (age 18.153s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 6e 65 74 00 6b 6b 6b a5 vdpasim_net.kkk. backtrace: [] __kmalloc_node_track_caller+0x4e/0x150 [] kstrdup+0x33/0x60 [] kobject_set_name_vargs+0x41/0x110 [] dev_set_name+0xab/0xe0 [] device_add+0xe3/0x1a80 [] 0xffffffffa0270013 [] do_one_initcall+0x87/0x2e0 [] do_init_module+0x1ab/0x640 [] load_module+0x5d00/0x77f0 [] __do_sys_finit_module+0x110/0x1b0 [] do_syscall_64+0x35/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (vdpa_sim_blk) unreferenced object 0xffff8881070c1250 (size 16): comm "modprobe", pid 6844, jiffies 4364069319 (age 17.572s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 62 6c 6b 00 6b 6b 6b a5 vdpasim_blk.kkk. backtrace: [] __kmalloc_node_track_caller+0x4e/0x150 [] kstrdup+0x33/0x60 [] kobject_set_name_vargs+0x41/0x110 [] dev_set_name+0xab/0xe0 [] device_add+0xe3/0x1a80 [] 0xffffffffa0220013 [] do_one_initcall+0x87/0x2e0 [] do_init_module+0x1ab/0x640 [] load_module+0x5d00/0x77f0 [] __do_sys_finit_module+0x110/0x1b0 [] do_syscall_64+0x35/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 899c4d187f6a ("vdpa_sim_blk: add support for vdpa management tool") Fixes: a3c06ae158dd ("vdpa_sim_net: Add support for user supported devices") Signed-off-by: ruanjinjie Reviewed-by: Stefano Garzarella Message-Id: <20221110082348.4105476-1-ruanjinjie@huawei.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 75e4ab9735a5a70612dd06461ca372b897bf371c Author: Shaomin Deng Date: Sat Nov 5 11:51:51 2022 -0400 tools: Delete the unneeded semicolon after curly braces Unneeded semicolon after curly braces, so delete it. Signed-off-by: Shaomin Deng Message-Id: <20221105155151.12155-1-dengshaomin@cdjrlc.com> Signed-off-by: Michael S. Tsirkin commit b66ead2d0ecac00c3a06a6218af5411cb5fcb5d5 Author: Angus Chen Date: Tue Nov 1 19:16:54 2022 +0800 virtio_pci: modify ENOENT to EINVAL Virtio_crypto use max_data_queues+1 to setup vqs, we use vp_modern_get_num_queues to protect the vq range in setup_vq. We could enter index >= vp_modern_get_num_queues(mdev) in setup_vq if common->num_queues is not set well,and it return -ENOENT. It is better to use -EINVAL instead. Signed-off-by: Angus Chen Message-Id: <20221101111655.1947-1-angus.chen@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin commit a9f0a19ff7700cc8a30db2496f40d18490dcb9df Author: Colin Ian King Date: Mon Oct 24 14:37:56 2022 +0100 RDMA/mlx5: remove variable i Variable i is just being incremented and it's never used anywhere else. The variable and the increment are redundant so remove it. Signed-off-by: Colin Ian King Message-Id: <20221024133756.2158497-1-colin.i.king@gmail.com> Signed-off-by: Michael S. Tsirkin commit b9d978a89296c57fbbbd8ea647c303ce4d37028f Author: Shaoqin Huang Date: Thu Oct 20 23:27:34 2022 -0700 virtio_ring: use helper function is_power_of_2() Use helper function is_power_of_2() to check if num is power of two. Minor readability improvement. Signed-off-by: Shaoqin Huang Message-Id: <20221021062734.228881-3-shaoqin.huang@intel.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 344686136d73501a18a9621de690ff7824a3d129 Author: Shaoqin Huang Date: Thu Oct 20 23:27:33 2022 -0700 virtio_pci: use helper function is_power_of_2() Use helper function is_power_of_2() to check if num is power of two. Minor readability improvement. Signed-off-by: Shaoqin Huang Message-Id: <20221021062734.228881-2-shaoqin.huang@intel.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Xuan Zhuo commit 38fc462f57ef4e5dc722bab6824854b105de8aa2 Author: Eli Cohen Date: Mon Nov 14 15:17:56 2022 +0200 vdpa/mlx5: Avoid overwriting CVQ iotlb When qemu uses different address spaces for data and control virtqueues, the current code would overwrite the control virtqueue iotlb through the dup_iotlb call. Fix this by referring to the address space identifier and the group to asid mapping to determine which mapping needs to be updated. We also move the address space logic from mlx5 net to core directory. Reported-by: Eugenio Pérez Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-6-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Eugenio Pérez commit 0dbc1b4ae07d003b2e88ba9d4142846320f8e349 Author: Eli Cohen Date: Mon Nov 14 15:17:55 2022 +0200 vdpa/mlx5: Avoid using reslock in event_handler event_handler runs under atomic context and may not acquire reslock. We can still guarantee that the handler won't be called after suspend by clearing nb_registered, unregistering the handler and flushing the workqueue. Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-5-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 1ab53760d322c82fb4cb5e81b5817065801e3ec4 Author: Eli Cohen Date: Mon Nov 14 15:17:54 2022 +0200 vdpa/mlx5: Fix wrong mac address deletion Delete the old MAC from the table and not the new one which is not there yet. Fixes: baf2ad3f6a98 ("vdpa/mlx5: Add RX MAC VLAN filter support") Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-4-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 5aec804936bbff182081f1cdc271fcb76af1a4ff Author: Eli Cohen Date: Mon Nov 14 15:17:53 2022 +0200 vdpa/mlx5: Return error on vlan ctrl commands if not supported Check if VIRTIO_NET_F_CTRL_VLAN is negotiated and return error if control VQ command is received. Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-3-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Eugenio Pérez commit a6ce72c0fb6041f9871f880b2d02b294f7f49cb4 Author: Eli Cohen Date: Mon Nov 14 15:17:52 2022 +0200 vdpa/mlx5: Fix rule forwarding VLAN to TIR Set the VLAN id to the header values field instead of overwriting the headers criteria field. Before this fix, VLAN filtering would not really work and tagged packets would be forwarded unfiltered to the TIR. Fixes: baf2ad3f6a98 ("vdpa/mlx5: Add RX MAC VLAN filter support") Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 2de5bba5890f6604a997c75e754df8082386c9f7 Author: Arnd Bergmann Date: Thu Dec 15 17:57:20 2022 +0100 usb: fotg210: fix OTG-only build The fotg210 module combines the HCD and OTG drivers, which then fails to build when only the USB gadget support is enabled in the kernel but host support is not: aarch64-linux-ld: drivers/usb/fotg210/fotg210-core.o: in function `fotg210_init': fotg210-core.c:(.init.text+0xc): undefined reference to `usb_disabled' Move the check for usb_disabled() after the check for the HCD module, and let the OTG driver still be probed in this configuration. A nicer approach might be to have the common portion built as a library module, with the two platform other files registering their own platform_driver instances separately. Fixes: ddacd6ef44ca ("usb: fotg210: Fix Kconfig for USB host modules") Reviewed-by: Linus Walleij Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20221215165728.2062984-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit b659b613cea2ae39746ca8bd2b69d1985dd9d770 Author: Ferry Toth Date: Thu Dec 22 21:53:02 2022 +0100 Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" This reverts commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac. This patch results in some qemu test failures, specifically xilinx-zynq-a9 machine and zynq-zc702 as well as zynq-zed devicetree files, when trying to boot from USB drive. Link: https://lore.kernel.org/lkml/20221220194334.GA942039@roeck-us.net/ Fixes: 8a7b31d545d3 ("usb: ulpi: defer ulpi_register on ulpi_read_id timeout") Cc: stable@vger.kernel.org Reported-by: Guenter Roeck Signed-off-by: Ferry Toth Link: https://lore.kernel.org/r/20221222205302.45761-1-ftoth@exalondelft.nl Signed-off-by: Greg Kroah-Hartman commit 8ac718cc0e36ef4046e2d6349727fecddc13ab9c Merge: 3ec3ebec7c767 a056ebcc30e2f Author: David S. Miller Date: Wed Dec 28 10:16:57 2022 +0000 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes This series fixes a devlink bug and several XDP related bugs. The devlink bug causes a kernel crash on VF devices. The XDP driver patches fix and clean up the RX XDP path and re-enable header-data split that was disabled by mistake when adding the XDP multi-buffer support. ==================== Signed-off-by: David S. Miller commit a056ebcc30e2f78451d66f615d2f6bdada3e6438 Author: Michael Chan Date: Mon Dec 26 22:19:40 2022 -0500 bnxt_en: Fix HDS and jumbo thresholds for RX packets The recent XDP multi-buffer feature has introduced regressions in the setting of HDS and jumbo thresholds. HDS was accidentally disabled in the nornmal mode without XDP. This patch restores jumbo HDS placement when not in XDP mode. In XDP multi-buffer mode, HDS should be disabled and the jumbo threshold should be set to the usable page size in the first page buffer. Fixes: 32861236190b ("bnxt: change receive ring space parameters") Reviewed-by: Mohammad Shuab Siddique Reviewed-by: Ajit Khaparde Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1abeacc1979fa4a756695f5030791d8f0fa934b9 Author: Michael Chan Date: Mon Dec 26 22:19:39 2022 -0500 bnxt_en: Fix first buffer size calculations for XDP multi-buffer The size of the first buffer is always page size, and the useable space is the page size minus the offset and the skb_shared_info size. Make sure SKB and XDP buf sizes match so that the skb_shared_info is at the same offset seen from the SKB and XDP_BUF. build_skb() should be passed PAGE_SIZE. xdp_init_buff() should be passed PAGE_SIZE as well. xdp_get_shared_info_from_buff() will automatically deduct the skb_shared_info size if the XDP buffer has frags. There is no need to keep bp->xdp_has_frags. Change BNXT_PAGE_MODE_BUF_SIZE to BNXT_MAX_PAGE_MODE_MTU_SBUF since this constant is really the MTU with ethernet header size subtracted. Also fix the BNXT_MAX_PAGE_MODE_MTU macro with proper parentheses. Fixes: 32861236190b ("bnxt: change receive ring space parameters") Reviewed-by: Somnath Kotur Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 9b3e607871ea5ee90f10f5be3965fc07f2aa3ef7 Author: Michael Chan Date: Mon Dec 26 22:19:38 2022 -0500 bnxt_en: Fix XDP RX path The XDP program can change the starting address of the RX data buffer and this information needs to be passed back from bnxt_rx_xdp() to bnxt_rx_pkt() for the XDP_PASS case so that the SKB can point correctly to the modified buffer address. Add back the data_ptr parameter to bnxt_rx_xdp() to make this work. Fixes: b231c3f3414c ("bnxt: refactor bnxt_rx_xdp to separate xdp_init_buff/xdp_prepare_buff") Reviewed-by: Andy Gospodarek Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit bbfc17e50ba2ed18dfef46b1c433d50a58566bf1 Author: Michael Chan Date: Mon Dec 26 22:19:37 2022 -0500 bnxt_en: Simplify bnxt_xdp_buff_init() bnxt_xdp_buff_init() does not modify the data_ptr or the len parameters, so no need to pass in the addresses of these parameters. Fixes: b231c3f3414c ("bnxt: refactor bnxt_rx_xdp to separate xdp_init_buff/xdp_prepare_buff") Reviewed-by: Andy Gospodarek Reviewed-by: Somnath Kotur Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0020ae2a4aa81becd182231bf48acd66c86c86dd Author: Vikas Gupta Date: Mon Dec 26 22:19:36 2022 -0500 bnxt_en: fix devlink port registration to netdev We don't register a devlink port in case of a VF so avoid setting the devlink pointer to netdev. Also, SET_NETDEV_DEVLINK_PORT has to be moved so that we determine whether the device is PF/VF first. This fixes the NULL pointer dereference of devlink_port->devlink when creating VFs: BUG: kernel NULL pointer dereference, address: 0000000000000160 PGD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 14 PID: 388 Comm: kworker/14:1 Kdump: loaded Not tainted 6.1.0-rc8 #5 Hardware name: Dell Inc. PowerEdge R750/06V45N, BIOS 1.3.8 08/31/2021 Workqueue: events work_for_cpu_fn RIP: 0010:devlink_nl_port_handle_size+0xb/0x50 Code: 83 c4 10 5b 5d c3 cc cc cc cc b8 a6 ff ff ff eb de e8 c9 59 21 00 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 53 48 8b 47 20 <48> 8b a8 60 01 00 00 48 8b 45 60 48 8b 38 e8 92 90 1a 00 48 8b 7d RSP: 0018:ff4fe5394846fcd8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000794 RCX: 0000000000000000 RDX: ff1f129683a30a40 RSI: 0000000000000008 RDI: ff1f1296bb496188 RBP: 0000000000000334 R08: 0000000000000cc0 R09: 0000000000000000 R10: ff1f1296bb494298 R11: ffffffffffffffc0 R12: 0000000000000000 R13: 0000000000000000 R14: ff1f1296bb494000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ff1f129e5fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000160 CR3: 000000131f610006 CR4: 0000000000771ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: if_nlmsg_size+0x14a/0x220 rtmsg_ifinfo_build_skb+0x3c/0x100 rtmsg_ifinfo+0x9c/0xc0 register_netdevice+0x59d/0x670 register_netdev+0x1c/0x40 bnxt_init_one+0x674/0xa60 [bnxt_en] local_pci_probe+0x42/0x80 work_for_cpu_fn+0x13/0x20 process_one_work+0x1e2/0x3b0 ? rescuer_thread+0x390/0x390 worker_thread+0x1c4/0x3a0 ? rescuer_thread+0x390/0x390 kthread+0xd6/0x100 ? kthread_complete_and_exit+0x20/0x20 Fixes: ac73d4bf2cda ("net: make drivers to use SET_NETDEV_DEVLINK_PORT to set devlink_port") Cc: Jiri Pirko Signed-off-by: Vikas Gupta Reviewed-by: Andy Gospodarek Reviewed-by: Kalesh Anakkur Purayil Reviewed-by: Damodharam Ammepalli Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3ec3ebec7c767e6d19768cb262663645b3506c0b Merge: 81852018f240f bd2adfe3b3b86 Author: David S. Miller Date: Wed Dec 28 10:09:50 2022 +0000 Merge branch 'rswitch-fixes' Yoshihiro Shimoda says: ==================== net: ethernet: renesas: rswitch: Fix minor issues This patch series is based on v6.2-rc2. ==================== Signed-off-by: David S. Miller commit bd2adfe3b3b863c883309bcc915f13c831ca88da Author: Yoshihiro Shimoda Date: Mon Dec 26 16:13:28 2022 +0900 net: ethernet: renesas: rswitch: Fix getting mac address from device tree To get mac address from device tree which is from each ethernet-port, fix the first argument of of_get_ethdev_address(). Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit 8e6a8d7a3dd93e93645be061692cb4ee6702dff0 Author: Yoshihiro Shimoda Date: Mon Dec 26 16:13:27 2022 +0900 net: ethernet: renesas: rswitch: Fix error path in renesas_eth_sw_probe() If rswitch_init() returns non-zero and this driver is re-probed, the following error happens: renesas_eth_sw e6880000.ethernet: Unbalanced pm_runtime_enable! So, fix error path in renesas_eth_sw_probe(). Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit 258896fcc786b4e7db238eba26f6dd080e0ff41e Author: Dmitry Fomichev Date: Sat Oct 15 23:41:26 2022 -0400 virtio-blk: use a helper to handle request queuing errors Define a new helper function, virtblk_fail_to_queue(), to clean up the error handling code in virtio_queue_rq(). Signed-off-by: Dmitry Fomichev Message-Id: <20221016034127.330942-2-dmitry.fomichev@wdc.com> Signed-off-by: Michael S. Tsirkin commit c262f75cb6bb5a63828e72ce3b8fe808e5029479 Author: Ricardo Cañuelo Date: Wed Oct 12 08:29:49 2022 +0200 tools/virtio: initialize spinlocks in vring_test.c The virtio_device vqs_list spinlocks must be initialized before use to prevent functions that manipulate the device virtualqueues, such as vring_new_virtqueue(), from blocking indefinitely. Signed-off-by: Ricardo Cañuelo Message-Id: <20221012062949.1526176-1-ricardo.canuelo@collabora.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit b9e05399d9273c8c066e73db1e6e85364003030c Author: Si-Wei Liu Date: Mon Oct 10 10:27:03 2022 -0700 vdpa: merge functionally duplicated dev_features attributes We can merge VDPA_ATTR_VDPA_DEV_SUPPORTED_FEATURES with VDPA_ATTR_DEV_FEATURES which is functionally equivalent. While at it, tweak the comment in header file to make user provioned device features distinguished from those supported by the parent mgmtdev device: the former of which can be inherited as a whole from the latter, or can be a subset of the latter if explicitly specified. Signed-off-by: Si-Wei Liu Message-Id: <1665422823-18364-1-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 81852018f240f9382f5fab3582de0a42cd059d08 Merge: 0e50d999903c0 ff249be5cca9f Author: David S. Miller Date: Wed Dec 28 10:06:06 2022 +0000 Merge branch 'netdev-doc-defaq' Jakub Kicinski says: ==================== netdev doc de-FAQization We have outgrown the FAQ format for our process doc. I often find myself struggling to locate information in this doc, because the questions do not serve well as section headers. Reformat the document. v2: update the headers v1: https://lore.kernel.org/all/20221221184007.1170384-1-kuba@kernel.org/ ==================== Signed-off-by: David S. Miller commit ff249be5cca9f982e58936847ba6c30104abbcad Author: Jakub Kicinski Date: Thu Dec 22 11:22:48 2022 -0800 docs: netdev: convert to a non-FAQ document The netdev-FAQ document has grown over the years to the point where finding information in it is somewhat challenging. The length of the questions prevents readers from locating content that's relevant at a glance. Convert to a more standard documentation format with sections and sub-sections rather than questions and answers. The content edits are limited to what's necessary to change the format, and very minor clarifications. Reviewed-by: Randy Dunlap Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit f4ef681115f822daf7f36f8b1892d9f1e1a26fbf Author: Jakub Kicinski Date: Thu Dec 22 11:22:47 2022 -0800 docs: netdev: reshuffle sections in prep for de-FAQization Subsequent changes will reformat the doc away from FAQ. To make that more readable perform the pure section moves now. Reviewed-by: Randy Dunlap Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 0e50d999903c009b6a9cd2277c82d6798d982e31 Author: David Howells Date: Sat Dec 24 14:49:00 2022 +0000 rxrpc: Fix a couple of potential use-after-frees At the end of rxrpc_recvmsg(), if a call is found, the call is put and then a trace line is emitted referencing that call in a couple of places - but the call may have been deallocated by the time those traces happen. Fix this by stashing the call debug_id in a variable and passing that to the tracepoint rather than the call pointer. Fixes: 849979051cbc ("rxrpc: Add a tracepoint to follow what recvmsg does") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 6b90032c73405cd4da29ab914df11fd1be960b99 Author: Xu Panda Date: Wed Dec 28 09:44:11 2022 +0800 fbdev: atyfb: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL-terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Signed-off-by: Helge Deller commit 8d8cf163c8d8c93bccf0c70a133309693af9bf61 Author: Xu Panda Date: Wed Dec 28 09:40:01 2022 +0800 fbdev: omapfb: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL-terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Signed-off-by: Helge Deller commit 25e8ac233d24051e2c4ff64c34f60609b0988568 Author: Vijaya Krishna Nivarthi Date: Fri Dec 16 23:08:13 2022 +0530 dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation Rx operation on SPI GSI DMA is currently not working. As per GSI spec, link_rx bit is to be set on GO TRE on tx channel whenever there is going to be a DMA TRE on rx channel. This is currently set for duplex operation only. Set the bit for rx operation as well. This is part of changes required to bring up Rx. Fixes: 94b8f0e58fa1 ("dmaengine: qcom: gpi: set chain and link flag for duplex") Signed-off-by: Vijaya Krishna Nivarthi Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/1671212293-14767-1-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Vinod Koul commit 22c7e1a0fa45cd7d028d6b4117161fd0e3427fe0 Author: Dominik Kobinski Date: Sun Dec 11 11:05:01 2022 +0100 arm64: dts: msm8992-bullhead: add memory hole region Add region for memory hole present on bullhead in order to fix a reboot issue on recent kernels Reported-by: Petr Vorel Signed-off-by: Dominik Kobinski Reviewed-by: Konrad Dybcio Tested-by: Petr Vorel Reviewed-by: Petr Vorel Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221211100501.82323-1-dominikkobinski314@gmail.com commit 4164843261d28f86910a5c2727faddce066334c5 Author: Christophe JAILLET Date: Tue Dec 13 07:15:33 2022 +0100 drm/msm/hdmi: Fix the error handling path of msm_hdmi_dev_probe() If an error occurs after a successful msm_hdmi_get_phy() call, it must be undone by a corresponding msm_hdmi_put_phy(), as already done in the remove function. Fixes: 437365464043 ("drm/msm/hdmi: move msm_hdmi_get_phy() to msm_hdmi_dev_probe()") Signed-off-by: Christophe JAILLET Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/514847/ Link: https://lore.kernel.org/r/b3f9da097851e2e42a40dc61458aa98c41c88d0d.1670741386.git.christophe.jaillet@wanadoo.fr Signed-off-by: Abhinav Kumar commit 45dac1352b55b1d8cb17f218936b2bc2bc1fb4ee Author: Miaoqian Lin Date: Wed Dec 7 10:59:22 2022 +0400 drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path of_icc_get() alloc resources for path1, we should release it when not need anymore. Early return when IS_ERR_OR_NULL(path0) may leak path1. Defer getting path1 to fix this. Fixes: b9364eed9232 ("drm/msm/dpu: Move min BW request and full BW disable back to mdss") Signed-off-by: Miaoqian Lin Reviewed-by: Douglas Anderson Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/514264/ Link: https://lore.kernel.org/r/20221207065922.2086368-1-linmq006@gmail.com Signed-off-by: Abhinav Kumar commit e5266ca38294c6eba48f5c9cd3d0402d619d7c05 Author: Adam Skladowski Date: Wed Nov 30 21:09:39 2022 +0100 dt-bindings: display: msm: Rename mdss node name in example Follow other YAMLs and replace mdss name into display-subystem. Signed-off-by: Adam Skladowski Acked-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Fixes: b93bdff44a85 ("dt-bindings: display/msm: add support for SM6115") Fixes: 06097b13ef97 ("dt-bindings: display/msm: split dpu-qcm2290 into DPU and MDSS parts") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/513585/ Link: https://lore.kernel.org/r/20221130200950.144618-2-a39.skl@gmail.com Signed-off-by: Abhinav Kumar commit ef11cb7a29c0e13031c968190ea8f86104e7fb6a Author: Konrad Dybcio Date: Wed Nov 16 17:32:18 2022 +0100 dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY On some SoCs (hello SM6350) vdds-supply is not wired to any smd-rpm or rpmh regulator, but instead powered by the VDD_MX/mx.lvl line, which is voted for in the DSI ctrl node. Signed-off-by: Konrad Dybcio Acked-by: Rob Herring Fixes: 8fc939e72ff8 ("dt-bindings: msm: dsi: add yaml schemas for DSI PHY bindings") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/511889/ Link: https://lore.kernel.org/r/20221116163218.42449-1-konrad.dybcio@linaro.org Signed-off-by: Abhinav Kumar commit a2117773c839a8439a3771e0c040b5c505b083a7 Author: Konrad Dybcio Date: Wed Nov 30 14:58:07 2022 +0100 dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY On some SoCs (hello SM6115) vcca-supply is not wired to any smd-rpm or rpmh regulator, but instead powered by the VDD_MX line, which is voted for in the DSI ctrl node. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Fixes: 8fc939e72ff8 ("dt-bindings: msm: dsi: add yaml schemas for DSI PHY bindings") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/513555/ Link: https://lore.kernel.org/r/20221130135807.45028-1-konrad.dybcio@linaro.org Signed-off-by: Abhinav Kumar commit 1bdeb321d1f856346fe0078af09c9e7ffbd2ca7a Author: Yang Li Date: Tue Nov 15 09:49:02 2022 +0800 drm/msm/dpu: Fix some kernel-doc comments Make the description of @init to @p in dpu_encoder_phys_wb_init() and remove @wb_roi in dpu_encoder_phys_wb_setup_fb() to clear the below warnings: drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:139: warning: Excess function parameter 'wb_roi' description in 'dpu_encoder_phys_wb_setup_fb' drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:699: warning: Function parameter or member 'p' not described in 'dpu_encoder_phys_wb_init' drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:699: warning: Excess function parameter 'init' description in 'dpu_encoder_phys_wb_init' Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3067 Reported-by: Abaci Robot Signed-off-by: Yang Li Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/511605/ Link: https://lore.kernel.org/r/20221115014902.45240-1-yang.lee@linux.alibaba.com Signed-off-by: Abhinav Kumar commit 9d8b5376cc2848ca22314fdec9a7a45b1bf69189 Author: Randy Dunlap Date: Fri Nov 25 16:04:01 2022 -0800 fbdev: make offb driver tristate Make the offb (Open Firmware frame buffer) driver tristate, i.e., so that it can be built as a loadable module. However, it still depends on the setting of DRM_OFDRM so that both of these drivers cannot be builtin at the same time nor can one be builtin and the other one a loadable module. Build-tested successfully with all combination of DRM_OFDRM and FB_OF. This fixes a build issue that Michal reported when FB_OF=y and DRM_OFDRM=m: powerpc64-linux-ld: drivers/video/fbdev/offb.o:(.data.rel.ro+0x58): undefined reference to `cfb_fillrect' powerpc64-linux-ld: drivers/video/fbdev/offb.o:(.data.rel.ro+0x60): undefined reference to `cfb_copyarea' powerpc64-linux-ld: drivers/video/fbdev/offb.o:(.data.rel.ro+0x68): undefined reference to `cfb_imageblit' Signed-off-by: Randy Dunlap Suggested-by: Arnd Bergmann Cc: Masahiro Yamada Cc: Thomas Zimmermann Cc: Michal Suchánek Cc: linuxppc-dev@lists.ozlabs.org Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 74ad47c9cecf12e647061107d9f3858d82e0e5c5 Merge: 1b929c02afd37 02228f6aa6a64 Author: Mark Brown Date: Tue Dec 27 17:42:08 2022 +0000 regulator: Merge up forgotten fix I forgot to send this fix during the 6.1 cycle, make sure it gets sent for 6.2. commit 721c0d68c0f882b6358102b52961ff6eb601839c Author: Johan Hovold Date: Mon Nov 21 09:50:58 2022 +0100 arm64: dts: qcom: sc8280xp: fix USB-DP PHY nodes Update the USB4-USB3-DP QMP PHY nodes to match the new binding which specifically includes the missing register regions (e.g. DP_PHY) and allows for supporting DisplayPort Alternate Mode. Reviewed-by: Dmitry Baryshkov Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221121085058.31213-16-johan+linaro@kernel.org commit ee4e530bdde29a69c58656a919545251a782674e Author: Johan Hovold Date: Mon Nov 21 09:50:57 2022 +0100 arm64: dts: qcom: sc8280xp: fix primary USB-DP PHY reset The vendor kernel is using the GCC_USB4_DP_PHY_PRIM_BCR and GCC_USB4_1_DP_PHY_PRIM_BCR resets for the USB4-USB3-DP QMP PHYs. Update the primary USB-DP PHY node to match. Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221121085058.31213-15-johan+linaro@kernel.org commit 9eb803402a2a83400c6c6afd900e3b7c87c06816 Author: Stefan Metzmacher Date: Wed Nov 16 21:25:24 2022 +0100 uapi:io_uring.h: allow linux/time_types.h to be skipped include/uapi/linux/io_uring.h is synced 1:1 into liburing:src/include/liburing/io_uring.h. liburing has a configure check to detect the need for linux/time_types.h. It can opt-out by defining UAPI_LINUX_IO_URING_H_SKIP_LINUX_TIME_TYPES_H Fixes: 78a861b94959 ("io_uring: add sync cancelation API through io_uring_register()") Link: https://github.com/axboe/liburing/issues/708 Link: https://github.com/axboe/liburing/pull/709 Link: https://lore.kernel.org/io-uring/20221115212614.1308132-1-ammar.faizi@intel.com/T/#m9f5dd571cd4f6a5dee84452dbbca3b92ba7a4091 CC: Jens Axboe Cc: Ammar Faizi Signed-off-by: Stefan Metzmacher Reviewed-by: Ammar Faizi Link: https://lore.kernel.org/r/7071a0a1d751221538b20b63f9160094fc7e06f4.1668630247.git.metze@samba.org Signed-off-by: Jens Axboe commit b1e9c223736b1471287f0ac46a368676c3bd7727 Author: Ricardo Ribalda Date: Sun Dec 25 09:37:12 2022 +0100 spi: mediatek: Enable irq before the spi registration If the irq is enabled after the spi si registered, there can be a race with the initialization of the devices on the spi bus. Eg: mtk-spi 1100a000.spi: spi-mem transfer timeout spi-nor: probe of spi0.0 failed with error -110 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: mtk_spi_can_dma+0x0/0x2c Fixes: c6f7874687f7 ("spi: mediatek: Enable irq when pdata is ready") Reported-by: Daniel Golle Signed-off-by: Ricardo Ribalda Tested-by: Daniel Golle Link: https://lore.kernel.org/r/20221225-mtk-spi-fixes-v1-0-bb6c14c232f8@chromium.org Signed-off-by: Mark Brown commit 94cd8fa09f5f1ebdd4e90964b08b7f2cc4b36c43 Author: Mathieu Desnoyers Date: Wed Dec 14 17:20:08 2022 -0500 futex: Fix futex_waitv() hrtimer debug object leak on kcalloc error In a scenario where kcalloc() fails to allocate memory, the futex_waitv system call immediately returns -ENOMEM without invoking destroy_hrtimer_on_stack(). When CONFIG_DEBUG_OBJECTS_TIMERS=y, this results in leaking a timer debug object. Fixes: bf69bad38cf6 ("futex: Implement sys_futex_waitv()") Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Davidlohr Bueso Cc: stable@vger.kernel.org Cc: stable@vger.kernel.org # v5.16+ Link: https://lore.kernel.org/r/20221214222008.200393-1-mathieu.desnoyers@efficios.com commit 63dc6325ff41ee9e570bde705ac34a39c5dbeb44 Author: Masami Hiramatsu (Google) Date: Mon Dec 19 23:35:19 2022 +0900 x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK Since the CONFIG_RETHUNK and CONFIG_SLS will use INT3 for stopping speculative execution after function return, kprobe jump optimization always fails on the functions with such INT3 inside the function body. (It already checks the INT3 padding between functions, but not inside the function) To avoid this issue, as same as kprobes, check whether the INT3 comes from kgdb or not, and if so, stop decoding and make it fail. The other INT3 will come from CONFIG_RETHUNK/CONFIG_SLS and those can be treated as a one-byte instruction. Fixes: e463a09af2f0 ("x86: Add straight-line-speculation mitigation") Suggested-by: Peter Zijlstra Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/167146051929.1374301.7419382929328081706.stgit@devnote3 commit 1993bf97992df2d560287f3c4120eda57426843d Author: Masami Hiramatsu (Google) Date: Mon Dec 19 23:35:10 2022 +0900 x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK Since the CONFIG_RETHUNK and CONFIG_SLS will use INT3 for stopping speculative execution after RET instruction, kprobes always failes to check the probed instruction boundary by decoding the function body if the probed address is after such sequence. (Note that some conditional code blocks will be placed after function return, if compiler decides it is not on the hot path.) This is because kprobes expects kgdb puts the INT3 as a software breakpoint and it will replace the original instruction. But these INT3 are not such purpose, it doesn't need to recover the original instruction. To avoid this issue, kprobes checks whether the INT3 is owned by kgdb or not, and if so, stop decoding and make it fail. The other INT3 will come from CONFIG_RETHUNK/CONFIG_SLS and those can be treated as a one-byte instruction. Fixes: e463a09af2f0 ("x86: Add straight-line-speculation mitigation") Suggested-by: Peter Zijlstra Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/167146051026.1374301.392728975473572291.stgit@devnote3 commit ade8c20847fcc3f4de08b35f730ec04ef29ddbdc Author: Arnd Bergmann Date: Thu Dec 15 17:43:23 2022 +0100 x86/calldepth: Fix incorrect init section references The addition of callthunks_translate_call_dest means that skip_addr() and patch_dest() can no longer be discarded as part of the __init section freeing: WARNING: modpost: vmlinux.o: section mismatch in reference: callthunks_translate_call_dest.cold (section: .text.unlikely) -> skip_addr (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: callthunks_translate_call_dest.cold (section: .text.unlikely) -> patch_dest (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: is_callthunk.cold (section: .text.unlikely) -> skip_addr (section: .init.text) ERROR: modpost: Section mismatches detected. Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them. Fixes: b2e9dfe54be4 ("x86/bpf: Emit call depth accounting if required") Signed-off-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221215164334.968863-1-arnd@kernel.org commit 0a041ebca4956292cadfb14a63ace3a9c1dcb0a3 Author: Namhyung Kim Date: Tue Dec 20 14:31:40 2022 -0800 perf/core: Call LSM hook after copying perf_event_attr It passes the attr struct to the security_perf_event_open() but it's not initialized yet. Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Joel Fernandes (Google) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20221220223140.4020470-1-namhyung@kernel.org commit a551844e345ba2a1c533dee4b55cb0efddb1bcda Author: Peter Zijlstra Date: Mon Dec 19 15:40:04 2022 +0100 perf: Fix use-after-free in error path The syscall error path has a use-after-free; put_pmu_ctx() will reference ctx, therefore we must ensure ctx is destroyed after pmu_ctx is. Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: syzbot+b8e8c01c8ade4fe6e48f@syzkaller.appspotmail.com Signed-off-by: Peter Zijlstra (Intel) Tested-by: Chengming Zhou Link: https://lkml.kernel.org/r/Y6B3xEgkbmFUCeni@hirez.programming.kicks-ass.net commit 08245672cdc6505550d1a5020603b0a8d4a6dcc7 Author: Colin Ian King Date: Fri Dec 2 13:51:49 2022 +0000 perf/x86/amd: fix potential integer overflow on shift of a int The left shift of int 32 bit integer constant 1 is evaluated using 32 bit arithmetic and then passed as a 64 bit function argument. In the case where i is 32 or more this can lead to an overflow. Avoid this by shifting using the BIT_ULL macro instead. Fixes: 471af006a747 ("perf/x86/amd: Constrain Large Increment per Cycle events") Signed-off-by: Colin Ian King Signed-off-by: Peter Zijlstra (Intel) Acked-by: Ian Rogers Acked-by: Kim Phillips Link: https://lore.kernel.org/r/20221202135149.1797974-1-colin.i.king@gmail.com commit f841b682baef90ee144df8b12e2c76aa460717c1 Author: Chengming Zhou Date: Wed Dec 7 20:40:23 2022 +0800 perf/core: Fix cgroup events tracking We encounter perf warnings when using cgroup events like: cd /sys/fs/cgroup mkdir test perf stat -e cycles -a -G test Which then triggers: WARNING: CPU: 0 PID: 690 at kernel/events/core.c:849 perf_cgroup_switch+0xb2/0xc0 Call Trace: __schedule+0x4ae/0x9f0 ? _raw_spin_unlock_irqrestore+0x23/0x40 ? __cond_resched+0x18/0x20 preempt_schedule_common+0x2d/0x70 __cond_resched+0x18/0x20 wait_for_completion+0x2f/0x160 ? cpu_stop_queue_work+0x9e/0x130 affine_move_task+0x18a/0x4f0 WARNING: CPU: 0 PID: 690 at kernel/events/core.c:829 ctx_sched_in+0x1cf/0x1e0 Call Trace: ? ctx_sched_out+0xb7/0x1b0 perf_cgroup_switch+0x88/0xc0 __schedule+0x4ae/0x9f0 ? _raw_spin_unlock_irqrestore+0x23/0x40 ? __cond_resched+0x18/0x20 preempt_schedule_common+0x2d/0x70 __cond_resched+0x18/0x20 wait_for_completion+0x2f/0x160 ? cpu_stop_queue_work+0x9e/0x130 affine_move_task+0x18a/0x4f0 The above two warnings are not complete here since I remove other unimportant information. The problem is caused by the perf cgroup events tracking: CPU0 CPU1 perf_event_open() perf_event_alloc() account_event() account_event_cpu() atomic_inc(perf_cgroup_events) __perf_event_task_sched_out() if (atomic_read(perf_cgroup_events)) perf_cgroup_switch() // kernel/events/core.c:849 WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0) if (READ_ONCE(cpuctx->cgrp) == cgrp) // false return perf_ctx_lock() ctx_sched_out() cpuctx->cgrp = cgrp ctx_sched_in() perf_cgroup_set_timestamp() // kernel/events/core.c:829 WARN_ON_ONCE(!ctx->nr_cgroups) perf_ctx_unlock() perf_install_in_context() cpu_function_call() __perf_install_in_context() add_event_to_ctx() list_add_event() perf_cgroup_event_enable() ctx->nr_cgroups++ cpuctx->cgrp = X We can see from above that we wrongly use percpu atomic perf_cgroup_events to check if we need to perf_cgroup_switch(), which should only be used when we know this CPU has cgroup events enabled. The commit bd2756811766 ("perf: Rewrite core context handling") change to have only one context per-CPU, so we can just use cpuctx->cgrp to check if this CPU has cgroup events enabled. So percpu atomic perf_cgroup_events is not needed. Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Chengming Zhou Signed-off-by: Peter Zijlstra (Intel) Tested-by: Ravi Bangoria Link: https://lkml.kernel.org/r/20221207124023.66252-1-zhouchengming@bytedance.com commit e2d371484653ac83b970d3ebcf343383f39f8b6b Author: Ravi Bangoria Date: Fri Nov 18 10:45:39 2022 +0530 perf core: Return error pointer if inherit_event() fails to find pmu_ctx inherit_event() returns NULL only when it finds orphaned events otherwise it returns either valid child_event pointer or an error pointer. Follow the same when it fails to find pmu_ctx. Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: Dan Carpenter Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221118051539.820-1-ravi.bangoria@amd.com commit f4b7f8febd4d9b615fbec2a06bf352b9c3729b11 Author: Hans de Goede Date: Thu Dec 15 16:43:57 2022 +0100 platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[] The Lenovo Legion 5 15ARH05 needs ideapad-laptop to call SALS_FNLOCK_ON / SALS_FNLOCK_OFF on Fn-lock state change to get the LED in the Fn key to correctly reflect the Fn-lock state. Add a DMI match for the Legion 5 15ARH05 to the set_fn_lock_led_list[] table for this. Fixes: 81a5603a0f50 ("platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221215154357.123876-1-hdegoede@redhat.com commit ad75bd85b1db69c97eefea07b375567821f6ef58 Author: Hans de Goede Date: Tue Dec 13 13:29:43 2022 +0100 platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe The 0x153 version of the kbd backlight control SNC handle has no separate address to probe if the backlight is there. This turns the probe call into a set keyboard backlight call with a value of 0 turning off the keyboard backlight. Skip probing when there is no separate probe address to avoid this. Link: https://bugzilla.redhat.com/show_bug.cgi?id=1583752 Fixes: 800f20170dcf ("Keyboard backlight control for some Vaio Fit models") Signed-off-by: Hans de Goede Reviewed-by: Mattia Dongili Link: https://lore.kernel.org/r/20221213122943.11123-1-hdegoede@redhat.com commit af2808906aab0bf5786021d45b3ebfca6f4ad72f Author: David Woodhouse Date: Mon Dec 26 12:03:20 2022 +0000 KVM: x86/xen: Documentation updates and clarifications Most notably, the KVM_XEN_EVTCHN_RESET feature had escaped documentation entirely. Along with how to turn most stuff off on SHUTDOWN_soft_reset. Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-6-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit b0305c1e0e27ad91187bc6d5ac3d502799faf239 Author: David Woodhouse Date: Mon Dec 26 12:03:19 2022 +0000 KVM: x86/xen: Add KVM_XEN_INVALID_GPA and KVM_XEN_INVALID_GFN to uapi These are (uint64_t)-1 magic values are a userspace ABI, allowing the shared info pages and other enlightenments to be disabled. This isn't a Xen ABI because Xen doesn't let the guest turn these off except with the full SHUTDOWN_soft_reset mechanism. Under KVM, the userspace VMM is expected to handle soft reset, and tear down the kernel parts of the enlightenments accordingly. Suggested-by: Sean Christopherson Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-5-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 1c14faa5087db0a098c3ab1e183f2b5df4b0d3f2 Author: Michal Luczaj Date: Mon Dec 26 12:03:18 2022 +0000 KVM: x86/xen: Simplify eventfd IOCTLs Port number is validated in kvm_xen_setattr_evtchn(). Remove superfluous checks in kvm_xen_eventfd_assign() and kvm_xen_eventfd_update(). Signed-off-by: Michal Luczaj Message-Id: <20221222203021.1944101-3-mhal@rbox.co> Signed-off-by: Paolo Bonzini Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-4-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 70eae03087a3101493d9a1cf60c86c5f65600822 Author: Paolo Bonzini Date: Mon Dec 26 12:03:17 2022 +0000 KVM: x86/xen: Fix SRCU/RCU usage in readers of evtchn_ports The evtchnfd structure itself must be protected by either kvm->lock or SRCU. Use the former in kvm_xen_eventfd_update(), since the lock is being taken anyway; kvm_xen_hcall_evtchn_send() instead is a reader and does not need kvm->lock, and is called in SRCU critical section from the kvm_x86_handle_exit function. It is also important to use rcu_read_{lock,unlock}() in kvm_xen_hcall_evtchn_send(), because idr_remove() will *not* use synchronize_srcu() to wait for readers to complete. Remove a superfluous if (kvm) check before calling synchronize_srcu() in kvm_xen_eventfd_deassign() where kvm has been dereferenced already. Co-developed-by: Michal Luczaj Signed-off-by: Michal Luczaj Signed-off-by: Paolo Bonzini Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-3-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 92c58965e9656dc6e682a8ffe520fac0fb256d13 Author: David Woodhouse Date: Mon Dec 26 12:03:16 2022 +0000 KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly In particular, we shouldn't assume that being contiguous in guest virtual address space means being contiguous in guest *physical* address space. In dropping the manual calls to kvm_mmu_gva_to_gpa_system(), also drop the srcu_read_lock() that was around them. All call sites are reached from kvm_xen_hypercall() which is called from the handle_exit function with the read lock already held. 536395260 ("KVM: x86/xen: handle PV timers oneshot mode") 1a65105a5 ("KVM: x86/xen: handle PV spinlocks slowpath") Fixes: 2fd6df2f2 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-2-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 385407a69d5140825d4cdab814cbf128ba63a64a Author: Michal Luczaj Date: Mon Dec 26 12:03:15 2022 +0000 KVM: x86/xen: Fix memory leak in kvm_xen_write_hypercall_page() Release page irrespectively of kvm_vcpu_write_guest() return value. Suggested-by: Paul Durrant Fixes: 23200b7a30de ("KVM: x86/xen: intercept xen hypercalls if enabled") Signed-off-by: Michal Luczaj Message-Id: <20221220151454.712165-1-mhal@rbox.co> Reviewed-by: Paul Durrant Signed-off-by: David Woodhouse Message-Id: <20221226120320.1125390-1-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini commit 23e528d9bce2385967370ad95a7d52a3c7a0a016 Author: Sean Christopherson Date: Wed Dec 7 00:36:37 2022 +0000 KVM: Delete extra block of "};" in the KVM API documentation Delete an extra block of code/documentation that snuck in when KVM's documentation was converted to ReST format. Fixes: 106ee47dc633 ("docs: kvm: Convert api.txt to ReST format") Signed-off-by: Sean Christopherson Message-Id: <20221207003637.2041211-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 562f5bc48a8d99a8898c734ecacf061a79a88fbf Author: Lai Jiangshan Date: Wed Dec 7 20:05:05 2022 +0800 kvm: x86/mmu: Remove duplicated "be split" in spte.h "be split be split" -> "be split" Signed-off-by: Lai Jiangshan Message-Id: <20221207120505.9175-1-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit a303def0fc18f0f2393b5c5f8ae3d2657a9713dc Author: Lai Jiangshan Date: Wed Dec 7 20:06:16 2022 +0800 kvm: Remove the unused macro KVM_MMU_READ_{,UN}LOCK() No code is using KVM_MMU_READ_LOCK() or KVM_MMU_READ_UNLOCK(). They used to be in virt/kvm/pfncache.c: KVM_MMU_READ_LOCK(kvm); retry = mmu_notifier_retry_hva(kvm, mmu_seq, uhva); KVM_MMU_READ_UNLOCK(kvm); However, since 58cd407ca4c6 ("KVM: Fix multiple races in gfn=>pfn cache refresh", 2022-05-25) the code is only relying on the MMU notifier's invalidation count and sequence number. Signed-off-by: Lai Jiangshan Message-Id: <20221207120617.9409-1-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit e0a78525f540f9d9a44a296f307b8b74cee4c288 Author: Lukas Bulwahn Date: Mon Dec 5 09:20:44 2022 +0100 MAINTAINERS: adjust entry after renaming the vmx hyperv files Commit a789aeba4196 ("KVM: VMX: Rename "vmx/evmcs.{ch}" to "vmx/hyperv.{ch}"") renames the VMX specific Hyper-V files, but does not adjust the entry in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in KVM X86 HYPER-V (KVM/hyper-v). Signed-off-by: Lukas Bulwahn Fixes: a789aeba4196 ("KVM: VMX: Rename "vmx/evmcs.{ch}" to "vmx/hyperv.{ch}"") Reviewed-by: Sean Christopherson Message-Id: <20221205082044.10141-1-lukas.bulwahn@gmail.com> Signed-off-by: Paolo Bonzini commit 92c8191bb5d3f670ed806f91823381193288a4e1 Author: Oliver Upton Date: Fri Dec 9 01:53:02 2022 +0000 KVM: selftests: Mark correct page as mapped in virt_map() The loop marks vaddr as mapped after incrementing it by page size, thereby marking the *next* page as mapped. Set the bit in vpages_mapped first instead. Fixes: 56fc7732031d ("KVM: selftests: Fill in vm->vpages_mapped bitmap in virt_map() too") Signed-off-by: Oliver Upton Message-Id: <20221209015307.1781352-4-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 7a16142505cbb9b80d5e998e32b1d882e0f45d64 Author: Oliver Upton Date: Fri Dec 9 01:53:04 2022 +0000 KVM: arm64: selftests: Don't identity map the ucall MMIO hole Currently the ucall MMIO hole is placed immediately after slot0, which is a relatively safe address in the PA space. However, it is possible that the same address has already been used for something else (like the guest program image) in the VA space. At least in my own testing, building the vgic_irq test with clang leads to the MMIO hole appearing underneath gicv3_ops. Stop identity mapping the MMIO hole and instead find an unused VA to map to it. Yet another subtle detail of the KVM selftests library is that virt_pg_map() does not update vm->vpages_mapped. Switch over to virt_map() instead to guarantee that the chosen VA isn't to something else. Signed-off-by: Oliver Upton Message-Id: <20221209015307.1781352-6-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit feb84f6daa7e7d51444d13fa65df7d5562fd0075 Author: Paolo Bonzini Date: Mon Dec 12 05:36:53 2022 -0500 KVM: selftests: document the default implementation of vm_vaddr_populate_bitmap Explain the meaning of the bit manipulations of vm_vaddr_populate_bitmap. These correspond to the "canonical addresses" of x86 and other architectures, but that is not obvious. Signed-off-by: Paolo Bonzini commit 2f5213b8fc311eaa8fc78de7ecbd27ead027993c Author: Sean Christopherson Date: Fri Dec 9 12:55:44 2022 -0800 KVM: selftests: Use magic value to signal ucall_alloc() failure Use a magic value to signal a ucall_alloc() failure instead of simply doing GUEST_ASSERT(). GUEST_ASSERT() relies on ucall_alloc() and so a failure puts the guest into an infinite loop. Use -1 as the magic value, as a real ucall struct should never wrap. Reported-by: Oliver Upton Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit db7b780dab6742a8358ae7ecb1d0e972ccea8737 Author: Sean Christopherson Date: Tue Dec 13 00:16:50 2022 +0000 KVM: selftests: Disable "gnu-variable-sized-type-not-at-end" warning Disable gnu-variable-sized-type-not-at-end so that tests and libraries can create overlays of variable sized arrays at the end of structs when using a fixed number of entries, e.g. to get/set a single MSR. It's possible to fudge around the warning, e.g. by defining a custom struct that hardcodes the number of entries, but that is a burden for both developers and readers of the code. lib/x86_64/processor.c:664:19: warning: field 'header' with variable sized type 'struct kvm_msrs' not at the end of a struct or class is a GNU extension [-Wgnu-variable-sized-type-not-at-end] struct kvm_msrs header; ^ lib/x86_64/processor.c:772:19: warning: field 'header' with variable sized type 'struct kvm_msrs' not at the end of a struct or class is a GNU extension [-Wgnu-variable-sized-type-not-at-end] struct kvm_msrs header; ^ lib/x86_64/processor.c:787:19: warning: field 'header' with variable sized type 'struct kvm_msrs' not at the end of a struct or class is a GNU extension [-Wgnu-variable-sized-type-not-at-end] struct kvm_msrs header; ^ 3 warnings generated. x86_64/hyperv_tlb_flush.c:54:18: warning: field 'hv_vp_set' with variable sized type 'struct hv_vpset' not at the end of a struct or class is a GNU extension [-Wgnu-variable-sized-type-not-at-end] struct hv_vpset hv_vp_set; ^ 1 warning generated. x86_64/xen_shinfo_test.c:137:25: warning: field 'info' with variable sized type 'struct kvm_irq_routing' not at the end of a struct or class is a GNU extension [-Wgnu-variable-sized-type-not-at-end] struct kvm_irq_routing info; ^ 1 warning generated. Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-12-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5efb946b9569abdfb8a42702d40a5c244096e932 Author: Sean Christopherson Date: Tue Dec 13 00:16:49 2022 +0000 KVM: selftests: Include lib.mk before consuming $(CC) Include lib.mk before consuming $(CC) and document that lib.mk overwrites $(CC) unless make was invoked with -e or $(CC) was specified after make (which makes the environment override the Makefile). Including lib.mk after using it for probing, e.g. for -no-pie, can lead to weirdness. Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-11-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 7cf2e7373ab145bf972c3cbcb495fd1a9770c3b0 Author: Sean Christopherson Date: Tue Dec 13 00:16:48 2022 +0000 KVM: selftests: Explicitly disable builtins for mem*() overrides Explicitly disable the compiler's builtin memcmp(), memcpy(), and memset(). Because only lib/string_override.c is built with -ffreestanding, the compiler reserves the right to do what it wants and can try to link the non-freestanding code to its own crud. /usr/bin/x86_64-linux-gnu-ld: /lib/x86_64-linux-gnu/libc.a(memcmp.o): in function `memcmp_ifunc': (.text+0x0): multiple definition of `memcmp'; tools/testing/selftests/kvm/lib/string_override.o: tools/testing/selftests/kvm/lib/string_override.c:15: first defined here clang: error: linker command failed with exit code 1 (use -v to see invocation) Fixes: 6b6f71484bf4 ("KVM: selftests: Implement memcmp(), memcpy(), and memset() for guest use") Reported-by: Aaron Lewis Reported-by: Raghavendra Rao Ananta Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-10-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 2b2d8afc1acf6396bea14ef973d0029c4a5b33f4 Author: Sean Christopherson Date: Tue Dec 13 00:16:47 2022 +0000 KVM: selftests: Probe -no-pie with actual CFLAGS used to compile Probe -no-pie with the actual set of CFLAGS used to compile the tests, clang whines about -no-pie being unused if the tests are compiled with -static. clang: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-9-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5dc38777a7de15109a1d45b42cf2bb7f1bbe6010 Author: Sean Christopherson Date: Tue Dec 13 00:16:46 2022 +0000 KVM: selftests: Use proper function prototypes in probing code Make the main() functions in the probing code proper prototypes so that compiling the probing code with more strict flags won't generate false negatives. :1:5: error: function declaration isn’t a prototype [-Werror=strict-prototypes] Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-8-seanjc@google.com> Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Paolo Bonzini commit 6a5db83adfd668b3c1092274ddf45903eb1fe435 Author: Sean Christopherson Date: Tue Dec 13 00:16:45 2022 +0000 KVM: selftests: Rename UNAME_M to ARCH_DIR, fill explicitly for x86 Rename UNAME_M to ARCH_DIR and explicitly set it directly for x86. At this point, the name of the arch directory really doesn't have anything to do with `uname -m`, and UNAME_M is unnecessarily confusing given that its purpose is purely to identify the arch specific directory. Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-7-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1525429fe5cb8e23b74c6dd473bb477a35906704 Author: Sean Christopherson Date: Tue Dec 13 00:16:44 2022 +0000 KVM: selftests: Fix a typo in x86-64's kvm_get_cpu_address_width() Fix a == vs. = typo in kvm_get_cpu_address_width() that results in @pa_bits being left unset if the CPU doesn't support enumerating its MAX_PHY_ADDR. Flagged by clang's unusued-value warning. lib/x86_64/processor.c:1034:51: warning: expression result unused [-Wunused-value] *pa_bits == kvm_cpu_has(X86_FEATURE_PAE) ? 36 : 32; Fixes: 3bd396353d18 ("KVM: selftests: Add X86_FEATURE_PAE and use it calc "fallback" MAXPHYADDR") Signed-off-by: Sean Christopherson Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20221213001653.3852042-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 43e96957e8b87bad8e4ba666750ff0cda9e03ffb Author: Sean Christopherson Date: Tue Dec 13 00:16:43 2022 +0000 KVM: selftests: Use pattern matching in .gitignore Use pattern matching to exclude everything except .c, .h, .S, and .sh files from Git. Manually adding every test target has an absurd maintenance cost, is comically error prone, and leads to bikeshedding over whether or not the targets should be listed in alphabetical order. Deliberately do not include the one-off assets, e.g. config, settings, .gitignore itself, etc as Git doesn't ignore files that are already in the repository. Adding the one-off assets won't prevent mistakes where developers forget to --force add files that don't match the "allowed". Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit d61a12cb9af5b355a38e0c0106e91224b49195ce Author: Sean Christopherson Date: Tue Dec 13 00:16:42 2022 +0000 KVM: selftests: Fix divide-by-zero bug in memslot_perf_test Check that the number of pages per slot is non-zero in get_max_slots() prior to computing the remaining number of pages. clang generates code that uses an actual DIV for calculating the remaining, which causes a #DE if the total number of pages is less than the number of slots. traps: memslot_perf_te[97611] trap divide error ip:4030c4 sp:7ffd18ae58f0 error:0 in memslot_perf_test[401000+cb000] Fixes: a69170c65acd ("KVM: selftests: memslot_perf_test: Report optimal memory slots") Signed-off-by: Sean Christopherson Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20221213001653.3852042-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 73441efa36c253906057b8800bc9a3fdadbc2c41 Author: Sean Christopherson Date: Tue Dec 13 00:16:41 2022 +0000 KVM: selftests: Delete dead code in x86_64/vmx_tsc_adjust_test.c Delete an unused struct definition in x86_64/vmx_tsc_adjust_test.c. Signed-off-by: Sean Christopherson Message-Id: <20221213001653.3852042-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit e779fd53b4aa0aa8704ae62eb56065b9877a540b Author: Sean Christopherson Date: Tue Dec 13 00:16:40 2022 +0000 KVM: selftests: Define literal to asm constraint in aarch64 as unsigned long Define a literal '0' asm input constraint to aarch64/page_fault_test's guest_cas() as an unsigned long to make clang happy. tools/testing/selftests/kvm/aarch64/page_fault_test.c:120:16: error: value size does not match register size specified by the constraint and modifier [-Werror,-Wasm-operand-widths] :: "r" (0), "r" (TEST_DATA), "r" (guest_test_memory)); ^ tools/testing/selftests/kvm/aarch64/page_fault_test.c:119:15: note: use constraint modifier "w" "casal %0, %1, [%2]\n" ^~ %w0 Fixes: 35c581015712 ("KVM: selftests: aarch64: Add aarch64/page_fault_test") Cc: Ricardo Koller Signed-off-by: Sean Christopherson Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20221213001653.3852042-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit cb8fd6f75775165390ededea8799b60d93d9fe3e Author: Gaosheng Cui Date: Sat Nov 26 12:49:11 2022 +0800 memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() The clk_disable_unprepare() should be called in the error handling of devbus_get_timing_params() and of_platform_populate(), fix it by replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled. Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221126044911.7226-1-cuigaosheng1@huawei.com Signed-off-by: Krzysztof Kozlowski commit 340cb392a038cf70540a4cdf2e98a247c66b6df4 Author: Gaosheng Cui Date: Fri Nov 25 15:37:57 2022 +0800 memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() The clk_disable_unprepare() should be called in the error handling of caps->has_mpddr_clk, fix it by replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled. Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221125073757.3535219-1-cuigaosheng1@huawei.com Signed-off-by: Krzysztof Kozlowski commit ef86b2c2807f41c045e5534d8513a8b83f63bc39 Author: Ashish Mhetre Date: Fri Nov 25 09:37:52 2022 +0530 memory: tegra: Remove clients SID override programming On newer Tegra releases, early boot SID override programming and SID override programming during resume is handled by bootloader. In the function tegra186_mc_program_sid() which is getting removed, SID override register of all clients is written without checking if secure firmware has allowed write on it or not. If write is disabled by secure firmware then it can lead to errors coming from secure firmware and hang in kernel boot. Also, SID override is programmed on-demand during probe_finalize() call of IOMMU which is done in tegra186_mc_client_sid_override() in this same file. This function does it correctly by checking if write is permitted on SID override register. It also checks if SID override register is already written with correct value and skips re-writing it in that case. Fixes: 393d66fd2cac ("memory: tegra: Implement SID override programming") Signed-off-by: Ashish Mhetre Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20221125040752.12627-1-amhetre@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 827e0920dbfb0d92416e56081d70745597403446 Author: Benedikt Niedermayr Date: Fri Dec 9 12:28:28 2022 +0100 memory: omap-gpmc: fix wait pin validation This bug has been introduced after switching from -1 to UINT_MAX for GPMC_WAITPIN_INVALID. The bug leads to an error when the optional gpmc,wait-pin dt-property is not used: ... gpmc_cs_program_settings: invalid wait-pin (-1) ... Signed-off-by: Benedikt Niedermayr Fixes: 8dd7e4af5853 ("memory: omap-gpmc: fix coverity issue "Control flow issues"") Acked-by: Roger Quadros Tested-by: Tony Lindgren Link: https://lore.kernel.org/r/20221209112828.581491-1-benedikt.niedermayr@siemens.com Signed-off-by: Krzysztof Kozlowski commit c28f3d80383571d3630df1a0e89500d23e855924 Author: Utkarsh Patel Date: Thu Dec 22 20:22:46 2022 -0800 thunderbolt: Do not report errors if on-board retimers are found Currently we return an error even if on-board retimers are found and that's not expected. Fix this to return an error only if there was one and 0 otherwise. Fixes: 1e56c88adecc ("thunderbolt: Runtime resume USB4 port when retimers are scanned") Cc: stable@vger.kernel.org Signed-off-by: Utkarsh Patel Signed-off-by: Mika Westerberg commit 01c5bb0cc2a39fbc56ff9a5ef28b79447f0c2351 Author: Sumit Gupta Date: Tue Dec 20 21:32:37 2022 +0530 cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist Tegra234 platform uses the tegra194-cpufreq driver, so add it to the blocklist in cpufreq-dt-platdev driver to avoid the cpufreq driver registration from there. Signed-off-by: Sumit Gupta Signed-off-by: Viresh Kumar commit 1a6a8b0080b09bf14a7d45abfe8020bd63306c17 Author: Konrad Dybcio Date: Tue Dec 20 14:39:10 2022 +0100 cpufreq: qcom-hw: Fix reading "reg" with address/size-cells != 2 Commit 054a3ef683a1 ("cpufreq: qcom-hw: Allocate qcom_cpufreq_data during probe") assumed that every reg variable is 4*u32 wide (as most new qcom SoCs set #address- and #size-cells to <2>. That is not the case for all of them though. Check the cells values dynamically to ensure the proper region of the DTB is being read. Fixes: 054a3ef683a1 ("cpufreq: qcom-hw: Allocate qcom_cpufreq_data during probe") Signed-off-by: Konrad Dybcio Signed-off-by: Viresh Kumar commit f5f94b9c8b805d87ff185caf9779c3a4d07819e3 Author: Pierre Gondois Date: Tue Dec 20 11:12:25 2022 +0100 cpufreq: CPPC: Add u64 casts to avoid overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using _CPC's values, add 'u64' casts. Signed-off-by: Pierre Gondois Signed-off-by: Viresh Kumar commit 83749a2ee548f568ce2037749e19602fdc9f3ee3 Author: Arnd Bergmann Date: Thu Dec 15 17:55:15 2022 +0100 cpufreq: apple: remove duplicate intializer When -Woverride-init is enabled, gcc notices that the .attr field is initialized twice: drivers/cpufreq/apple-soc-cpufreq.c:331:27: error: initialized field overwritten [-Werror=override-init] 331 | .attr = apple_soc_cpufreq_hw_attr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ Remove the first one, since this is not actually used. Signed-off-by: Arnd Bergmann Reviewed-by: Eric Curtin Signed-off-by: Viresh Kumar commit 37e14e4f3715428b809e4df9a9958baa64c77d51 Author: Adam Vodopjan Date: Fri Dec 9 09:26:34 2022 +0000 ata: ahci: Fix PCS quirk application for suspend Since kernel 5.3.4 my laptop (ICH8M controller) does not see Kingston SV300S37A60G SSD disk connected into a SATA connector on wake from suspend. The problem was introduced in c312ef176399 ("libata/ahci: Drop PCS quirk for Denverton and beyond"): the quirk is not applied on wake from suspend as it originally was. It is worth to mention the commit contained another bug: the quirk is not applied at all to controllers which require it. The fix commit 09d6ac8dc51a ("libata/ahci: Fix PCS quirk application") landed in 5.3.8. So testing my patch anywhere between commits c312ef176399 and 09d6ac8dc51a is pointless. Not all disks trigger the problem. For example nothing bad happens with Western Digital WD5000LPCX HDD. Test hardware: - Acer 5920G with ICH8M SATA controller - sda: some SATA HDD connnected into the DVD drive IDE port with a SATA-IDE caddy. It is a boot disk - sdb: Kingston SV300S37A60G SSD connected into the only SATA port Sample "dmesg --notime | grep -E '^(sd |ata)'" output on wake: sd 0:0:0:0: [sda] Starting disk sd 2:0:0:0: [sdb] Starting disk ata4: SATA link down (SStatus 4 SControl 300) ata3: SATA link down (SStatus 4 SControl 300) ata1.00: ACPI cmd ef/03:0c:00:00:00:a0 (SET FEATURES) filtered out ata1.00: ACPI cmd ef/03:42:00:00:00:a0 (SET FEATURES) filtered out ata1: FORCE: cable set to 80c ata5: SATA link down (SStatus 0 SControl 300) ata3: SATA link down (SStatus 4 SControl 300) ata3: SATA link down (SStatus 4 SControl 300) ata3.00: disabled sd 2:0:0:0: rejecting I/O to offline device ata3.00: detaching (SCSI 2:0:0:0) sd 2:0:0:0: [sdb] Start/Stop Unit failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK sd 2:0:0:0: [sdb] Synchronizing SCSI cache sd 2:0:0:0: [sdb] Synchronize Cache(10) failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK sd 2:0:0:0: [sdb] Stopping disk sd 2:0:0:0: [sdb] Start/Stop Unit failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK Commit c312ef176399 dropped ahci_pci_reset_controller() which internally calls ahci_reset_controller() and applies the PCS quirk if needed after that. It was called each time a reset was required instead of just ahci_reset_controller(). This patch puts the function back in place. Fixes: c312ef176399 ("libata/ahci: Drop PCS quirk for Denverton and beyond") Signed-off-by: Adam Vodopjan Signed-off-by: Damien Le Moal commit ce9ef749a2fa9048c1ebacc3194b17a9628512f5 Merge: 3e78986a840d5 9a9134fd56f6b Author: Mark Brown Date: Tue Dec 27 00:03:16 2022 +0000 ASoC: SOF: Fixes for suspend after firmware crash Merge series from Peter Ujfalusi : This series contails 2 patches to fix device suspend after a firmware crash and another patch to allow reading the FW state from debugfs. commit e8bb8f19e73a1e855e54788f8673b9b49e46b5cd Author: Witold Sadowski Date: Mon Dec 19 06:42:48 2022 -0800 spi: cadence: Fix busy cycles calculation If xSPI is in x2/x4/x8 mode to calculate busy cycles, busy bits count must be divided by the number of lanes. If opcommand is using 8 busy bits, but SPI is in x4 mode, there will be only 2 busy cycles. Signed-off-by: Witold Sadowski Reviewed-by: Chandrakala Chavva Reviewed-by: Sunil Kovvuri Goutham Link: https://lore.kernel.org/r/20221219144254.20883-2-wsadowski@marvell.com Signed-off-by: Mark Brown commit b24cded8c065d7cef8690b2c7b82b828cce57708 Author: Ricardo Ribalda Date: Sun Dec 25 09:37:12 2022 +0100 spi: mediatek: Enable irq before the spi registration If the irq is enabled after the spi si registered, there can be a race with the initialization of the devices on the spi bus. Eg: mtk-spi 1100a000.spi: spi-mem transfer timeout spi-nor: probe of spi0.0 failed with error -110 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: mtk_spi_can_dma+0x0/0x2c Fixes: c6f7874687f7 ("spi: mediatek: Enable irq when pdata is ready") Reported-by: Daniel Golle Signed-off-by: Ricardo Ribalda Tested-by: Daniel Golle Link: https://lore.kernel.org/r/20221225-mtk-spi-fixes-v1-0-bb6c14c232f8@chromium.org Signed-off-by: Mark Brown commit 3e78986a840d59dd27e636eae3f52dc11125c835 Author: Arnd Bergmann Date: Wed Dec 21 14:24:56 2022 +0100 ASoC: Intel: sof-nau8825: fix module alias overflow The maximum name length for a platform_device_id entry is 20 characters including the trailing NUL byte. The sof_nau8825.c file exceeds that, which causes an obscure error message: sound/soc/intel/boards/snd-soc-sof_nau8825.mod.c:35:45: error: illegal character encoding in string literal [-Werror,-Winvalid-source-encoding] MODULE_ALIAS("platform:adl_max98373_nau8825"); ^~~~ include/linux/module.h:168:49: note: expanded from macro 'MODULE_ALIAS' ^~~~~~ include/linux/module.h:165:56: note: expanded from macro 'MODULE_INFO' ^~~~ include/linux/moduleparam.h:26:47: note: expanded from macro '__MODULE_INFO' = __MODULE_INFO_PREFIX __stringify(tag) "=" info I could not figure out how to make the module handling robust enough to handle this better, but as a quick fix, using slightly shorter names that are still unique avoids the build issue. Fixes: 8d0872f6239f ("ASoC: Intel: add sof-nau8825 machine driver") Signed-off-by: Arnd Bergmann Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221221132515.2363276-1-arnd@kernel.org Signed-off-by: Mark Brown commit 63f3d99b7efe4c5404a9388c05780917099cecf4 Author: Arnd Bergmann Date: Wed Dec 21 14:25:48 2022 +0100 ASoC: Intel: fix sof-nau8825 link failure The snd-soc-sof_nau8825.ko module fails to link unless the sof_realtek_common support is also enabled: ERROR: modpost: "sof_rt1015p_codec_conf" [sound/soc/intel/boards/snd-soc-sof_nau8825.ko] undefined! ERROR: modpost: "sof_rt1015p_dai_link" [sound/soc/intel/boards/snd-soc-sof_nau8825.ko] undefined! Fixes: 8d0872f6239f ("ASoC: Intel: add sof-nau8825 machine driver") Signed-off-by: Arnd Bergmann Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221221132559.2402341-1-arnd@kernel.org Signed-off-by: Mark Brown commit ba7523bb0f494fc440d3a9bb0b665cfcaa192d0c Author: Ajye Huang Date: Thu Dec 22 12:26:24 2022 +0800 ASoC: Intel: sof_nau8825: add variant with nau8318 amplifier. This patch adds the driver data for two nau8318 speaker amplifiers on SSP1 and nau8825 on SSP0 for ADL platform. The nau8315 and nau8318 are both Nuvoton Amp chips. They use the same Amp driver nau8315.c. The acpi_device_id for nau8315 is "NVTN2010", for nau8318 is "NVTN2012". The nau8825 is one of Nuvoton headset codec, and its acpi_device_id is "10508825". Signed-off-by: Ajye Huang Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221222042624.557869-1-ajye_huang@compal.corp-partner.google.com Signed-off-by: Mark Brown commit 68506a173dd700c2bd794dcc3489edcdb8ee35c6 Author: Wim Van Boven Date: Fri Dec 16 09:18:27 2022 +0100 ASoC: amd: yc: Add Razer Blade 14 2022 into DMI table Razer Blade 14 (2022) - RZ09-0427 needs the quirk to enable the built in microphone Signed-off-by: Wim Van Boven Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20221216081828.12382-1-wimvanboven@gmail.com Signed-off-by: Mark Brown commit b25a31b463391cc47a654594eb154ebf5dd0d60a Author: Gongjun Song Date: Mon Dec 26 09:09:17 2022 +0800 ASoC: Intel: soc-acpi: add configuration for variant of 0C11 product Support configuration with SoundWire RT1318 amplifiers on link1 and link2, and RT711 on link0 for headphone/headset. This product does not support local microphones. Signed-off-by: Gongjun Song Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20221226010917.2632973-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 896c3dc21f1e84cb2f60d54572fc3377eb57e004 Author: Gongjun Song Date: Mon Dec 26 09:09:16 2022 +0800 ASoC: Intel: soc-acpi: add configuration for variant of 0C40 product Support configuration with SoundWire RT1316 amplifiers on link0 and link1, and RT711 on link2 for headphone/headset. This product does not support local microphones. Signed-off-by: Gongjun Song Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20221226010917.2632973-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 93ef83050e597634d2c7dc838a28caf5137b9404 Author: YoungJun.park Date: Fri Oct 28 07:42:41 2022 -0700 kunit: alloc_string_stream_fragment error handling bug fix When it fails to allocate fragment, it does not free and return error. And check the pointer inappropriately. Fixed merge conflicts with commit 618887768bb7 ("kunit: update NULL vs IS_ERR() tests") Shuah Khan Signed-off-by: YoungJun.park Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 8c3313e8556b8a817e7b4bc9c249b58855a7e49c Author: Corentin Labbe Date: Mon Dec 12 12:44:23 2022 +0000 arm64: dts: rockchip: use correct reset names for rk3399 crypto nodes The reset names does not follow the binding, use the correct ones. Fixes: 8c701fa6e38c ("arm64: dts: rockchip: rk3399: add crypto node") Signed-off-by: Corentin Labbe Link: https://lore.kernel.org/r/20221212124423.1239748-1-clabbe@baylibre.com Signed-off-by: Heiko Stuebner commit 88d356ca41ba1c3effc2d4208dfbd4392f58cd6d Author: Christoph Hellwig Date: Sun Dec 25 11:32:32 2022 +0100 nvme-pci: update sqsize when adjusting the queue depth Update the core sqsize field in addition to the PCIe-specific q_depth field as the core tagset allocation helpers rely on it. Fixes: 0da7feaa5913 ("nvme-pci: use the tagset alloc/free helpers") Signed-off-by: Christoph Hellwig Acked-by: Hugh Dickins Link: https://lore.kernel.org/r/20221225103234.226794-3-hch@lst.de Signed-off-by: Jens Axboe commit 33b93727ce90c8db916fb071ed13e90106339754 Author: Christoph Hellwig Date: Sun Dec 25 11:32:31 2022 +0100 nvme: fix setting the queue depth in nvme_alloc_io_tag_set While the CAP.MQES field in NVMe is a 0s based filed with a natural one off, we also need to account for the queue wrap condition and fix undo the one off again in nvme_alloc_io_tag_set. This was never properly done by the fabrics drivers, but they don't seem to care because there is no actual physical queue that can wrap around, but it became a problem when converting over the PCIe driver. Also add back the BLK_MQ_MAX_DEPTH check that was lost in the same commit. Fixes: 0da7feaa5913 ("nvme-pci: use the tagset alloc/free helpers") Reported-by: Hugh Dickins Signed-off-by: Christoph Hellwig Tested-by: Hugh Dickins Link: https://lore.kernel.org/r/20221225103234.226794-2-hch@lst.de Signed-off-by: Jens Axboe commit 246cf66e300b76099b5dbd3fdd39e9a5dbc53f02 Author: Yu Kuai Date: Mon Dec 26 11:06:05 2022 +0800 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq(). Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") Reported-by: Yi Zhang Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20221226030605.1437081-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit d4542f314507015ac0e25c6e8102b88293826a51 Author: Darrick J. Wong Date: Mon Dec 26 10:11:18 2022 -0800 xfs: make xfs_iomap_page_ops static Shut up the sparse warnings about this variable that isn't referenced anywhere else. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 26870c3f5b15187268bf183055c7b9f29fe66079 Author: Darrick J. Wong Date: Mon Dec 26 10:11:17 2022 -0800 xfs: don't assert if cmap covers imap after cycling lock In xfs_reflink_fill_cow_hole, there's a debugging assertion that trips if (after cycling the ILOCK to get a transaction) the requeried cow mapping overlaps the start of the area being written. IOWs, it trips if the hole in the cow fork that it's supposed to fill has been filled. This is trivially possible since we cycled ILOCK_EXCL. If we trip the assertion, then we know that cmap is a delalloc extent because @found is false. Fortunately, the bmapi_write call below will convert the delalloc extent to a real unwritten cow fork extent, so all we need to do here is remove the assertion. It turns out that generic/095 trips this pretty regularly with alwayscow mode enabled. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit a4517c4f3423c7c448f2c359218f97c1173523a1 Author: Chris Chiu Date: Mon Dec 26 19:43:03 2022 +0800 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops The Dell Latiture 3340/3440/3540 laptops with Realtek ALC3204 have dual codecs and need the ALC1220_FIXUP_GB_DUAL_CODECS to fix the conflicts of Master controls. The existing headset mic fixup for Dell is also required to enable the jack sense and the headset mic. Introduce a new fixup to fix the dual codec and headset mic issues for particular Dell laptops since other old Dell laptops with the same codec configuration are already well handled by the fixup in alc269_fallback_pin_fixup_tbl[]. Signed-off-by: Chris Chiu Cc: Link: https://lore.kernel.org/r/20221226114303.4027500-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit d3805695fe1e7383517903715cefc9bbdcffdc90 Author: Anuradha Weeraman Date: Sun Dec 25 23:12:22 2022 +0530 net: ethernet: marvell: octeontx2: Fix uninitialized variable warning Fix for uninitialized variable warning. Addresses-Coverity: ("Uninitialized scalar variable") Signed-off-by: Anuradha Weeraman Signed-off-by: David S. Miller commit df49908f3c52d211aea5e2a14a93bbe67a2cb3af Author: Miaoqian Lin Date: Fri Dec 23 11:37:18 2022 +0400 nfc: Fix potential resource leaks nfc_get_device() take reference for the device, add missing nfc_put_device() to release it when not need anymore. Also fix the style warnning by use error EOPNOTSUPP instead of ENOTSUPP. Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation") Fixes: 29e76924cf08 ("nfc: netlink: Add capability to reply to vendor_cmd with data") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller commit 30e725537546248bddc12eaac2fe0a258917f190 Author: Johnny S. Lee Date: Thu Dec 22 22:34:05 2022 +0800 net: dsa: mv88e6xxx: depend on PTP conditionally PTP hardware timestamping related objects are not linked when PTP support for MV88E6xxx (NET_DSA_MV88E6XXX_PTP) is disabled, therefore NET_DSA_MV88E6XXX should not depend on PTP_1588_CLOCK_OPTIONAL regardless of NET_DSA_MV88E6XXX_PTP. Instead, condition more strictly on how NET_DSA_MV88E6XXX_PTP's dependencies are met, making sure that it cannot be enabled when NET_DSA_MV88E6XXX=y and PTP_1588_CLOCK=m. In other words, this commit allows NET_DSA_MV88E6XXX to be built-in while PTP_1588_CLOCK is a module, as long as NET_DSA_MV88E6XXX_PTP is prevented from being enabled. Fixes: e5f31552674e ("ethernet: fix PTP_1588_CLOCK dependencies") Signed-off-by: Johnny S. Lee Signed-off-by: David S. Miller commit 13a7c8964afcd8ca43c0b6001ebb0127baa95362 Author: Daniil Tatianin Date: Thu Dec 22 14:52:28 2022 +0300 qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure adapter->dcb would get silently freed inside qlcnic_dcb_enable() in case qlcnic_dcb_attach() would return an error, which always happens under OOM conditions. This would lead to use-after-free because both of the existing callers invoke qlcnic_dcb_get_info() on the obtained pointer, which is potentially freed at that point. Propagate errors from qlcnic_dcb_enable(), and instead free the dcb pointer at callsite using qlcnic_dcb_free(). This also removes the now unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around kfree() also causing memory leaks for partially initialized dcb. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 3c44bba1d270 ("qlcnic: Disable DCB operations from SR-IOV VFs") Reviewed-by: Michal Swiatkowski Signed-off-by: Daniil Tatianin Signed-off-by: David S. Miller commit 399ab7fe0fa0d846881685fd4e57e9a8ef7559f7 Author: Hawkins Jiawei Date: Thu Dec 22 11:51:19 2022 +0800 net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810c287f00 (size 256): comm "syz-executor105", pid 3600, jiffies 4294943292 (age 12.990s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046 [] kmalloc include/linux/slab.h:576 [inline] [] kmalloc_array include/linux/slab.h:627 [inline] [] kcalloc include/linux/slab.h:659 [inline] [] tcf_exts_init include/net/pkt_cls.h:250 [inline] [] tcindex_set_parms+0xa7/0xbe0 net/sched/cls_tcindex.c:342 [] tcindex_change+0xdf/0x120 net/sched/cls_tcindex.c:553 [] tc_new_tfilter+0x4f2/0x1100 net/sched/cls_api.c:2147 [] rtnetlink_rcv_msg+0x4dc/0x5d0 net/core/rtnetlink.c:6082 [] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2540 [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [] sock_sendmsg_nosec net/socket.c:714 [inline] [] sock_sendmsg+0x56/0x80 net/socket.c:734 [] ____sys_sendmsg+0x178/0x410 net/socket.c:2482 [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [] __sys_sendmmsg+0x105/0x330 net/socket.c:2622 [] __do_sys_sendmmsg net/socket.c:2651 [inline] [] __se_sys_sendmmsg net/socket.c:2648 [inline] [] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2648 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd ==================================== Kernel uses tcindex_change() to change an existing filter properties. Yet the problem is that, during the process of changing, if `old_r` is retrieved from `p->perfect`, then kernel uses tcindex_alloc_perfect_hash() to newly allocate filter results, uses tcindex_filter_result_init() to clear the old filter result, without destroying its tcf_exts structure, which triggers the above memory leak. To be more specific, there are only two source for the `old_r`, according to the tcindex_lookup(). `old_r` is retrieved from `p->perfect`, or `old_r` is retrieved from `p->h`. * If `old_r` is retrieved from `p->perfect`, kernel uses tcindex_alloc_perfect_hash() to newly allocate the filter results. Then `r` is assigned with `cp->perfect + handle`, which is newly allocated. So condition `old_r && old_r != r` is true in this situation, and kernel uses tcindex_filter_result_init() to clear the old filter result, without destroying its tcf_exts structure * If `old_r` is retrieved from `p->h`, then `p->perfect` is NULL according to the tcindex_lookup(). Considering that `cp->h` is directly copied from `p->h` and `p->perfect` is NULL, `r` is assigned with `tcindex_lookup(cp, handle)`, whose value should be the same as `old_r`, so condition `old_r && old_r != r` is false in this situation, kernel ignores using tcindex_filter_result_init() to clear the old filter result. So only when `old_r` is retrieved from `p->perfect` does kernel use tcindex_filter_result_init() to clear the old filter result, which triggers the above memory leak. Considering that there already exists a tc_filter_wq workqueue to destroy the old tcindex_data by tcindex_partial_destroy_work() at the end of tcindex_set_parms(), this patch solves this memory leak bug by removing this old filter result clearing part and delegating it to the tc_filter_wq workqueue. Note that this patch doesn't introduce any other issues. If `old_r` is retrieved from `p->perfect`, this patch just delegates old filter result clearing part to the tc_filter_wq workqueue; If `old_r` is retrieved from `p->h`, kernel doesn't reach the old filter result clearing part, so removing this part has no effect. [Thanks to the suggestion from Jakub Kicinski, Cong Wang, Paolo Abeni and Dmitry Vyukov] Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()") Link: https://lore.kernel.org/all/0000000000001de5c505ebc9ec59@google.com/ Reported-by: syzbot+232ebdbd36706c965ebf@syzkaller.appspotmail.com Tested-by: syzbot+232ebdbd36706c965ebf@syzkaller.appspotmail.com Cc: Cong Wang Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Dmitry Vyukov Acked-by: Paolo Abeni Signed-off-by: Hawkins Jiawei Signed-off-by: David S. Miller commit b8800d324abb50160560c636bfafe2c81001b66c Author: Artem Egorkine Date: Sun Dec 25 12:57:28 2022 +0200 ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messages are sent to a PODxt device. Signed-off-by: Artem Egorkine Cc: Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com Signed-off-by: Takashi Iwai commit 8508fa2e7472f673edbeedf1b1d2b7a6bb898ecc Author: Artem Egorkine Date: Sun Dec 25 12:57:27 2022 +0200 ALSA: line6: correct midi status byte when receiving data from podxt A PODxt device sends 0xb2, 0xc2 or 0xf2 as a status byte for MIDI messages over USB that should otherwise have a 0xb0, 0xc0 or 0xf0 status byte. This is usually corrected by the driver on other OSes. This fixes MIDI sysex messages sent by PODxt. [ tiwai: fixed white spaces ] Signed-off-by: Artem Egorkine Cc: Link: https://lore.kernel.org/r/20221225105728.1153989-1-arteme@gmail.com Signed-off-by: Takashi Iwai commit 1b929c02afd37871d5afb9d498426f83432e71c2 Author: Linus Torvalds Date: Sun Dec 25 13:41:39 2022 -0800 Linux 6.2-rc1 commit 292a089d78d3e2f7944e60bb897c977785a321e3 Author: Steven Rostedt (Google) Date: Tue Dec 20 13:45:19 2022 -0500 treewide: Convert del_timer*() to timer_shutdown*() Due to several bugs caused by timers being re-armed after they are shutdown and just before they are freed, a new state of timers was added called "shutdown". After a timer is set to this state, then it can no longer be re-armed. The following script was run to find all the trivial locations where del_timer() or del_timer_sync() is called in the same function that the object holding the timer is freed. It also ignores any locations where the timer->function is modified between the del_timer*() and the free(), as that is not considered a "trivial" case. This was created by using a coccinelle script and the following commands: $ cat timer.cocci @@ expression ptr, slab; identifier timer, rfield; @@ ( - del_timer(&ptr->timer); + timer_shutdown(&ptr->timer); | - del_timer_sync(&ptr->timer); + timer_shutdown_sync(&ptr->timer); ) ... when strict when != ptr->timer ( kfree_rcu(ptr, rfield); | kmem_cache_free(slab, ptr); | kfree(ptr); ) $ spatch timer.cocci . > /tmp/t.patch $ patch -p1 < /tmp/t.patch Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ Signed-off-by: Steven Rostedt (Google) Acked-by: Pavel Machek [ LED ] Acked-by: Kalle Valo [ wireless ] Acked-by: Paolo Abeni [ networking ] Signed-off-by: Linus Torvalds commit be1236fce5f4ac94915cdca8c61bb6e0e1503b81 Merge: 256cbafb0a9a3 fcbb408a1aaf4 Author: David S. Miller Date: Sat Dec 24 09:39:02 2022 +0000 Merge tag 'for-netdev' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 7 non-merge commits during the last 5 day(s) which contain a total of 11 files changed, 231 insertions(+), 3 deletions(-). The main changes are: 1) Fix a splat in bpf_skb_generic_pop() under CHECKSUM_PARTIAL due to misuse of skb_postpull_rcsum(), from Jakub Kicinski with test case from Martin Lau. 2) Fix BPF verifier's nullness propagation when registers are of type PTR_TO_BTF_ID, from Hao Sun. 3) Fix bpftool build for JIT disassembler under statically built libllvm, from Anton Protopopov. 4) Fix warnings reported by resolve_btfids when building vmlinux with CONFIG_SECURITY_NETWORK disabled, from Hou Tao. 5) Minor fix up for BPF selftest gitignore, from Stanislav Fomichev. ==================== Signed-off-by: David S. Miller commit 72a85e2b0a1e1e6fb4ee51ae902730212b2de25c Merge: 0a023cbb11e3d 3b553e0041a65 Author: Linus Torvalds Date: Fri Dec 23 14:44:08 2022 -0800 Merge tag 'spi-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One driver specific change here which handles the case where a SPI device for some reason tries to change the bus speed during a message on fsl_spi hardware, this should be very unusual" * tag 'spi-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: fsl_spi: Don't change speed while chipselect is active commit 0a023cbb11e3d05c39dbb67317cb77ef22d47404 Merge: 2c91ce92c6d99 cb3543cff90a4 Author: Linus Torvalds Date: Fri Dec 23 14:38:00 2022 -0800 Merge tag 'regulator-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Two core fixes here, one for a long standing race which some Qualcomm systems have started triggering with their UFS driver and another fixing a problem with supply lookup introduced by the fixes for devm related use after free issues that were introduced in this merge window" * tag 'regulator-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: fix deadlock on regulator enable regulator: core: Fix resolve supply lookup issue commit 523dfa96add75e60cfe6bf5a1c8f713635cd6b73 Author: Arnd Bergmann Date: Thu Dec 15 17:34:49 2022 +0100 drm/tests: reduce drm_mm_test stack usage The check_reserve_boundaries function uses a lot of kernel stack, and it gets inlined by clang, which makes __drm_test_mm_reserve use even more of it, to the point of hitting the warning limit: drivers/gpu/drm/tests/drm_mm_test.c:344:12: error: stack frame size (1048) exceeds limit (1024) in '__drm_test_mm_reserve' [-Werror,-Wframe-larger-than] When building with gcc, this does not happen, but the structleak plugin can similarly increase the stack usage and needs to be disabled, as we do for all other kunit users. Signed-off-by: Arnd Bergmann Reviewed-by: Maíra Canal Reviewed-by: Nathan Chancellor Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20221215163511.266214-1-arnd@kernel.org commit 2c91ce92c6d99fe8ed0fde2e67c19d40f062e8a3 Merge: 51094a24b85e2 2d63e6a3d9713 Author: Linus Torvalds Date: Fri Dec 23 13:56:41 2022 -0800 Merge tag 'coccinelle-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccicheck update from Julia Lawall: "Modernize use of grep in coccicheck: Use 'grep -E' instead of 'egrep'" * tag 'coccinelle-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: scripts: coccicheck: use "grep -E" instead of "egrep" commit fcbb408a1aaf426f88d8fb3b4c14e3625745b02f Author: Stanislav Fomichev Date: Thu Dec 22 13:39:58 2022 -0800 selftests/bpf: Add host-tools to gitignore Shows up when cross-compiling: HOST_SCRATCH_DIR := $(OUTPUT)/host-tools vs SCRATCH_DIR := $(OUTPUT)/tools HOST_SCRATCH_DIR := $(SCRATCH_DIR) Reported-by: John Sperbeck Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20221222213958.2302320-1-sdf@google.com commit 51094a24b85e29138b7fa82ef1e1b4fe19c90046 Merge: edb23125fd4a7 cf8016408d880 Author: Linus Torvalds Date: Fri Dec 23 12:00:24 2022 -0800 Merge tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening fixes from Kees Cook: - Fix CFI failure with KASAN (Sami Tolvanen) - Fix LKDTM + CFI under GCC 7 and 8 (Kristina Martsenko) - Limit CONFIG_ZERO_CALL_USED_REGS to Clang > 15.0.6 (Nathan Chancellor) - Ignore "contents" argument in LoadPin's LSM hook handling - Fix paste-o in /sys/kernel/warn_count API docs - Use READ_ONCE() consistently for oops/warn limit reading * tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: cfi: Fix CFI failure with KASAN exit: Use READ_ONCE() for all oops/warn limit reads security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 lkdtm: cfi: Make PAC test work with GCC 7 and 8 docs: Fix path paste-o for /sys/kernel/warn_count LoadPin: Ignore the "contents" argument of the LSM hooks commit 256cbafb0a9a3b340bd4798ad77bf0d93ee35ae8 Merge: 7fac54b93ad13 8ee57c7b8406c Author: Jakub Kicinski Date: Fri Dec 23 12:00:09 2022 -0800 Merge branch 'net-hns3-fix-some-bug-for-hns3' Hao Lan says: ==================== net: hns3: fix some bug for hns3 There are some bugfixes for the HNS3 ethernet driver. patch#1 fix miss checking for rx packet. patch#2 fixes VF promisc mode not update when mac table full bug, and patch#3 fixes a nterrupts not initialization in VF FLR bug. ==================== Link: https://lore.kernel.org/r/20221222064343.61537-1-lanhao@huawei.com Signed-off-by: Jakub Kicinski commit 8ee57c7b8406c7aa8ca31e014440c87c6383f429 Author: Jian Shen Date: Thu Dec 22 14:43:43 2022 +0800 net: hns3: fix VF promisc mode not update when mac table full Currently, it missed set HCLGE_VPORT_STATE_PROMISC_CHANGE flag for VF when vport->overflow_promisc_flags changed. So the VF won't check whether to update promisc mode in this case. So add it. Fixes: 1e6e76101fd9 ("net: hns3: configure promisc mode for VF asynchronously") Signed-off-by: Jian Shen Signed-off-by: Hao Lan Signed-off-by: Jakub Kicinski commit 7d89b53cea1a702f97117fb4361523519bb1e52c Author: Jian Shen Date: Thu Dec 22 14:43:42 2022 +0800 net: hns3: fix miss L3E checking for rx packet For device supports RXD advanced layout, the driver will return directly if the hardware finish the checksum calculate. It cause missing L3E checking for ip packets. Fixes it. Fixes: 1ddc028ac849 ("net: hns3: refactor out RX completion checksum") Signed-off-by: Jian Shen Signed-off-by: Hao Lan Signed-off-by: Jakub Kicinski commit 09e6b30eeb254f1818a008cace3547159e908dfd Author: Jie Wang Date: Thu Dec 22 14:43:41 2022 +0800 net: hns3: add interrupts re-initialization while doing VF FLR Currently keep alive message between PF and VF may be lost and the VF is unalive in PF. So the VF will not do reset during PF FLR reset process. This would make the allocated interrupt resources of VF invalid and VF would't receive or respond to PF any more. So this patch adds VF interrupts re-initialization during VF FLR for VF recovery in above cases. Fixes: 862d969a3a4d ("net: hns3: do VF's pci re-initialization while PF doing FLR") Signed-off-by: Jie Wang Signed-off-by: Hao Lan Signed-off-by: Jakub Kicinski commit edb23125fd4a79003012bc619d2c604da922865e Merge: 59d2c635f6cfb beca3e311a49c Author: Linus Torvalds Date: Fri Dec 23 11:55:54 2022 -0800 Merge tag 'pstore-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fixes from Kees Cook: - Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz) - Correctly assign mem_type property (Luca Stefani) * tag 'pstore-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Properly assign mem_type property pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion commit 59d2c635f6cfb0a8c7e5acb06b10c4e587fbfd1a Merge: e3b862ed893bf 3622b86f49f84 Author: Linus Torvalds Date: Fri Dec 23 11:44:20 2022 -0800 Merge tag 'dma-mapping-2022-12-23' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Fix up the sound code to not pass __GFP_COMP to the non-coherent DMA allocator, as it copes with that just as badly as the coherent allocator, and then add a check to make sure no one passes the flag ever again" * tag 'dma-mapping-2022-12-23' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: reject GFP_COMP for noncoherent allocations ALSA: memalloc: don't use GFP_COMP for non-coherent dma allocations commit e3b862ed893bf030ebdd78ead99647374a2cfd47 Merge: a27405b2ed9c7 1a4f69ef15ec2 Author: Linus Torvalds Date: Fri Dec 23 11:39:18 2022 -0800 Merge tag '9p-for-6.2-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: - improve p9_check_errors to check buffer size instead of msize when possible (e.g. not zero-copy) - some more syzbot and KCSAN fixes - minor headers include cleanup * tag '9p-for-6.2-rc1' of https://github.com/martinetd/linux: 9p/client: fix data race on req->status net/9p: fix response size check in p9_check_errors() net/9p: distinguish zero-copy requests 9p/xen: do not memcpy header into req->rc 9p: set req refcount to zero to avoid uninitialized usage 9p/net: Remove unneeded idr.h #include 9p/fs: Remove unneeded idr.h #include commit a27405b2ed9c7717ac1ea5587d465234a592c3b3 Merge: 55c7d6a91d42a 6bf5f9a8b408a Author: Linus Torvalds Date: Fri Dec 23 11:15:48 2022 -0800 Merge tag 'sound-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull more sound updates from Takashi Iwai: "A few more updates for 6.2: most of changes are about ASoC device-specific fixes. - Lots of ASoC Intel AVS extensions and refactoring - Quirks for ASoC Intel SOF as well as regression fixes - ASoC Mediatek and Rockchip fixes - Intel HD-audio HDMI workarounds - Usual HD- and USB-audio device-specific quirks" * tag 'sound-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (54 commits) ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless ALSA: azt3328: Remove the unused function snd_azf3328_codec_outl() ASoC: lochnagar: Fix unused lochnagar_of_match warning ASoC: Intel: Add HP Stream 8 to bytcr_rt5640.c ASoC: SOF: mediatek: initialize panic_info to zero ASoC: rt5670: Remove unbalanced pm_runtime_put() ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: mediatek: mt8195: add sof be ops to check audio active ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown" ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed" ALSA: hda/hdmi: fix stream-id config keep-alive for rt suspend ALSA: hda/hdmi: set default audio parameters for KAE silent-stream ALSA: hda/hdmi: fix i915 silent stream programming flow ALSA: hda: Error out if invalid stream is being setup ASoC: dt-bindings: fsl-sai: Reinstate i.MX93 SAI compatible string ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated ASoC: codecs: wcd-clsh: Remove the unused function ... commit 55c7d6a91d42ad98cbfb10da077ce8bb7084dc0e Merge: 06d65a6f64011 fe8f5b2f7bec5 Author: Linus Torvalds Date: Fri Dec 23 11:09:44 2022 -0800 Merge tag 'drm-next-2022-12-23' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Holiday fixes! Two batches from amd, and one group of i915 changes. amdgpu: - Spelling fix - BO pin fix - Properly handle polaris 10/11 overlap asics - GMC9 fix - SR-IOV suspend fix - DCN 3.1.4 fix - KFD userptr locking fix - SMU13.x fixes - GDS/GWS/OA handling fix - Reserved VMID handling fixes - FRU EEPROM fix - BO validation fixes - Avoid large variable on the stack - S0ix fixes - SMU 13.x fixes - VCN fix - Add missing fence reference amdkfd: - Fix init vm error handling - Fix double release of compute pasid i915 - Documentation fixes - OA-perf related fix - VLV/CHV HDMI/DP audio fix - Display DDI/Transcoder fix - Migrate fixes" * tag 'drm-next-2022-12-23' of git://anongit.freedesktop.org/drm/drm: (39 commits) drm/amdgpu: grab extra fence reference for drm_sched_job_add_dependency drm/amdgpu: enable VCN DPG for GC IP v11.0.4 drm/amdgpu: skip mes self test after s0i3 resume for MES IP v11.0 drm/amd/pm: correct the fan speed retrieving in PWM for some SMU13 asics drm/amd/pm: bump SMU13.0.0 driver_if header to version 0x34 drm/amdgpu: skip MES for S0ix as well since it's part of GFX drm/amd/pm: avoid large variable on kernel stack drm/amdkfd: Fix double release compute pasid drm/amdkfd: Fix kfd_process_device_init_vm error handling drm/amd/pm: update SMU13.0.0 reported maximum shader clock drm/amd/pm: correct SMU13.0.0 pstate profiling clock settings drm/amd/pm: enable GPO dynamic control support for SMU13.0.7 drm/amd/pm: enable GPO dynamic control support for SMU13.0.0 drm/amdgpu: revert "generally allow over-commit during BO allocation" drm/amdgpu: Remove unnecessary domain argument drm/amdgpu: Fix size validation for non-exclusive domains (v4) drm/amdgpu: Check if fru_addr is not NULL (v2) drm/i915/ttm: consider CCS for backup objects drm/i915/migrate: fix corner case in CCS aux copying drm/amdgpu: rework reserved VMID handling ... commit 06d65a6f640118430b894273914aa8d62d2cf637 Merge: 699aee7b47dbb 24b333a866a10 Author: Linus Torvalds Date: Fri Dec 23 10:49:45 2022 -0800 Merge tag 'mips_6.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: "Fixes due to DT changes" * tag 'mips_6.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: dts: bcm63268: Add missing properties to the TWD node MIPS: ralink: mt7621: avoid to init common ralink reset controller commit 699aee7b47dbb1d3c30bf24f3c905eff366d9571 Merge: 8395ae05cb5a2 e96b95c2b7a63 Author: Linus Torvalds Date: Fri Dec 23 10:45:00 2022 -0800 Merge tag 'mm-hotfixes-stable-2022-12-22-14-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Eight fixes, all cc:stable. One is for gcov and the remainder are MM" * tag 'mm-hotfixes-stable-2022-12-22-14-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: gcov: add support for checksum field test_maple_tree: add test for mas_spanning_rebalance() on insufficient data maple_tree: fix mas_spanning_rebalance() on insufficient data hugetlb: really allocate vma lock for all sharable vmas kmsan: export kmsan_handle_urb kmsan: include linux/vmalloc.h mm/mempolicy: fix memory leak in set_mempolicy_home_node system call mm, mremap: fix mremap() expanding vma with addr inside vma commit beca3e311a49cd3c55a056096531737d7afa4361 Author: Luca Stefani Date: Thu Dec 22 14:10:49 2022 +0100 pstore: Properly assign mem_type property If mem-type is specified in the device tree it would end up overriding the record_size field instead of populating mem_type. As record_size is currently parsed after the improper assignment with default size 0 it continued to work as expected regardless of the value found in the device tree. Simply changing the target field of the struct is enough to get mem-type working as expected. Fixes: 9d843e8fafc7 ("pstore: Add mem_type property DT parsing support") Cc: stable@vger.kernel.org Signed-off-by: Luca Stefani Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221222131049.286288-1-luca@osomprivacy.com commit 2f4fec5943407318b9523f01ce1f5d668c028332 Author: John Stultz Date: Wed Dec 21 05:18:55 2022 +0000 pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES In commit 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") I changed a lock to an rt_mutex. However, its possible that CONFIG_RT_MUTEXES is not enabled, which then results in a build failure, as the 0day bot detected: https://lore.kernel.org/linux-mm/202212211244.TwzWZD3H-lkp@intel.com/ Thus this patch changes CONFIG_PSTORE_PMSG to select CONFIG_RT_MUTEXES, which ensures the build will not fail. Cc: Wei Wang Cc: Midas Chien Cc: Connor O'Brien Cc: Kees Cook Cc: Anton Vorontsov Cc: Colin Cross Cc: Tony Luck Cc: kernel test robot Cc: kernel-team@android.com Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") Reported-by: kernel test robot Signed-off-by: John Stultz Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221221051855.15761-1-jstultz@google.com commit cf8016408d880afe9c5dc495af40dc2932874e77 Author: Sami Tolvanen Date: Thu Dec 22 22:57:47 2022 +0000 cfi: Fix CFI failure with KASAN When CFI_CLANG and KASAN are both enabled, LLVM doesn't generate a CFI type hash for asan.module_ctor functions in translation units where CFI is disabled, which leads to a CFI failure during boot when do_ctors calls the affected constructors: CFI failure at do_basic_setup+0x64/0x90 (target: asan.module_ctor+0x0/0x28; expected type: 0xa540670c) Specifically, this happens because CFI is disabled for kernel/cfi.c. There's no reason to keep CFI disabled here anymore, so fix the failure by not filtering out CC_FLAGS_CFI for the file. Note that https://reviews.llvm.org/rG3b14862f0a96 fixed the issue where LLVM didn't emit CFI type hashes for any sanitizer constructors, but now type hashes are emitted correctly for TUs that use CFI. Link: https://github.com/ClangBuiltLinux/linux/issues/1742 Fixes: 89245600941e ("cfi: Switch to -fsanitize=kcfi") Reported-by: Mark Rutland Signed-off-by: Sami Tolvanen Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221222225747.3538676-1-samitolvanen@google.com commit 50a9ac25985c037d45ee6d7e3a7ae198a63b9266 Author: Sean Christopherson Date: Tue Dec 13 03:30:29 2022 +0000 KVM: x86/mmu: Don't install TDP MMU SPTE if SP has unexpected level Don't install a leaf TDP MMU SPTE if the parent page's level doesn't match the target level of the fault, and instead have the vCPU retry the faulting instruction after warning. Continuing on is completely unnecessary as the absolute worst case scenario of retrying is DoSing the vCPU, whereas continuing on all but guarantees bigger explosions, e.g. ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/mmu/tdp_mmu.c:559! invalid opcode: 0000 [#1] SMP CPU: 1 PID: 1025 Comm: nx_huge_pages_t Tainted: G W 6.1.0-rc4+ #64 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__handle_changed_spte.cold+0x95/0x9c RSP: 0018:ffffc9000072faf8 EFLAGS: 00010246 RAX: 00000000000000c1 RBX: ffffc90000731000 RCX: 0000000000000027 RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: ffff888277c5b4c8 RBP: 0600000112400bf3 R08: ffff888277c5b4c0 R09: ffffc9000072f9a0 R10: 0000000000000001 R11: 0000000000000001 R12: 06000001126009f3 R13: 0000000000000002 R14: 0000000012600901 R15: 0000000012400b01 FS: 00007fba9f853740(0000) GS:ffff888277c40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010aa7a003 CR4: 0000000000172ea0 Call Trace: kvm_tdp_mmu_map+0x3b0/0x510 kvm_tdp_page_fault+0x10c/0x130 kvm_mmu_page_fault+0x103/0x680 vmx_handle_exit+0x132/0x5a0 [kvm_intel] vcpu_enter_guest+0x60c/0x16f0 kvm_arch_vcpu_ioctl_run+0x1e2/0x9d0 kvm_vcpu_ioctl+0x271/0x660 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Modules linked in: kvm_intel ---[ end trace 0000000000000000 ]--- Signed-off-by: Sean Christopherson Message-Id: <20221213033030.83345-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 21a36ac6b6c7059965bac0cc73ef3cbb8ef576dd Author: Sean Christopherson Date: Tue Dec 13 03:30:28 2022 +0000 KVM: x86/mmu: Re-check under lock that TDP MMU SP hugepage is disallowed Re-check sp->nx_huge_page_disallowed under the tdp_mmu_pages_lock spinlock when adding a new shadow page in the TDP MMU. To ensure the NX reclaim kthread can't see a not-yet-linked shadow page, the page fault path links the new page table prior to adding the page to possible_nx_huge_pages. If the page is zapped by different task, e.g. because dirty logging is disabled, between linking the page and adding it to the list, KVM can end up triggering use-after-free by adding the zapped SP to the aforementioned list, as the zapped SP's memory is scheduled for removal via RCU callback. The bug is detected by the sanity checks guarded by CONFIG_DEBUG_LIST=y, i.e. the below splat is just one possible signature. ------------[ cut here ]------------ list_add corruption. prev->next should be next (ffffc9000071fa70), but was ffff88811125ee38. (prev=ffff88811125ee38). WARNING: CPU: 1 PID: 953 at lib/list_debug.c:30 __list_add_valid+0x79/0xa0 Modules linked in: kvm_intel CPU: 1 PID: 953 Comm: nx_huge_pages_t Tainted: G W 6.1.0-rc4+ #71 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__list_add_valid+0x79/0xa0 RSP: 0018:ffffc900006efb68 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888116cae8a0 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000100001872 RDI: ffff888277c5b4c8 RBP: ffffc90000717000 R08: ffff888277c5b4c0 R09: ffffc900006efa08 R10: 0000000000199998 R11: 0000000000199a20 R12: ffff888116cae930 R13: ffff88811125ee38 R14: ffffc9000071fa70 R15: ffff88810b794f90 FS: 00007fc0415d2740(0000) GS:ffff888277c40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000115201006 CR4: 0000000000172ea0 Call Trace: track_possible_nx_huge_page+0x53/0x80 kvm_tdp_mmu_map+0x242/0x2c0 kvm_tdp_page_fault+0x10c/0x130 kvm_mmu_page_fault+0x103/0x680 vmx_handle_exit+0x132/0x5a0 [kvm_intel] vcpu_enter_guest+0x60c/0x16f0 kvm_arch_vcpu_ioctl_run+0x1e2/0x9d0 kvm_vcpu_ioctl+0x271/0x660 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- Fixes: 61f94478547b ("KVM: x86/mmu: Set disallowed_nx_huge_page in TDP MMU before setting SPTE") Reported-by: Greg Thelen Analyzed-by: David Matlack Cc: David Matlack Cc: Ben Gardon Cc: Mingwei Zhang Signed-off-by: Sean Christopherson Message-Id: <20221213033030.83345-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 80a3e4ae962de33ff6a94e798c80e56e1fed4d10 Author: Sean Christopherson Date: Tue Dec 13 03:30:27 2022 +0000 KVM: x86/mmu: Map TDP MMU leaf SPTE iff target level is reached Map the leaf SPTE when handling a TDP MMU page fault if and only if the target level is reached. A recent commit reworked the retry logic and incorrectly assumed that walking SPTEs would never "fail", as the loop either bails (retries) or installs parent SPs. However, the iterator itself will bail early if it detects a frozen (REMOVED) SPTE when stepping down. The TDP iterator also rereads the current SPTE before stepping down specifically to avoid walking into a part of the tree that is being removed, which means it's possible to terminate the loop without the guts of the loop observing the frozen SPTE, e.g. if a different task zaps a parent SPTE between the initial read and try_step_down()'s refresh. Mapping a leaf SPTE at the wrong level results in all kinds of badness as page table walkers interpret the SPTE as a page table, not a leaf, and walk into the weeds. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1025 at arch/x86/kvm/mmu/tdp_mmu.c:1070 kvm_tdp_mmu_map+0x481/0x510 Modules linked in: kvm_intel CPU: 1 PID: 1025 Comm: nx_huge_pages_t Tainted: G W 6.1.0-rc4+ #64 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_tdp_mmu_map+0x481/0x510 RSP: 0018:ffffc9000072fba8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffffc9000072fcc0 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff888277c5b4c8 RBP: ffff888107d45a10 R08: ffff888277c5b4c0 R09: ffffc9000072fa48 R10: 0000000000000001 R11: 0000000000000001 R12: ffffc9000073a0e0 R13: ffff88810fc54800 R14: ffff888107d1ae60 R15: ffff88810fc54f90 FS: 00007fba9f853740(0000) GS:ffff888277c40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010aa7a003 CR4: 0000000000172ea0 Call Trace: kvm_tdp_page_fault+0x10c/0x130 kvm_mmu_page_fault+0x103/0x680 vmx_handle_exit+0x132/0x5a0 [kvm_intel] vcpu_enter_guest+0x60c/0x16f0 kvm_arch_vcpu_ioctl_run+0x1e2/0x9d0 kvm_vcpu_ioctl+0x271/0x660 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- Invalid SPTE change: cannot replace a present leaf SPTE with another present leaf SPTE mapping a different PFN! as_id: 0 gfn: 100200 old_spte: 600000112400bf3 new_spte: 6000001126009f3 level: 2 ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/mmu/tdp_mmu.c:559! invalid opcode: 0000 [#1] SMP CPU: 1 PID: 1025 Comm: nx_huge_pages_t Tainted: G W 6.1.0-rc4+ #64 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__handle_changed_spte.cold+0x95/0x9c RSP: 0018:ffffc9000072faf8 EFLAGS: 00010246 RAX: 00000000000000c1 RBX: ffffc90000731000 RCX: 0000000000000027 RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: ffff888277c5b4c8 RBP: 0600000112400bf3 R08: ffff888277c5b4c0 R09: ffffc9000072f9a0 R10: 0000000000000001 R11: 0000000000000001 R12: 06000001126009f3 R13: 0000000000000002 R14: 0000000012600901 R15: 0000000012400b01 FS: 00007fba9f853740(0000) GS:ffff888277c40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010aa7a003 CR4: 0000000000172ea0 Call Trace: kvm_tdp_mmu_map+0x3b0/0x510 kvm_tdp_page_fault+0x10c/0x130 kvm_mmu_page_fault+0x103/0x680 vmx_handle_exit+0x132/0x5a0 [kvm_intel] vcpu_enter_guest+0x60c/0x16f0 kvm_arch_vcpu_ioctl_run+0x1e2/0x9d0 kvm_vcpu_ioctl+0x271/0x660 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Modules linked in: kvm_intel ---[ end trace 0000000000000000 ]--- Fixes: 63d28a25e04c ("KVM: x86/mmu: simplify kvm_tdp_mmu_map flow when guest has to retry") Cc: Robert Hoo Signed-off-by: Sean Christopherson Message-Id: <20221213033030.83345-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f5d16bb9be68b20c78fc3d93fa243eb1f0b9fa53 Author: Sean Christopherson Date: Tue Dec 13 03:30:26 2022 +0000 KVM: x86/mmu: Don't attempt to map leaf if target TDP MMU SPTE is frozen Hoist the is_removed_spte() check above the "level == goal_level" check when walking SPTEs during a TDP MMU page fault to avoid attempting to map a leaf entry if said entry is frozen by a different task/vCPU. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 939 at arch/x86/kvm/mmu/tdp_mmu.c:653 kvm_tdp_mmu_map+0x269/0x4b0 Modules linked in: kvm_intel CPU: 3 PID: 939 Comm: nx_huge_pages_t Not tainted 6.1.0-rc4+ #67 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_tdp_mmu_map+0x269/0x4b0 RSP: 0018:ffffc9000068fba8 EFLAGS: 00010246 RAX: 00000000000005a0 RBX: ffffc9000068fcc0 RCX: 0000000000000005 RDX: ffff88810741f000 RSI: ffff888107f04600 RDI: ffffc900006a3000 RBP: 060000010b000bf3 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 000ffffffffff000 R12: 0000000000000005 R13: ffff888113670000 R14: ffff888107464958 R15: 0000000000000000 FS: 00007f01c942c740(0000) GS:ffff888277cc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000117013006 CR4: 0000000000172ea0 Call Trace: kvm_tdp_page_fault+0x10c/0x130 kvm_mmu_page_fault+0x103/0x680 vmx_handle_exit+0x132/0x5a0 [kvm_intel] vcpu_enter_guest+0x60c/0x16f0 kvm_arch_vcpu_ioctl_run+0x1e2/0x9d0 kvm_vcpu_ioctl+0x271/0x660 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- Fixes: 63d28a25e04c ("KVM: x86/mmu: simplify kvm_tdp_mmu_map flow when guest has to retry") Cc: Robert Hoo Signed-off-by: Sean Christopherson Reviewed-by: Robert Hoo Message-Id: <20221213033030.83345-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a0860d68a25dee4e51e7d3e067a66ca765776fe8 Author: Sean Christopherson Date: Tue Dec 13 06:23:04 2022 +0000 KVM: nVMX: Don't stuff secondary execution control if it's not supported When stuffing the allowed secondary execution controls for nested VMX in response to CPUID updates, don't set the allowed-1 bit for a feature that isn't supported by KVM, i.e. isn't allowed by the canonical vmcs_config. WARN if KVM attempts to manipulate a feature that isn't supported. All features that are currently stuffed are always advertised to L1 for nested VMX if they are supported in KVM's base configuration, and no additional features should ever be added to the CPUID-induced stuffing (updating VMX MSRs in response to CPUID updates is a long-standing KVM flaw that is slowly being fixed). Signed-off-by: Sean Christopherson Message-Id: <20221213062306.667649-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 31de69f4eea77b28a9724b3fa55aae104fc91fc7 Author: Sean Christopherson Date: Tue Dec 13 06:23:03 2022 +0000 KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 Set ENABLE_USR_WAIT_PAUSE in KVM's supported VMX MSR configuration if the feature is supported in hardware and enabled in KVM's base, non-nested configuration, i.e. expose ENABLE_USR_WAIT_PAUSE to L1 if it's supported. This fixes a bug where saving/restoring, i.e. migrating, a vCPU will fail if WAITPKG (the associated CPUID feature) is enabled for the vCPU, and obviously allows L1 to enable the feature for L2. KVM already effectively exposes ENABLE_USR_WAIT_PAUSE to L1 by stuffing the allowed-1 control ina vCPU's virtual MSR_IA32_VMX_PROCBASED_CTLS2 when updating secondary controls in response to KVM_SET_CPUID(2), but (a) that depends on flawed code (KVM shouldn't touch VMX MSRs in response to CPUID updates) and (b) runs afoul of vmx_restore_control_msr()'s restriction that the guest value must be a strict subset of the supported host value. Although no past commit explicitly enabled nested support for WAITPKG, doing so is safe and functionally correct from an architectural perspective as no additional KVM support is needed to virtualize TPAUSE, UMONITOR, and UMWAIT for L2 relative to L1, and KVM already forwards VM-Exits to L1 as necessary (commit bf653b78f960, "KVM: vmx: Introduce handle_unexpected_vmexit and handle WAITPKG vmexit"). Note, KVM always keeps the hosts MSR_IA32_UMWAIT_CONTROL resident in hardware, i.e. always runs both L1 and L2 with the host's power management settings for TPAUSE and UMWAIT. See commit bf09fb6cba4f ("KVM: VMX: Stop context switching MSR_IA32_UMWAIT_CONTROL") for more details. Fixes: e69e72faa3a0 ("KVM: x86: Add support for user wait instructions") Cc: stable@vger.kernel.org Reported-by: Aaron Lewis Reported-by: Yu Zhang Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Message-Id: <20221213062306.667649-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 057b18756b464729bc787ed4e6b44abb9f5c3a38 Author: Sean Christopherson Date: Tue Dec 20 15:42:24 2022 +0000 KVM: nVMX: Document that ignoring memory failures for VMCLEAR is deliberate Explicitly drop the result of kvm_vcpu_write_guest() when writing the "launch state" as part of VMCLEAR emulation, and add a comment to call out that KVM's behavior is architecturally valid. Intel's pseudocode effectively says that VMCLEAR is a nop if the target VMCS address isn't in memory, e.g. if the address points at MMIO. Add a FIXME to call out that suppressing failures on __copy_to_user() is wrong, as memory (a memslot) does exist in that case. Punt the issue to the future as open coding kvm_vcpu_write_guest() just to make sure the guest dies with -EFAULT isn't worth the extra complexity. The flaw will need to be addressed if KVM ever does something intelligent on uaccess failures, e.g. to support post-copy demand paging, but in that case KVM will need a more thorough overhaul, i.e. VMCLEAR shouldn't need to open code a core KVM helper. No functional change intended. Reported-by: coverity-bot Addresses-Coverity-ID: 1527765 ("Error handling issues") Fixes: 587d7e72aedc ("kvm: nVMX: VMCLEAR should not cause the vCPU to shut down") Cc: Jim Mattson Signed-off-by: Sean Christopherson Message-Id: <20221220154224.526568-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 53800f88d414525d3fdc5c84629faa0b6bc35b3b Author: Sean Christopherson Date: Mon Dec 19 22:04:16 2022 +0000 KVM: selftests: Zero out valid_bank_mask for "all" case in Hyper-V IPI test Zero out the valid_bank_mask when using the fast variant of HVCALL_SEND_IPI_EX to send IPIs to all vCPUs. KVM requires the "var_cnt" and "valid_bank_mask" inputs to be consistent even when targeting all vCPUs. See commit bd1ba5732bb9 ("KVM: x86: Get the number of Hyper-V sparse banks from the VARHEAD field"). Fixes: 998489245d84 ("KVM: selftests: Hyper-V PV IPI selftest") Cc: Vitaly Kuznetsov Signed-off-by: Sean Christopherson Message-Id: <20221219220416.395329-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 77b1908e10eccf34310ffd95b0b455c01aa76286 Author: Sean Christopherson Date: Tue Dec 20 15:34:27 2022 +0000 KVM: x86: Sanity check inputs to kvm_handle_memory_failure() Add a sanity check in kvm_handle_memory_failure() to assert that a valid x86_exception structure is provided if the memory "failure" wants to propagate a fault into the guest. If a memory failure happens during a direct guest physical memory access, e.g. for nested VMX, KVM hardcodes the failure to X86EMUL_IO_NEEDED and doesn't provide an exception pointer (because the exception struct would just be filled with garbage). Signed-off-by: Sean Christopherson Message-Id: <20221220153427.514032-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3c649918b764c0aaef22ea65d514bac5e2324ec0 Author: Peng Hao Date: Tue Dec 6 17:20:15 2022 +0800 KVM: x86: Simplify kvm_apic_hw_enabled kvm_apic_hw_enabled() only needs to return bool, there is no place to use the return value of MSR_IA32_APICBASE_ENABLE. Signed-off-by: Peng Hao Message-Id: Signed-off-by: Paolo Bonzini commit 8b9e13d2de73b5513c2ceffe0f62eab40206a126 Author: Vitaly Kuznetsov Date: Thu Dec 8 11:27:00 2022 +0100 KVM: x86: hyper-v: Fix 'using uninitialized value' Coverity warning In kvm_hv_flush_tlb(), 'data_offset' and 'consumed_xmm_halves' variables are used in a mutually exclusive way: in 'hc->fast' we count in 'XMM halves' and increase 'data_offset' otherwise. Coverity discovered, that in one case both variables are incremented unconditionally. This doesn't seem to cause any issues as the only user of 'data_offset'/'consumed_xmm_halves' data is kvm_hv_get_tlb_flush_entries() -> kvm_hv_get_hc_data() which also takes into account 'hc->fast' but is still worth fixing. To make things explicit, put 'data_offset' and 'consumed_xmm_halves' to 'struct kvm_hv_hcall' as a union and use at call sites. This allows to remove explicit 'data_offset'/'consumed_xmm_halves' parameters from kvm_hv_get_hc_data()/kvm_get_sparse_vp_set()/kvm_hv_get_tlb_flush_entries() helpers. Note: 'struct kvm_hv_hcall' is allocated on stack in kvm_hv_hypercall() and is not zeroed, consumers are supposed to initialize the appropriate field if needed. Reported-by: coverity-bot Addresses-Coverity-ID: 1527764 ("Uninitialized variables") Fixes: 260970862c88 ("KVM: x86: hyper-v: Handle HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST{,EX} calls gently") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Message-Id: <20221208102700.959630-1-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit fceb3a36c29a957515d5156e5e7844ea040dc43d Author: Adamos Ttofari Date: Thu Dec 8 09:44:14 2022 +0000 KVM: x86: ioapic: Fix level-triggered EOI and userspace I/OAPIC reconfigure race When scanning userspace I/OAPIC entries, intercept EOI for level-triggered IRQs if the current vCPU has a pending and/or in-service IRQ for the vector in its local API, even if the vCPU doesn't match the new entry's destination. This fixes a race between userspace I/OAPIC reconfiguration and IRQ delivery that results in the vector's bit being left set in the remote IRR due to the eventual EOI not being forwarded to the userspace I/OAPIC. Commit 0fc5a36dd6b3 ("KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race") fixed the in-kernel IOAPIC, but not the userspace IOAPIC configuration, which has a similar race. Fixes: 0fc5a36dd6b3 ("KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race") Signed-off-by: Adamos Ttofari Reviewed-by: Sean Christopherson Message-Id: <20221208094415.12723-1-attofari@amazon.de> Signed-off-by: Paolo Bonzini commit 55c590adfe18b5380f7c4ae3696468bc5c916ee5 Author: Like Xu Date: Wed Dec 7 15:15:05 2022 +0800 KVM: x86/pmu: Prevent zero period event from being repeatedly released The current vPMU can reuse the same pmc->perf_event for the same hardware event via pmc_pause/resume_counter(), but this optimization does not apply to a portion of the TSX events (e.g., "event=0x3c,in_tx=1, in_tx_cp=1"), where event->attr.sample_period is legally zero at creation, thus making the perf call to perf_event_period() meaningless (no need to adjust sample period in this case), and instead causing such reusable perf_events to be repeatedly released and created. Avoid releasing zero sample_period events by checking is_sampling_event() to follow the previously enable/disable optimization. Signed-off-by: Like Xu Message-Id: <20221207071506.15733-2-likexu@tencent.com> Signed-off-by: Paolo Bonzini commit 343190841a1f22b96996d9f8cfab902a4d1bfd0e Author: Jens Axboe Date: Fri Dec 23 06:37:08 2022 -0700 io_uring: check for valid register opcode earlier We only check the register opcode value inside the restricted ring section, move it into the main io_uring_register() function instead and check it up front. Signed-off-by: Jens Axboe commit 7fac54b93ad13e5e7ac237af33eb2a0940eaeea0 Author: Rong Tao Date: Wed Dec 21 20:36:27 2022 +0800 atm: uapi: fix spelling typos in comments Fix the typo of 'Unsuported' in atmbr2684.h Signed-off-by: Rong Tao Link: https://lore.kernel.org/r/tencent_F1354BEC925C65EA357E741E91DF2044E805@qq.com Signed-off-by: Jakub Kicinski commit 8d8bee13ae9e316443c6666286360126a19c8d94 Author: Sean Anderson Date: Fri Dec 16 12:29:37 2022 -0500 powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 There aren't enough resources to run these ports at 10G speeds. Disable 10G for these ports, reverting to the previous speed. Fixes: 36926a7d70c2 ("powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G") Reported-by: Camelia Alexandra Groza Signed-off-by: Sean Anderson Reviewed-by: Camelia Groza Tested-by: Camelia Groza Link: https://lore.kernel.org/r/20221216172937.2960054-1-sean.anderson@seco.com Signed-off-by: Jakub Kicinski commit cedebd74cf3883f0384af9ec26b4e6f8f1964dd4 Author: Hao Sun Date: Thu Dec 22 10:44:14 2022 +0800 selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Verify that nullness information is not porpagated in the branches of register to register JEQ and JNE operations if one of them is PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE. Signed-off-by: Hao Sun Suggested-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20221222024414.29539-2-sunhao.th@gmail.com Signed-off-by: Martin KaFai Lau commit 8374bfd5a3c90a5b250f7c087c4d2b8ac467b12e Author: Hao Sun Date: Thu Dec 22 10:44:13 2022 +0800 bpf: fix nullness propagation for reg to reg comparisons After befae75856ab, the verifier would propagate null information after JEQ/JNE, e.g., if two pointers, one is maybe_null and the other is not, the former would be marked as non-null in eq path. However, as comment "PTR_TO_BTF_ID points to a kernel struct that does not need to be null checked by the BPF program ... The verifier must keep this in mind and can make no assumptions about null or non-null when doing branch ...". If one pointer is maybe_null and the other is PTR_TO_BTF, the former is incorrectly marked non-null. The following BPF prog can trigger a null-ptr-deref, also see this report for more details[1]: 0: (18) r1 = map_fd ; R1_w=map_ptr(ks=4, vs=4) 2: (79) r6 = *(u64 *)(r1 +8) ; R6_w=bpf_map->inner_map_data ; R6 is PTR_TO_BTF_ID ; equals to null at runtime 3: (bf) r2 = r10 4: (07) r2 += -4 5: (62) *(u32 *)(r2 +0) = 0 6: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null 7: (1d) if r6 == r0 goto pc+1 8: (95) exit ; from 7 to 9: R0=map_value R6=ptr_bpf_map 9: (61) r0 = *(u32 *)(r0 +0) ; null-ptr-deref 10: (95) exit So, make the verifier propagate nullness information for reg to reg comparisons only if neither reg is PTR_TO_BTF_ID. [1] https://lore.kernel.org/bpf/CACkBjsaFJwjC5oiw-1KXvcazywodwXo4zGYsRHwbr2gSG9WcSw@mail.gmail.com/T/#u Fixes: befae75856ab ("bpf: propagate nullness information for reg to reg comparisons") Signed-off-by: Hao Sun Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20221222024414.29539-1-sunhao.th@gmail.com Signed-off-by: Martin KaFai Lau commit 8395ae05cb5a2e31d36106e8c85efa11cda849be Merge: ff75ec43a2f6f 68ad83188d782 Author: Linus Torvalds Date: Thu Dec 22 11:22:31 2022 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Mostly small bug fixes and small updates. The only things of note is a qla2xxx fix for crash on hotplug and timeout and the addition of a user exposed abstraction layer for persistent reservation error return handling (which necessitates the conversion of nvme.c as well as SCSI)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qla2xxx: Fix crash when I/O abort times out nvme: Convert NVMe errors to PR errors scsi: sd: Convert SCSI errors to PR errors scsi: core: Rename status_byte to sg_status_byte block: Add error codes for common PR failures scsi: sd: sd_zbc: Trace zone append emulation scsi: libfc: Include the correct header commit ff75ec43a2f6fbf7049472312bab322d77eb1bde Merge: d1ac1a2b14264 a9eb558a5bea6 Author: Linus Torvalds Date: Thu Dec 22 11:17:34 2022 -0800 Merge tag 'afs-next-20221222' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull afs update from David Howells: "A fix for a couple of missing resource counter decrements, two small cleanups of now-unused bits of code and a patch to remove writepage support from afs" * tag 'afs-next-20221222' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Stop implementing ->writepage() afs: remove afs_cache_netfs and afs_zap_permits() declarations afs: remove variable nr_servers afs: Fix lost servers_outstanding count commit 55171f2930be98c8a49991435cdf3a8b574353b6 Author: Anton Protopopov Date: Thu Dec 22 10:26:27 2022 +0000 bpftool: Fix linkage with statically built libllvm Since the commit eb9d1acf634b ("bpftool: Add LLVM as default library for disassembling JIT-ed programs") we might link the bpftool program with the libllvm library. This works fine when a shared libllvm library is available, but fails if we want to link bpftool with a statically built LLVM: [...] /usr/bin/ld: /usr/local/lib/libLLVMSupport.a(CrashRecoveryContext.cpp.o): in function `llvm::CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup()': CrashRecoveryContext.cpp:(.text._ZN4llvm27CrashRecoveryContextCleanupD0Ev+0x17): undefined reference to `operator delete(void*, unsigned long)' /usr/bin/ld: /usr/local/lib/libLLVMSupport.a(CrashRecoveryContext.cpp.o): in function `llvm::CrashRecoveryContext::~CrashRecoveryContext()': CrashRecoveryContext.cpp:(.text._ZN4llvm20CrashRecoveryContextD2Ev+0xc8): undefined reference to `operator delete(void*, unsigned long)' [...] So in the case of static libllvm we need to explicitly link bpftool with required libraries, namely, libstdc++ and those provided by the `llvm-config --system-libs` command. We can distinguish between the shared and static cases by using the `llvm-config --shared-mode` command. Fixes: eb9d1acf634b ("bpftool: Add LLVM as default library for disassembling JIT-ed programs") Signed-off-by: Anton Protopopov Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20221222102627.1643709-1-aspsk@isovalent.com commit d1ac1a2b14264e98c24db6f8c2bd452e695c7238 Merge: 9d2f6060fe4c3 09e6f9f98370b Author: Linus Torvalds Date: Thu Dec 22 11:07:29 2022 -0800 Merge tag 'perf-tools-for-v6.2-2-2022-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tools updates from Arnaldo Carvalho de Melo: "perf tools fixes and improvements: - Don't stop building perf if python setuptools isn't installed, just disable the affected perf feature. - Remove explicit reference to python 2.x devel files, that warning is about python-devel, no matter what version, being unavailable and thus disabling the linking with libpython. - Don't use -Werror=switch-enum when building the python support that handles libtraceevent enumerations, as there is no good way to test if some specific enum entry is available with the libtraceevent installed on the system. - Introduce 'perf lock contention' --type-filter and --lock-filter, to filter by lock type and lock name: $ sudo ./perf lock record -a -- ./perf bench sched messaging $ sudo ./perf lock contention -E 5 -Y spinlock contended total wait max wait avg wait type caller 802 1.26 ms 11.73 us 1.58 us spinlock __wake_up_common_lock+0x62 13 787.16 us 105.44 us 60.55 us spinlock remove_wait_queue+0x14 12 612.96 us 78.70 us 51.08 us spinlock prepare_to_wait+0x27 114 340.68 us 12.61 us 2.99 us spinlock try_to_wake_up+0x1f5 83 226.38 us 9.15 us 2.73 us spinlock folio_lruvec_lock_irqsave+0x5e $ sudo ./perf lock contention -l contended total wait max wait avg wait address symbol 57 1.11 ms 42.83 us 19.54 us ffff9f4140059000 15 280.88 us 23.51 us 18.73 us ffffffff9d007a40 jiffies_lock 1 20.49 us 20.49 us 20.49 us ffffffff9d0d50c0 rcu_state 1 9.02 us 9.02 us 9.02 us ffff9f41759e9ba0 $ sudo ./perf lock contention -L jiffies_lock,rcu_state contended total wait max wait avg wait type caller 15 280.88 us 23.51 us 18.73 us spinlock tick_sched_do_timer+0x93 1 20.49 us 20.49 us 20.49 us spinlock __softirqentry_text_start+0xeb $ sudo ./perf lock contention -L ffff9f4140059000 contended total wait max wait avg wait type caller 38 779.40 us 42.83 us 20.51 us spinlock worker_thread+0x50 11 216.30 us 39.87 us 19.66 us spinlock queue_work_on+0x39 8 118.13 us 20.51 us 14.77 us spinlock kthread+0xe5 - Fix splitting CC into compiler and options when checking if a option is present in clang to build the python binding, needed in systems such as yocto that set CC to, e.g.: "gcc --sysroot=/a/b/c". - Refresh metris and events for Intel systems: alderlake. alderlake-n, bonnell, broadwell, broadwellde, broadwellx, cascadelakex, elkhartlake, goldmont, goldmontplus, haswell, haswellx, icelake, icelakex, ivybridge, ivytown, jaketown, knightslanding, meteorlake, nehalemep, nehalemex, sandybridge, sapphirerapids, silvermont, skylake, skylakex, snowridgex, tigerlake, westmereep-dp, westmereep-sp, westmereex. - Add vendor events files (JSON) for AMD Zen 4, from sections 2.1.15.4 "Core Performance Monitor Counters", 2.1.15.5 "L3 Cache Performance Monitor Counter"s and Section 7.1 "Fabric Performance Monitor Counter (PMC) Events" in the Processor Programming Reference (PPR) for AMD Family 19h Model 11h Revision B1 processors. This constitutes events which capture op dispatch, execution and retirement, branch prediction, L1 and L2 cache activity, TLB activity, L3 cache activity and data bandwidth for various links and interfaces in the Data Fabric. - Also, from the same PPR are metrics taken from Section 2.1.15.2 "Performance Measurement", including pipeline utilization, which are new to Zen 4 processors and useful for finding performance bottlenecks by analyzing activity at different stages of the pipeline. - Greatly improve the 'srcline', 'srcline_from', 'srcline_to' and 'srcfile' sort keys performance by postponing calling the external addr2line utility to the collapse phase of histogram bucketing. - Fix 'perf test' "all PMU test" to skip parametrized events, that requires setting up and are not supported by this test. - Update tools/ copies of kernel headers: features, disabled-features, fscrypt.h, i915_drm.h, msr-index.h, power pc syscall table and kvm.h. - Add .DELETE_ON_ERROR special Makefile target to clean up partially updated files on error. - Simplify the mksyscalltbl script for arm64 by avoiding to run the host compiler to create the syscall table, do it all just with the shell script. - Further fixes to honour quiet mode (-q)" * tag 'perf-tools-for-v6.2-2-2022-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (67 commits) perf python: Fix splitting CC into compiler and options perf scripting python: Don't be strict at handling libtraceevent enumerations perf arm64: Simplify mksyscalltbl perf build: Remove explicit reference to python 2.x devel files perf vendor events amd: Add Zen 4 mapping perf vendor events amd: Add Zen 4 metrics perf vendor events amd: Add Zen 4 uncore events perf vendor events amd: Add Zen 4 core events perf vendor events intel: Refresh westmereex events perf vendor events intel: Refresh westmereep-sp events perf vendor events intel: Refresh westmereep-dp events perf vendor events intel: Refresh tigerlake metrics and events perf vendor events intel: Refresh snowridgex events perf vendor events intel: Refresh skylakex metrics and events perf vendor events intel: Refresh skylake metrics and events perf vendor events intel: Refresh silvermont events perf vendor events intel: Refresh sapphirerapids metrics and events perf vendor events intel: Refresh sandybridge metrics and events perf vendor events intel: Refresh nehalemex events perf vendor events intel: Refresh nehalemep events ... commit e555c85792bd5f9828a2fd2ca9761f70efb1c77b Author: Mario Limonciello Date: Thu Dec 15 13:16:16 2022 -0600 ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ After we introduced a module parameter and quirk infrastructure for picking the Microsoft GUID over the SOC vendor GUID we discovered that lots and lots of systems are getting this wrong. The table continues to grow, and is becoming unwieldy. We don't really have any benefit to forcing vendors to populate the AMD GUID. This is just extra work, and more and more vendors seem to mess it up. As the Microsoft GUID is used by Windows as well, it's very likely that it won't be messed up like this. So drop all the quirks forcing it and the Rembrandt behavior. This means that Cezanne or later effectively only run the Microsoft GUID codepath with the exception of HP Elitebook 8*5 G9. Fixes: fd894f05cf30 ("ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt") Cc: stable@vger.kernel.org # 6.1 Reported-by: Benjamin Cheng Reported-by: bilkow@tutanota.com Reported-by: Paul Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2292 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216768 Signed-off-by: Mario Limonciello Reviewed-by: Philipp Zabel Tested-by: Philipp Zabel Signed-off-by: Rafael J. Wysocki commit 3ea45390e9c0d35805ef8357ace55594fd4233d0 Author: Mario Limonciello Date: Thu Dec 15 13:16:15 2022 -0600 ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 HP Elitebook 865 supports both the AMD GUID w/ _REV 2 and Microsoft GUID with _REV 0. Both have very similar code but the AMD GUID has a special workaround that is specific to a problem with spurious wakeups on systems with Qualcomm WLAN. This is believed to be a bug in the Qualcomm WLAN F/W (it doesn't affect any other WLAN H/W). If this WLAN firmware is fixed this quirk can be dropped. Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit 3cf3b7f012f3ea8bdc56196e367cf07c10424855 Author: Hans de Goede Date: Thu Dec 15 10:41:38 2022 +0100 ACPI: video: Fix Apple GMUX backlight detection The apple-gmux driver only binds to old GMUX devices which have an IORESOURCE_IO resource (using inb()/outb()) rather then memory-mapped IO (IORESOURCE_MEM). T2 MacBooks use the new style GMUX devices (with IORESOURCE_MEM access), so these are not supported by the apple-gmux driver. This is not a problem since they have working ACPI video backlight support. But the apple_gmux_present() helper only checks if an ACPI device with the "APP000B" HID is present, causing acpi_video_get_backlight_type() to return acpi_backlight_apple_gmux disabling the acpi_video backlight device. Add a new apple_gmux_backlight_present() helper which checks that the "APP000B" device actually is an old GMUX device with an IORESOURCE_IO resource. This fixes the acpi_video0 backlight no longer registering on T2 MacBooks. Note people are working to add support for the new style GMUX to Linux: https://github.com/kekrby/linux-t2/commits/wip/hybrid-graphics Once this lands this patch should be reverted so that acpi_video_get_backlight_type() also prefers the gmux on new style GMUX MacBooks, but for now this is necessary to avoid regressing backlight control on T2 Macs. Fixes: 21245df307cb ("ACPI: video: Add Apple GMUX brightness control detection") Reported-and-tested-by: Aditya Garg Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 7203481fd12b1257938519efb2460ea02b9236ee Author: Hans de Goede Date: Thu Dec 15 10:44:43 2022 +0100 ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it should be Active_Low. This patch adds the ExpertBook B2502 model to the existing quirk list of Asus laptops with this issue. Fixes: b5f9223a105d ("ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142574 Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit f3cb9b740869712d448edf3b9ef5952b847caf8b Author: Adrian Freund Date: Tue Dec 13 21:13:11 2022 +0100 ACPI: resource: do IRQ override on Lenovo 14ALC7 Commit bfcdf58380b1 ("ACPI: resource: do IRQ override on LENOVO IdeaPad") added an override for Lenovo IdeaPad 5 16ALC7. The 14ALC7 variant also suffers from a broken touchscreen and trackpad. Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216804 Signed-off-by: Adrian Freund Signed-off-by: Rafael J. Wysocki commit 7592b79ba4a91350b38469e05238308bcfe1019b Author: Erik Schumacher Date: Sun Dec 11 14:33:22 2022 +0100 ACPI: resource: do IRQ override on XMG Core 15 The Schenker XMG CORE 15 (M22) is Ryzen-6 based and needs IRQ overriding for the keyboard to work. Adding an entry for this laptop to the override_table makes the internal keyboard functional again. Signed-off-by: Erik Schumacher Signed-off-by: Rafael J. Wysocki commit 5aa9d943e9b6bf6e6023645cbe7ce7d5ed84baf4 Author: Mario Limonciello Date: Thu Dec 8 10:42:07 2022 -0600 ACPI: video: Don't enable fallback path for creating ACPI backlight by default The ACPI video detection code has a module parameter `register_backlight_delay` which is currently configured to 8 seconds. This means that if after 8 seconds of booting no native driver has created a backlight device then the code will attempt to make an ACPI video backlight device. This was intended as a safety mechanism with the backlight overhaul that occurred in kernel 6.1, but as it doesn't appear necesssary set it to be disabled by default. Suggested-by: Hans de Goede Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit c573e240609ff781a0246c0c8c8351abd0475287 Author: Mario Limonciello Date: Thu Dec 8 10:42:06 2022 -0600 drm/amd/display: Report to ACPI video if no panels were found On desktop APUs amdgpu doesn't create a native backlight device as no eDP panels are found. However if the BIOS has reported backlight control methods in the ACPI tables then an acpi_video0 backlight device will be made 8 seconds after boot. This has manifested in a power slider on a number of desktop APUs ranging from Ryzen 5000 through Ryzen 7000 on various motherboard manufacturers. To avoid this, report to the acpi video detection that the system does not have any panel connected in the native driver. Link: https://bugzilla.redhat.com/show_bug.cgi?id=1783786 Reported-by: Hans de Goede Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 00a734104af7d878f1252d49eff9298785c6cbdc Author: Mario Limonciello Date: Thu Dec 8 10:42:05 2022 -0600 ACPI: video: Allow GPU drivers to report no panels The current logic for the ACPI backlight detection will create a backlight device if no native or vendor drivers have created 8 seconds after the system has booted if the ACPI tables included backlight control methods. If the GPU drivers have loaded, they may be able to report whether any LCD panels were found. Allow using this information to factor in whether to enable the fallback logic for making an acpi_video0 backlight device. Suggested-by: Hans de Goede Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit fb857b0bb2c7eea22a896c53c849a75437d24ea8 Merge: 53eab8e76667b 3659fb5ac29a5 Author: Jens Axboe Date: Thu Dec 22 09:22:35 2022 -0700 Merge tag 'nvme-6.2-2022-12-22' of git://git.infradead.org/nvme into block-6.2 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.2 - fix doorbell buffer value endianness (Klaus Jensen) - fix Linux vs NVMe page size mismatch (Keith Busch) - fix a potential use memory access beyong the allocation limit (Keith Busch) - fix a multipath vs blktrace NULL pointer dereference (Yanjun Zhang)" * tag 'nvme-6.2-2022-12-22' of git://git.infradead.org/nvme: nvme: fix multipath crash caused by flush request when blktrace is enabled nvme-pci: fix page size checks nvme-pci: fix mempool alloc size nvme-pci: fix doorbell buffer value endianness commit 789e1e10f214c00ca18fc6610824c5b9876ba5f2 Author: Jeff Layton Date: Thu Dec 22 09:51:30 2022 -0500 nfsd: shut down the NFSv4 state objects before the filecache Currently, we shut down the filecache before trying to clean up the stateids that depend on it. This leads to the kernel trying to free an nfsd_file twice, and a refcount overput on the nf_mark. Change the shutdown procedure to tear down all of the stateids prior to shutting down the filecache. Reported-and-tested-by: Wang Yugui Signed-off-by: Jeff Layton Fixes: 5e113224c17e ("nfsd: nfsd_file cache entries should be per net namespace") Signed-off-by: Chuck Lever commit 09e6f9f98370be9a9f8978139e0eb1be87d1125f Author: Arnaldo Carvalho de Melo Date: Thu Dec 22 10:56:25 2022 -0300 perf python: Fix splitting CC into compiler and options Noticed this build failure on archlinux:base when building with clang: clang-14: error: optimization flag '-ffat-lto-objects' is not supported [-Werror,-Wignored-optimization-argument] In tools/perf/util/setup.py we check if clang supports that option, but since commit 3cad53a6f9cdbafa ("perf python: Account for multiple words in CC") this got broken as in the common case where CC="clang": >>> cc="clang" >>> print(cc.split()[0]) clang >>> option="-ffat-lto-objects" >>> print(str(cc.split()[1:]) + option) []-ffat-lto-objects >>> And then the Popen will call clang with that bogus option name that in turn will not produce the b"unknown argument" or b"is not supported" that this function uses to detect if the option is not available and thus later on clang will be called with an unknown/unsupported option. Fix it by looking if really there are options in the provided CC variable, and if so override 'cc' with the first token and append the options to the 'option' variable. Fixes: 3cad53a6f9cdbafa ("perf python: Account for multiple words in CC") Cc: Adrian Hunter Cc: Fangrui Song Cc: Florian Fainelli Cc: Ian Rogers Cc: Jiri Olsa Cc: John Keeping Cc: Khem Raj Cc: Leo Yan Cc: Michael Petlan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Sedat Dilek Link: http://lore.kernel.org/lkml/Y6Rq5F5NI0v1QQHM@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fa349e396e4886d742fd6501c599ec627ef1353b Author: Shawn Bohrer Date: Tue Dec 20 12:59:03 2022 -0600 veth: Fix race with AF_XDP exposing old or uninitialized descriptors When AF_XDP is used on on a veth interface the RX ring is updated in two steps. veth_xdp_rcv() removes packet descriptors from the FILL ring fills them and places them in the RX ring updating the cached_prod pointer. Later xdp_do_flush() syncs the RX ring prod pointer with the cached_prod pointer allowing user-space to see the recently filled in descriptors. The rings are intended to be SPSC, however the existing order in veth_poll allows the xdp_do_flush() to run concurrently with another CPU creating a race condition that allows user-space to see old or uninitialized descriptors in the RX ring. This bug has been observed in production systems. To summarize, we are expecting this ordering: CPU 0 __xsk_rcv_zc() CPU 0 __xsk_map_flush() CPU 2 __xsk_rcv_zc() CPU 2 __xsk_map_flush() But we are seeing this order: CPU 0 __xsk_rcv_zc() CPU 2 __xsk_rcv_zc() CPU 0 __xsk_map_flush() CPU 2 __xsk_map_flush() This occurs because we rely on NAPI to ensure that only one napi_poll handler is running at a time for the given veth receive queue. napi_schedule_prep() will prevent multiple instances from getting scheduled. However calling napi_complete_done() signals that this napi_poll is complete and allows subsequent calls to napi_schedule_prep() and __napi_schedule() to succeed in scheduling a concurrent napi_poll before the xdp_do_flush() has been called. For the veth driver a concurrent call to napi_schedule_prep() and __napi_schedule() can occur on a different CPU because the veth xmit path can additionally schedule a napi_poll creating the race. The fix as suggested by Magnus Karlsson, is to simply move the xdp_do_flush() call before napi_complete_done(). This syncs the producer ring pointers before another instance of napi_poll can be scheduled on another CPU. It will also slightly improve performance by moving the flush closer to when the descriptors were placed in the RX ring. Fixes: d1396004dd86 ("veth: Add XDP TX and REDIRECT") Suggested-by: Magnus Karlsson Signed-off-by: Shawn Bohrer Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com Signed-off-by: Paolo Abeni commit a9eb558a5bea66cc43950632f5fffec6b5795233 Author: David Howells Date: Fri Nov 18 07:57:27 2022 +0000 afs: Stop implementing ->writepage() We're trying to get rid of the ->writepage() hook[1]. Stop afs from using it by unlocking the page and calling afs_writepages_region() rather than folio_write_one(). A flag is passed to afs_writepages_region() to indicate that it should only write a single region so that we don't flush the entire file in ->write_begin(), but do add other dirty data to the region being written to try and reduce the number of RPC ops. This requires ->migrate_folio() to be implemented, so point that at filemap_migrate_folio() for files and also for symlinks and directories. This can be tested by turning on the afs_folio_dirty tracepoint and then doing something like: xfs_io -c "w 2223 7000" -c "w 15000 22222" -c "w 23 7" /afs/my/test/foo and then looking in the trace to see if the write at position 15000 gets stored before page 0 gets dirtied for the write at position 23. Signed-off-by: David Howells cc: Marc Dionne cc: Christoph Hellwig cc: Matthew Wilcox cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/20221113162902.883850-1-hch@lst.de/ [1] Link: https://lore.kernel.org/r/166876785552.222254.4403222906022558715.stgit@warthog.procyon.org.uk/ # v1 commit b3d3ca556757577c95a6bc786a5b6a48c23f00fa Author: Gaosheng Cui Date: Fri Sep 9 15:03:53 2022 +0800 afs: remove afs_cache_netfs and afs_zap_permits() declarations afs_zap_permits() has been removed since commit be080a6f43c4 ("afs: Overhaul permit caching"). afs_cache_netfs has been removed since commit 523d27cda149 ("afs: Convert afs to use the new fscache API"). so remove the declare for them from header file. Signed-off-by: Gaosheng Cui Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/20220909070353.1160228-1-cuigaosheng1@huawei.com/ commit 318b83b71242998814a570c3420c042ee6165fca Author: Colin Ian King Date: Thu Oct 20 18:39:23 2022 +0100 afs: remove variable nr_servers Variable nr_servers is no longer being used, the last reference to it was removed in commit 45df8462730d ("afs: Fix server list handling") so clean up the code by removing it. Signed-off-by: Colin Ian King Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/20221020173923.21342-1-colin.i.king@gmail.com/ commit 36f82c93ee0bd88f1c95a52537906b8178b537f1 Author: David Howells Date: Wed Dec 21 14:30:48 2022 +0000 afs: Fix lost servers_outstanding count The afs_fs_probe_dispatcher() work function is passed a count on net->servers_outstanding when it is scheduled (which may come via its timer). This is passed back to the work_item, passed to the timer or dropped at the end of the dispatcher function. But, at the top of the dispatcher function, there are two checks which skip the rest of the function: if the network namespace is being destroyed or if there are no fileservers to probe. These two return paths, however, do not drop the count passed to the dispatcher, and so, sometimes, the destruction of a network namespace, such as induced by rmmod of the kafs module, may get stuck in afs_purge_servers(), waiting for net->servers_outstanding to become zero. Fix this by adding the missing decrements in afs_fs_probe_dispatcher(). Fixes: f6cbb368bcb0 ("afs: Actively poll fileservers to maintain NAT or firewall openings") Reported-by: Marc Dionne Signed-off-by: David Howells Tested-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/167164544917.2072364.3759519569649459359.stgit@warthog.procyon.org.uk/ commit d717f9474e3fb7e6bd3e43ca16e131f04320ed6f Author: Horatiu Vultur Date: Wed Dec 21 10:33:15 2022 +0100 net: lan966x: Fix configuration of the PCS When the PCS was taken out of reset, we were changing by mistake also the speed to 100 Mbit. But in case the link was going down, the link up routine was setting correctly the link speed. If the link was not getting down then the speed was forced to run at 100 even if the speed was something else. On lan966x, to set the speed link to 1G or 2.5G a value of 1 needs to be written in DEV_CLOCK_CFG_LINK_SPEED. This is similar to the procedure in lan966x_port_init. The issue was reproduced using 1000base-x sfp module using the commands: ip link set dev eth2 up ip link addr add 10.97.10.2/24 dev eth2 ethtool -s eth2 speed 1000 autoneg off Fixes: d28d6d2e37d1 ("net: lan966x: add port module support") Signed-off-by: Horatiu Vultur Reviewed-by: Piotr Raczynski Link: https://lore.kernel.org/r/20221221093315.939133-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 42c7ded0eeacd2ba5db599205c71c279dc715de7 Author: Eric Dumazet Date: Tue Dec 20 13:08:31 2022 +0000 bonding: fix lockdep splat in bond_miimon_commit() bond_miimon_commit() is run while RTNL is held, not RCU. WARNING: suspicious RCU usage 6.1.0-syzkaller-09671-g89529367293c #0 Not tainted ----------------------------- drivers/net/bonding/bond_main.c:2704 suspicious rcu_dereference_check() usage! Fixes: e95cc44763a4 ("bonding: do failover when high prio link up") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Hangbin Liu Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Link: https://lore.kernel.org/r/20221220130831.1480888-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 123b99619cca94bdca0bf7bde9abe28f0a0dfe06 Author: Pablo Neira Ayuso Date: Mon Dec 19 20:10:12 2022 +0100 netfilter: nf_tables: honor set timeout and garbage collection updates Set timeout and garbage collection interval updates are ignored on updates. Add transaction to update global set element timeout and garbage collection interval. Fixes: 96518518cc41 ("netfilter: add nftables") Suggested-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 3659fb5ac29a5e6102bebe494ac789fd47fb78f4 Author: Yanjun Zhang Date: Thu Dec 22 09:57:21 2022 +0800 nvme: fix multipath crash caused by flush request when blktrace is enabled The flush request initialized by blk_kick_flush has NULL bio, and it may be dealt with nvme_end_req during io completion. When blktrace is enabled, nvme_trace_bio_complete with multipath activated trying to access NULL pointer bio from flush request results in the following crash: [ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a [ 2517.835213] #PF: supervisor read access in kernel mode [ 2517.838724] #PF: error_code(0x0000) - not-present page [ 2517.842222] PGD 7b2d51067 P4D 0 [ 2517.845684] Oops: 0000 [#1] SMP NOPTI [ 2517.849125] CPU: 2 PID: 732 Comm: kworker/2:1H Kdump: loaded Tainted: G S 5.15.67-0.cl9.x86_64 #1 [ 2517.852723] Hardware name: XFUSION 2288H V6/BC13MBSBC, BIOS 1.13 07/27/2022 [ 2517.856358] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [ 2517.859993] RIP: 0010:blk_add_trace_bio_complete+0x6/0x30 [ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1f 44 00 00 41 54 49 89 f4 55 <0f> b6 7a 1a 48 89 d5 e8 3e 1c 2b 00 48 89 ee 4c 89 e7 5d 89 c1 ba [ 2517.871269] RSP: 0018:ff7f6a008d9dbcd0 EFLAGS: 00010286 [ 2517.875081] RAX: ff3d5b4be00b1d50 RBX: 0000000002040002 RCX: ff3d5b0a270f2000 [ 2517.878966] RDX: 0000000000000000 RSI: ff3d5b0b021fb9f8 RDI: 0000000000000000 [ 2517.882849] RBP: ff3d5b0b96a6fa00 R08: 0000000000000001 R09: 0000000000000000 [ 2517.886718] R10: 000000000000000c R11: 000000000000000c R12: ff3d5b0b021fb9f8 [ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018 [ 2517.894434] FS: 0000000000000000(0000) GS:ff3d5b42bfc80000(0000) knlGS:0000000000000000 [ 2517.898299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2517.902157] CR2: 000000000000001a CR3: 00000004f023e005 CR4: 0000000000771ee0 [ 2517.906053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2517.909930] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2517.913761] PKRU: 55555554 [ 2517.917558] Call Trace: [ 2517.921294] [ 2517.924982] nvme_complete_rq+0x1c3/0x1e0 [nvme_core] [ 2517.928715] nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp] [ 2517.932442] nvme_tcp_recv_skb+0x4f/0x240 [nvme_tcp] [ 2517.936137] ? nvme_tcp_recv_pdu+0x540/0x540 [nvme_tcp] [ 2517.939830] tcp_read_sock+0x9c/0x260 [ 2517.943486] nvme_tcp_try_recv+0x65/0xa0 [nvme_tcp] [ 2517.947173] nvme_tcp_io_work+0x64/0x90 [nvme_tcp] [ 2517.950834] process_one_work+0x1e8/0x390 [ 2517.954473] worker_thread+0x53/0x3c0 [ 2517.958069] ? process_one_work+0x390/0x390 [ 2517.961655] kthread+0x10c/0x130 [ 2517.965211] ? set_kthread_struct+0x40/0x40 [ 2517.968760] ret_from_fork+0x1f/0x30 [ 2517.972285] To avoid this situation, add a NULL check for req->bio before calling trace_block_bio_complete. Signed-off-by: Yanjun Zhang Signed-off-by: Christoph Hellwig commit 6bf5f9a8b408a6ce5aba6119f305b5b8f1238025 Merge: fd28941cff1cd a12a383e59ce4 Author: Takashi Iwai Date: Thu Dec 22 09:18:38 2022 +0100 Merge tag 'asoc-v6.2-3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v6.2 Some more small fixes and board quirks that came in since my last update, the main one being the fixes from Kai for issues around the attempts to get kexec working well on SOF based systems. commit fd28941cff1cd9d8ffa59fe11eb64148e09b6ed6 Author: Jaroslav Kysela Date: Thu Dec 15 16:30:37 2022 +0100 ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless It seems that the firmware is broken and does not accept the UAC_EP_CS_ATTR_SAMPLE_RATE URB. There is only one rate (48000Hz) available in the descriptors for the output endpoint. Create a new quirk QUIRK_FLAG_FIXED_RATE to skip the rate setup when only one rate is available (fixed). BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216798 Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20221215153037.1163786-1-perex@perex.cz Signed-off-by: Takashi Iwai commit a95e163a4bfa7780f64e589bbedc6bdeb7cf3839 Author: Jiapeng Chong Date: Tue Dec 13 14:13:55 2022 +0800 ALSA: azt3328: Remove the unused function snd_azf3328_codec_outl() The function snd_azf3328_codec_outl is defined in the azt3328.c file, but not called elsewhere, so remove this unused function. sound/pci/azt3328.c:367:1: warning: unused function 'snd_azf3328_codec_outl'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3432 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20221213061355.62856-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Takashi Iwai commit 2d78eb0342dd2c9c5cde9ae9ada1d33f189a858b Merge: b47068b4aa53a ee0b089d66002 Author: Takashi Iwai Date: Thu Dec 22 09:11:48 2022 +0100 Merge branch 'for-next' into for-linus commit 9d2f6060fe4c3b49d0cdc1dce1c99296f33379c8 Merge: af9b3fa15d6d9 bfa87ac86ce9f Author: Linus Torvalds Date: Wed Dec 21 19:03:42 2022 -0800 Merge tag 'trace-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "I missed this minor hardening of the kernel in the first pull. - Make monitor structures read only" * tag 'trace-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv/monitors: Move monitor structure in rodata commit af9b3fa15d6d99d948bcaca5a036ad2b292c8e8a Merge: 7a5189c58b3cf d4505aa6afae1 Author: Linus Torvalds Date: Wed Dec 21 18:57:24 2022 -0800 Merge tag 'trace-probes-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull trace probes updates from Steven Rostedt: - New "symstr" type for dynamic events that writes the name of the function+offset into the ring buffer and not just the address - Prevent kernel symbol processing on addresses in user space probes (uprobes). - And minor fixes and clean ups * tag 'trace-probes-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Reject symbol/symstr type for uprobe tracing/probes: Add symstr type for dynamic events kprobes: kretprobe events missing on 2-core KVM guest kprobes: Fix check for probe enabled in kill_kprobe() test_kprobes: Fix implicit declaration error of test_kprobes tracing: Fix race where eprobes can be called before the event commit 7a5189c58b3cf250e6f50ede724409c31795d5f1 Merge: 569c3a283c96a 6ebbdecff6ae0 Author: Linus Torvalds Date: Wed Dec 21 18:52:15 2022 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull RISC-V kvm updates from Paolo Bonzini: - Allow unloading KVM module - Allow KVM user-space to set mvendorid, marchid, and mimpid - Several fixes and cleanups * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: RISC-V: KVM: Add ONE_REG interface for mvendorid, marchid, and mimpid RISC-V: KVM: Save mvendorid, marchid, and mimpid when creating VCPU RISC-V: Export sbi_get_mvendorid() and friends RISC-V: KVM: Move sbi related struct and functions to kvm_vcpu_sbi.h RISC-V: KVM: Use switch-case in kvm_riscv_vcpu_set/get_reg() RISC-V: KVM: Remove redundant includes of asm/csr.h RISC-V: KVM: Remove redundant includes of asm/kvm_vcpu_timer.h RISC-V: KVM: Fix reg_val check in kvm_riscv_vcpu_set_reg_config() RISC-V: KVM: Simplify kvm_arch_prepare_memory_region() RISC-V: KVM: Exit run-loop immediately if xfer_to_guest fails RISC-V: KVM: use vma_lookup() instead of find_vma_intersection() RISC-V: KVM: Add exit logic to main.c commit 43ae218f69a66a4998ca2f99b9a1887ccc61fd4f Merge: e20aa071cd955 fec3adfd754cc Author: Jakub Kicinski Date: Wed Dec 21 18:06:01 2022 -0800 Merge branch 'mptcp-locking-fixes' Mat Martineau says: ==================== mptcp: Locking fixes Two separate locking fixes for the networking tree: Patch 1 addresses a MPTCP fastopen error-path deadlock that was found with syzkaller. Patch 2 works around a lockdep false-positive between MPTCP listening and non-listening sockets at socket destruct time. ==================== Link: https://lore.kernel.org/r/20221220195215.238353-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit fec3adfd754ccc99a7230e8ab9f105b65fb07bcc Author: Paolo Abeni Date: Tue Dec 20 11:52:15 2022 -0800 mptcp: fix lockdep false positive MattB reported a lockdep splat in the mptcp listener code cleanup: WARNING: possible circular locking dependency detected packetdrill/14278 is trying to acquire lock: ffff888017d868f0 ((work_completion)(&msk->work)){+.+.}-{0:0}, at: __flush_work (kernel/workqueue.c:3069) but task is already holding lock: ffff888017d84130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973) which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: __lock_acquire (kernel/locking/lockdep.c:5055) lock_acquire (kernel/locking/lockdep.c:466) lock_sock_nested (net/core/sock.c:3463) mptcp_worker (net/mptcp/protocol.c:2614) process_one_work (kernel/workqueue.c:2294) worker_thread (include/linux/list.h:292) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:312) -> #0 ((work_completion)(&msk->work)){+.+.}-{0:0}: check_prev_add (kernel/locking/lockdep.c:3098) validate_chain (kernel/locking/lockdep.c:3217) __lock_acquire (kernel/locking/lockdep.c:5055) lock_acquire (kernel/locking/lockdep.c:466) __flush_work (kernel/workqueue.c:3070) __cancel_work_timer (kernel/workqueue.c:3160) mptcp_cancel_work (net/mptcp/protocol.c:2758) mptcp_subflow_queue_clean (net/mptcp/subflow.c:1817) __mptcp_close_ssk (net/mptcp/protocol.c:2363) mptcp_destroy_common (net/mptcp/protocol.c:3170) mptcp_destroy (include/net/sock.h:1495) __mptcp_destroy_sock (net/mptcp/protocol.c:2886) __mptcp_close (net/mptcp/protocol.c:2959) mptcp_close (net/mptcp/protocol.c:2974) inet_release (net/ipv4/af_inet.c:432) __sock_release (net/socket.c:651) sock_close (net/socket.c:1367) __fput (fs/file_table.c:320) task_work_run (kernel/task_work.c:181 (discriminator 1)) exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49) syscall_exit_to_user_mode (kernel/entry/common.c:130) do_syscall_64 (arch/x86/entry/common.c:87) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET); lock((work_completion)(&msk->work)); lock(sk_lock-AF_INET); lock((work_completion)(&msk->work)); *** DEADLOCK *** The report is actually a false positive, since the only existing lock nesting is the msk socket lock acquired by the mptcp work. cancel_work_sync() is invoked without the relevant socket lock being held, but under a different (the msk listener) socket lock. We could silence the splat adding a per workqueue dynamic lockdep key, but that looks overkill. Instead just tell lockdep the msk socket lock is not held around cancel_work_sync(). Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/322 Fixes: 30e51b923e43 ("mptcp: fix unreleased socket in accept queue") Reported-by: Matthieu Baerts Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 7d803344fdc3e38079fabcf38b1e4cb6f8faa655 Author: Paolo Abeni Date: Tue Dec 20 11:52:14 2022 -0800 mptcp: fix deadlock in fastopen error path MatM reported a deadlock at fastopening time: INFO: task syz-executor.0:11454 blocked for more than 143 seconds. Tainted: G S 6.1.0-rc5-03226-gdb0157db5153 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:25104 pid:11454 ppid:424 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5191 [inline] __schedule+0x5c2/0x1550 kernel/sched/core.c:6503 schedule+0xe8/0x1c0 kernel/sched/core.c:6579 __lock_sock+0x142/0x260 net/core/sock.c:2896 lock_sock_nested+0xdb/0x100 net/core/sock.c:3466 __mptcp_close_ssk+0x1a3/0x790 net/mptcp/protocol.c:2328 mptcp_destroy_common+0x16a/0x650 net/mptcp/protocol.c:3171 mptcp_disconnect+0xb8/0x450 net/mptcp/protocol.c:3019 __inet_stream_connect+0x897/0xa40 net/ipv4/af_inet.c:720 tcp_sendmsg_fastopen+0x3dd/0x740 net/ipv4/tcp.c:1200 mptcp_sendmsg_fastopen net/mptcp/protocol.c:1682 [inline] mptcp_sendmsg+0x128a/0x1a50 net/mptcp/protocol.c:1721 inet6_sendmsg+0x11f/0x150 net/ipv6/af_inet6.c:663 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xf7/0x190 net/socket.c:734 ____sys_sendmsg+0x336/0x970 net/socket.c:2476 ___sys_sendmsg+0x122/0x1c0 net/socket.c:2530 __sys_sendmmsg+0x18d/0x460 net/socket.c:2616 __do_sys_sendmmsg net/socket.c:2645 [inline] __se_sys_sendmmsg net/socket.c:2642 [inline] __x64_sys_sendmmsg+0x9d/0x110 net/socket.c:2642 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f5920a75e7d RSP: 002b:00007f59201e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f5920bb4f80 RCX: 00007f5920a75e7d RDX: 0000000000000001 RSI: 0000000020002940 RDI: 0000000000000005 RBP: 00007f5920ae7593 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020004050 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f5920bb4f80 R15: 00007f59201c8000 In the error path, tcp_sendmsg_fastopen() ends-up calling mptcp_disconnect(), and the latter tries to close each subflow, acquiring the socket lock on each of them. At fastopen time, we have a single subflow, and such subflow socket lock is already held by the called, causing the deadlock. We already track the 'fastopen in progress' status inside the msk socket. Use it to address the issue, making mptcp_disconnect() a no op when invoked from the fastopen (error) path and doing the relevant cleanup after releasing the subflow socket lock. While at the above, rename the fastopen status bit to something more meaningful. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/321 Fixes: fa9e57468aa1 ("mptcp: fix abba deadlock on fastopen") Reported-by: Mat Martineau Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit e20aa071cd955aabc15be0ec1e914283592ddef4 Author: Yinjun Zhang Date: Tue Dec 20 16:21:00 2022 +0100 nfp: fix schedule in atomic context when sync mc address The callback `.ndo_set_rx_mode` is called in atomic context, sleep is not allowed in the implementation. Now use workqueue mechanism to avoid this issue. Fixes: de6248644966 ("nfp: add support for multicast filter") Signed-off-by: Yinjun Zhang Reviewed-by: Louis Peens Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20221220152100.1042774-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit 3d8f2c4269d08f8793e946279dbdf5e972cc4911 Author: Ronak Doshi Date: Tue Dec 20 12:25:55 2022 -0800 vmxnet3: correctly report csum_level for encapsulated packet Commit dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support") added support for encapsulation offload. However, the pathc did not report correctly the csum_level for encapsulated packet. This patch fixes this issue by reporting correct csum level for the encapsulated packet. Fixes: dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support") Signed-off-by: Ronak Doshi Acked-by: Peng Li Link: https://lore.kernel.org/r/20221220202556.24421-1-doshir@vmware.com Signed-off-by: Jakub Kicinski commit 95637d91fefdb94d6e7389222ba9ddab0e9f5abe Author: Aaron Conole Date: Tue Dec 20 16:27:17 2022 -0500 net: openvswitch: release vport resources on failure A recent commit introducing upcall packet accounting failed to properly release the vport object when the per-cpu stats struct couldn't be allocated. This can cause dangling pointers to dp objects long after they've been released. Cc: wangchuanlei Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets") Reported-by: syzbot+8f4e2dcfcb3209ac35f9@syzkaller.appspotmail.com Signed-off-by: Aaron Conole Acked-by: Eelco Chaudron Reviewed-by: Michal Swiatkowski Link: https://lore.kernel.org/r/20221220212717.526780-1-aconole@redhat.com Signed-off-by: Jakub Kicinski commit f2575c8f404911da83f25b688e12afcf4273e640 Author: Antoine Tenart Date: Tue Dec 20 18:18:25 2022 +0100 net: vrf: determine the dst using the original ifindex for multicast Multicast packets received on an interface bound to a VRF are marked as belonging to the VRF and the skb device is updated to point to the VRF device itself. This was fine even when a route was associated to a device as when performing a fib table lookup 'oif' in fib6_table_lookup (coming from 'skb->dev->ifindex' in ip6_route_input) was set to 0 when FLOWI_FLAG_SKIP_NH_OIF was set. With commit 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices") this is not longer true and multicast traffic is not received on the original interface. Instead of adding back a similar check in fib6_table_lookup determine the dst using the original ifindex for multicast VRF traffic. To make things consistent across the function do the above for all strict packets, which was the logic before commit 6f12fa775530 ("vrf: mark skb for multicast or link-local as enslaved to VRF"). Note that reverting to this behavior should be fine as the change was about marking packets belonging to the VRF, not about their dst. Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices") Reported-by: Jianlin Shi Signed-off-by: Antoine Tenart Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20221220171825.1172237-1-atenart@kernel.org Signed-off-by: Jakub Kicinski commit 53fc61be273a1e76dd5e356f91805dce00ff2d2c Author: Maciej Fijalkowski Date: Tue Dec 20 09:54:48 2022 -0800 ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf Previously ice XDP xmit routine was changed in a way that it avoids xdp_buff->xdp_frame conversion as it is simply not needed for handling XDP_TX action and what is more it saves us CPU cycles. This routine is re-used on ZC driver to handle XDP_TX action. Although for XDP_TX on Rx ZC xdp_buff that comes from xsk_buff_pool is converted to xdp_frame, xdp_frame itself is not stored inside ice_tx_buf, we only store raw data pointer. Casting this pointer to xdp_frame and calling against it xdp_return_frame in ice_clean_xdp_tx_buf() results in undefined behavior. To fix this, simply call page_frag_free() on tx_buf->raw_buf. Later intention is to remove the buff->frame conversion in order to simplify the codebase and improve XDP_TX performance on ZC. Fixes: 126cdfe1007a ("ice: xsk: Improve AF_XDP ZC Tx and use batching API") Reported-and-tested-by: Robin Cowley Signed-off-by: Maciej Fijalkowski Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Piotr Raczynski Link: https://lore.kernel.org/r/20221220175448.693999-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit fe8f5b2f7bec504021b395d24f7efca415d21e2b Merge: 38624d2c972e7 c1c4a8b217213 Author: Dave Airlie Date: Thu Dec 22 11:02:55 2022 +1000 Merge tag 'amd-drm-fixes-6.2-2022-12-21' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.2-2022-12-21: amdgpu: - Avoid large variable on the stack - S0ix fixes - SMU 13.x fixes - VCN fix - Add missing fence reference amdkfd: - Fix init vm error handling - Fix double release of compute pasid Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20221221205828.6093-1-alexander.deucher@amd.com commit aa6c3961a3eef78a93a8f3a3760ae1dd7ebb94e8 Merge: 609d3bc623051 b7dc753fe33a7 Author: Jakub Kicinski Date: Wed Dec 21 16:44:55 2022 -0800 Merge tag 'wireless-2022-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.2 First set of fixes for v6.2. Fix for a link error in mt76, fix for an iwlwifi firmware crash and two cleanups. * tag 'wireless-2022-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: ath9k: use proper statements in conditionals wifi: mt76: mt7996: select CONFIG_RELAY wifi: iwlwifi: fw: skip PPAG for JF wifi: ti: remove obsolete lines in the Makefile ==================== Link: https://lore.kernel.org/r/20221221180808.96A8AC433EF@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 569c3a283c96a9efbf7ee32dda10905b8684de07 Merge: 5d4740fc787db 53eab8e76667b Author: Linus Torvalds Date: Wed Dec 21 16:35:26 2022 -0800 Merge tag 'block-6.2-2022-12-19' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Various fixes for BFQ (Yu, Yuwei) - Fix for loop command line parsing (Isaac) - No need to specifically clear REQ_ALLOC_CACHE on IOPOLL downgrade anymore (me) - blk-iocost enum fix for newer gcc (Jiri) - UAF fix for queue release (Ming) - blk-iolatency error handling memory leak fix (Tejun) * tag 'block-6.2-2022-12-19' of git://git.kernel.dk/linux: block: don't clear REQ_ALLOC_CACHE for non-polled requests block: fix use-after-free of q->q_usage_counter block, bfq: only do counting of pending-request for BFQ_GROUP_IOSCHED blk-iolatency: Fix memory leak on add_disk() failures loop: Fix the max_loop commandline argument treatment when it is set to 0 block/blk-iocost (gcc13): keep large values in a new enum block, bfq: replace 0/1 with false/true in bic apis block, bfq: don't return bfqg from __bfq_bic_change_cgroup() block, bfq: fix possible uaf for 'bfqq->bic' commit 5d4740fc787db767811c4ac625665493314b382c Merge: 0a924817d2ed9 5ad70eb27d2b8 Author: Linus Torvalds Date: Wed Dec 21 16:28:25 2022 -0800 Merge tag 'io_uring-6.2-2022-12-19' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Improve the locking for timeouts. This was originally queued up for the initial pull, but I messed up and it got missed. (Pavel) - Fix an issue with running task_work from the wait path, causing some inefficiencies (me) - Add a clear of ->free_iov upfront in the 32-bit compat data importing, so we ensure that it's always sane at completion time (me) - Use call_rcu_hurry() for the eventfd signaling (Dylan) - Ordering fix for multishot recv completions (Pavel) - Add the io_uring trace header to the MAINTAINERS entry (Ammar) * tag 'io_uring-6.2-2022-12-19' of git://git.kernel.dk/linux: MAINTAINERS: io_uring: Add include/trace/events/io_uring.h io_uring/net: fix cleanup after recycle io_uring/net: ensure compat import handlers clear free_iov io_uring: include task_work run after scheduling in wait for events io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work io_uring: use call_rcu_hurry if signaling an eventfd io_uring: fix overflow handling regression io_uring: ease timeout flush locking requirements io_uring: revise completion_lock locking io_uring: protect cq_timeouts with timeout_lock commit 70a00e2f1dbae11dc3444444c6bd7555763d8421 Author: Martin KaFai Lau Date: Wed Dec 21 10:56:53 2022 -0800 selftests/bpf: Test bpf_skb_adjust_room on CHECKSUM_PARTIAL When the bpf_skb_adjust_room() shrinks the skb such that its csum_start is invalid, the skb->ip_summed should be reset from CHECKSUM_PARTIAL to CHECKSUM_NONE. The commit 54c3f1a81421 ("bpf: pull before calling skb_postpull_rcsum()") fixed it. This patch adds a test to ensure the skb->ip_summed changed from CHECKSUM_PARTIAL to CHECKSUM_NONE after bpf_skb_adjust_room(). Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20221221185653.1589961-1-martin.lau@linux.dev commit e96b95c2b7a63a454b6498e2df67aac14d046d13 Author: Rickard x Andersson Date: Tue Dec 20 11:23:18 2022 +0100 gcov: add support for checksum field In GCC version 12.1 a checksum field was added. This patch fixes a kernel crash occurring during boot when using gcov-kernel with GCC version 12.2. The crash occurred on a system running on i.MX6SX. Link: https://lkml.kernel.org/r/20221220102318.3418501-1-rickaran@axis.com Fixes: 977ef30a7d88 ("gcov: support GCC 12.1 and newer compilers") Signed-off-by: Rickard x Andersson Reviewed-by: Peter Oberparleiter Tested-by: Peter Oberparleiter Reviewed-by: Martin Liska Cc: Signed-off-by: Andrew Morton commit c5651b31f51584bd1199b3a552c8211a8523d6e1 Author: Liam Howlett Date: Mon Dec 19 16:20:15 2022 +0000 test_maple_tree: add test for mas_spanning_rebalance() on insufficient data Add a test to the maple tree test suite for the spanning rebalance insufficient node issue does not go undetected again. Link: https://lkml.kernel.org/r/20221219161922.2708732-3-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Cc: Andrei Vagin Cc: Mike Rapoport Cc: Muhammad Usama Anjum Cc: Signed-off-by: Andrew Morton commit 0abb964aae3da746ea2fd4301599a6fa26da58db Author: Liam Howlett Date: Mon Dec 19 16:20:15 2022 +0000 maple_tree: fix mas_spanning_rebalance() on insufficient data Mike Rapoport contacted me off-list with a regression in running criu. Periodic tests fail with an RCU stall during execution. Although rare, it is possible to hit this with other uses so this patch should be backported to fix the regression. This patchset adds the fix and a test case to the maple tree test suite. This patch (of 2): An insufficient node was causing an out-of-bounds access on the node in mas_leaf_max_gap(). The cause was the faulty detection of the new node being a root node when overwriting many entries at the end of the tree. Fix the detection of a new root and ensure there is sufficient data prior to entering the spanning rebalance loop. Link: https://lkml.kernel.org/r/20221219161922.2708732-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20221219161922.2708732-2-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Mike Rapoport Tested-by: Mike Rapoport Cc: Andrei Vagin Cc: Mike Rapoport Cc: Muhammad Usama Anjum Cc: Signed-off-by: Andrew Morton commit e700898fa075c69b3ae02b702ab57fb75e1a82ec Author: Mike Kravetz Date: Mon Dec 12 15:50:41 2022 -0800 hugetlb: really allocate vma lock for all sharable vmas Commit bbff39cc6cbc ("hugetlb: allocate vma lock for all sharable vmas") removed the pmd sharable checks in the vma lock helper routines. However, it left the functional version of helper routines behind #ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE. Therefore, the vma lock is not being used for sharable vmas on architectures that do not support pmd sharing. On these architectures, a potential fault/truncation race is exposed that could leave pages in a hugetlb file past i_size until the file is removed. Move the functional vma lock helpers outside the ifdef, and remove the non-functional stubs. Since the vma lock is not just for pmd sharing, rename the routine __vma_shareable_flags_pmd. Link: https://lkml.kernel.org/r/20221212235042.178355-1-mike.kravetz@oracle.com Fixes: bbff39cc6cbc ("hugetlb: allocate vma lock for all sharable vmas") Signed-off-by: Mike Kravetz Reviewed-by: Miaohe Lin Cc: "Aneesh Kumar K.V" Cc: David Hildenbrand Cc: James Houghton Cc: Mina Almasry Cc: Muchun Song Cc: Naoya Horiguchi Cc: Peter Xu Cc: Signed-off-by: Andrew Morton commit 7ba594d700998bafa96a75360d2e060aa39156d2 Author: Arnd Bergmann Date: Thu Dec 15 17:26:57 2022 +0100 kmsan: export kmsan_handle_urb USB support can be in a loadable module, and this causes a link failure with KMSAN: ERROR: modpost: "kmsan_handle_urb" [drivers/usb/core/usbcore.ko] undefined! Export the symbol so it can be used by this module. Link: https://lkml.kernel.org/r/20221215162710.3802378-1-arnd@kernel.org Fixes: 553a80188a5d ("kmsan: handle memory sent to/from USB") Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit aaa746ad8b30f38ef89a301faf339ef1c19cf33a Author: Arnd Bergmann Date: Thu Dec 15 17:30:17 2022 +0100 kmsan: include linux/vmalloc.h This is needed for the vmap/vunmap declarations: mm/kmsan/kmsan_test.c:316:9: error: implicit declaration of function 'vmap' is invalid in C99 [-Werror,-Wimplicit-function-declaration] vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL); ^ mm/kmsan/kmsan_test.c:316:29: error: use of undeclared identifier 'VM_MAP' vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL); ^ mm/kmsan/kmsan_test.c:322:3: error: implicit declaration of function 'vunmap' is invalid in C99 [-Werror,-Wimplicit-function-declaration] vunmap(vbuf); ^ Link: https://lkml.kernel.org/r/20221215163046.4079767-1-arnd@kernel.org Fixes: 8ed691b02ade ("kmsan: add tests for KMSAN") Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit 38ce7c9bdfc228c14d7621ba36d3eebedd9d4f76 Author: Mathieu Desnoyers Date: Thu Dec 15 14:46:21 2022 -0500 mm/mempolicy: fix memory leak in set_mempolicy_home_node system call When encountering any vma in the range with policy other than MPOL_BIND or MPOL_PREFERRED_MANY, an error is returned without issuing a mpol_put on the policy just allocated with mpol_dup(). This allows arbitrary users to leak kernel memory. Link: https://lkml.kernel.org/r/20221215194621.202816-1-mathieu.desnoyers@efficios.com Fixes: c6018b4b2549 ("mm/mempolicy: add set_mempolicy_home_node syscall") Signed-off-by: Mathieu Desnoyers Reviewed-by: Randy Dunlap Reviewed-by: "Huang, Ying" Reviewed-by: Aneesh Kumar K.V Acked-by: Michal Hocko Cc: Aneesh Kumar K.V Cc: Dave Hansen Cc: Feng Tang Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Mel Gorman Cc: Mike Kravetz Cc: Randy Dunlap Cc: Vlastimil Babka Cc: Andi Kleen Cc: Dan Williams Cc: Huang Ying Cc: [5.17+] Signed-off-by: Andrew Morton commit 6f12be792fde994ed934168f93c2a0d2a0cf0bc5 Author: Vlastimil Babka Date: Fri Dec 16 17:32:27 2022 +0100 mm, mremap: fix mremap() expanding vma with addr inside vma Since 6.1 we have noticed random rpm install failures that were tracked to mremap() returning -ENOMEM and to commit ca3d76b0aa80 ("mm: add merging after mremap resize"). The problem occurs when mremap() expands a VMA in place, but using an starting address that's not vma->vm_start, but somewhere in the middle. The extension_pgoff calculation introduced by the commit is wrong in that case, so vma_merge() fails due to pgoffs not being compatible. Fix the calculation. By the way it seems that the situations, where rpm now expands a vma from the middle, were made possible also due to that commit, thanks to the improved vma merging. Yet it should work just fine, except for the buggy calculation. Link: https://lkml.kernel.org/r/20221216163227.24648-1-vbabka@suse.cz Reported-by: Jiri Slaby Link: https://bugzilla.suse.com/show_bug.cgi?id=1206359 Fixes: ca3d76b0aa80 ("mm: add merging after mremap resize") Signed-off-by: Vlastimil Babka Cc: Jakub Matěna Cc: "Kirill A . Shutemov" Cc: Liam Howlett Cc: Matthew Wilcox Cc: Mel Gorman Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton commit c1c4a8b217213c1924eabf4f28385bbee9cc50c1 Author: Christian König Date: Mon Dec 19 11:47:18 2022 +0100 drm/amdgpu: grab extra fence reference for drm_sched_job_add_dependency That function consumes the reference. Reviewed-by: Luben Tuikov Reported-by: Borislav Petkov (AMD) Tested-by: Borislav Petkov (AMD) Signed-off-by: Christian König Fixes: aab9cf7b6954 ("drm/amdgpu: use scheduler dependencies for VM updates") Signed-off-by: Alex Deucher commit 23fffb2f09ce1145cbd751801d45ba74acaa6542 Author: Jens Axboe Date: Wed Dec 21 07:11:33 2022 -0700 io_uring/cancel: re-grab ctx mutex after finishing wait If we have a signal pending during cancelations, it'll cause the task_work run to return an error. Since we didn't run task_work, the current task is left in TASK_INTERRUPTIBLE state when we need to re-grab the ctx mutex, and the kernel will rightfully complain about that. Move the lock grabbing for the error cases outside the loop to avoid that issue. Reported-by: syzbot+7df055631cd1be4586fd@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/0000000000003a14a905f05050b0@google.com/ Signed-off-by: Jens Axboe commit f257ba9c160f4cb13e88b9be83e39a0e94d45c70 Author: Arnaldo Carvalho de Melo Date: Wed Dec 21 17:30:38 2022 -0300 perf scripting python: Don't be strict at handling libtraceevent enumerations The build was failing on archlinux because it has a newer libtraceevent that added a new entry to the tep_print_arg_type enum: 19.72 archlinux:base : FAIL gcc version 12.2.0 (GCC) util/scripting-engines/trace-event-python.c: In function ‘define_event_symbols’: util/scripting-engines/trace-event-python.c:281:9: error: enumeration value ‘TEP_PRINT_CPUMASK’ not handled in switch [-Werror=switch-enum] 281 | switch (args->type) { | ^~~~~~ cc1: all warnings being treated as errors Since we build with distros that have different versions of libtraceevent and there is no way to easily test if these enum entries are available, just disable -Werror=switch-enum for that specific object. Signed-off-by: Arnaldo Carvalho de Melo commit e1d900df63adcb748905131dd6258e570e11aed1 Author: Saleemkhan Jamadar Date: Tue Dec 20 13:21:44 2022 +0530 drm/amdgpu: enable VCN DPG for GC IP v11.0.4 Enable VCN Dynamic Power Gating control for GC IP v11.0.4. Signed-off-by: Saleemkhan Jamadar Reviewed-by: Veerabadhran Gopalakrishnan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0, 6.1 commit 9854e7ad35fecf3007d44e58484e05cf39a62bd6 Author: Hans-Peter Nilsson Date: Mon Dec 28 03:41:59 2020 +0100 perf arm64: Simplify mksyscalltbl This patch isn't intended to have any effect on the compiled code. It just removes one level of indirection: calling the *host* compiler to build and then run a program that just printf:s the numerical entries of the syscall-table. In other words, the generated syscalls.c changes from: [46] = "ftruncate", to: [__NR3264_ftruncate] = "ftruncate", The latter is as good as the former to the user of perf, and this can be done directly by the shell-script. The syscalls defined as non-literal values (like "#define __NR_ftruncate __NR3264_ftruncate") are trivially resolved at compile-time without namespace-leaking and/or collision for its sole user, perf/util/syscalltbl.c, that just #includes the generated file. A future "-mabi=32" support would probably have to handle this differently, but that is a pre-existing problem not affected by this simplification. Calling the *host* compiler only complicates things and accidentally can get a completely wrong set of files and syscall numbers, see earlier commits. Note that the script parameter hostcc is now unused. At the time of this patch, powerpc (the origin, see comments), and also e.g. x86 has moved on, from filtering "gcc -dM -E" output to reading separate specific text-file, a table of syscall numbers. IMHO should arm64 consider adopting this. Signed-off-by: Hans-Peter Nilsson Cc: Alexander Shishkin Reviewed-by: Leo Yan Tested-by: Leo Yan Acked-by: Arnd Bergmann Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Kim Phillips Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20201228024159.2BB66203B5@pchp3.se.axis.com Signed-off-by: Arnaldo Carvalho de Melo commit 0a924817d2ed9396401e0557c6134276d2e26382 Merge: 6022ec6ee2c3a aacfc939cc422 Author: Linus Torvalds Date: Wed Dec 21 10:40:08 2022 -0800 Merge tag '6.2-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "cifs/smb3 client fixes, mostly related to reconnect and/or DFS: - two important reconnect fixes: cases where status of recently connected IPCs and shares were not being updated leaving them in an incorrect state - fix for older Windows servers that would return STATUS_OBJECT_NAME_INVALID to query info requests on DFS links in a namespace that contained non-ASCII characters, reducing number of wasted roundtrips. - fix for leaked -ENOMEM to userspace when cifs.ko couldn't perform I/O due to a disconnected server, expired or deleted session. - removal of all unneeded DFS related mount option string parsing (now using fs_context for automounts) - improve clarity/readability, moving various DFS related functions out of fs/cifs/connect.c (which was getting too big to be readable) to new file. - Fix problem when large number of DFS connections. Allow sharing of DFS connections and fix how the referral paths are matched - Referral caching fix: Instead of looking up ipc connections to refresh cached referrals, store direct dfs root server's IPC pointer in new sessions so it can simply be accessed to either refresh or create a new referral that such connections belong to. - Fix to allow dfs root server's connections to also failover - Optimized reconnect of nested DFS links - Set correct status of IPC connections marked for reconnect" * tag '6.2-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: don't leak -ENOMEM in smb2_open_file() cifs: use origin fullpath for automounts cifs: set correct status of tcon ipc when reconnecting cifs: optimize reconnect of nested links cifs: fix source pathname comparison of dfs supers cifs: fix confusing debug message cifs: don't block in dfs_cache_noreq_update_tgthint() cifs: refresh root referrals cifs: fix refresh of cached referrals cifs: don't refresh cached referrals from unactive mounts cifs: share dfs connections and supers cifs: split out ses and tcon retrieval from mount_get_conns() cifs: set resolved ip in sockaddr cifs: remove unused smb3_fs_context::mount_options cifs: get rid of mount options string parsing cifs: use fs_context for automounts cifs: reduce roundtrips on create/qinfo requests cifs: set correct ipc status after initial tree connect cifs: set correct tcon status after initial tree connect commit 6022ec6ee2c3a16b26f218d7abb538afb839bd6d Merge: 04065c12072b6 36963cf225f89 Author: Linus Torvalds Date: Wed Dec 21 10:18:17 2022 -0800 Merge tag 'ntfs3_for_6.2' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: - added mount options 'hidedotfiles', 'nocase' and 'windows_names' - fixed xfstests (tested on x86_64): generic/083 generic/263 generic/307 generic/465 - fix some logic errors - code refactoring and dead code removal * tag 'ntfs3_for_6.2' of https://github.com/Paragon-Software-Group/linux-ntfs3: (61 commits) fs/ntfs3: Make if more readable fs/ntfs3: Improve checking of bad clusters fs/ntfs3: Fix wrong if in hdr_first_de fs/ntfs3: Use ALIGN kernel macro fs/ntfs3: Fix incorrect if in ntfs_set_acl_ex fs/ntfs3: Check fields while reading fs/ntfs3: Correct ntfs_check_for_free_space fs/ntfs3: Restore correct state after ENOSPC in attr_data_get_block fs/ntfs3: Changing locking in ntfs_rename fs/ntfs3: Fixing wrong logic in attr_set_size and ntfs_fallocate fs/ntfs3: atomic_open implementation fs/ntfs3: Fix wrong indentations fs/ntfs3: Change new sparse cluster processing fs/ntfs3: Fixing work with sparse clusters fs/ntfs3: Simplify ntfs_update_mftmirr function fs/ntfs3: Remove unused functions fs/ntfs3: Fix sparse problems fs/ntfs3: Add ntfs_bitmap_weight_le function and refactoring fs/ntfs3: Use _le variants of bitops functions fs/ntfs3: Add functions to modify LE bitmaps ... commit 04065c12072b6124475c7c4f6ad7484475a2f66e Merge: d264dd3bbbd16 11933cf1d91d5 Author: Linus Torvalds Date: Wed Dec 21 09:54:00 2022 -0800 Merge tag 'fs.mount.propagation.fix.v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull mount propagation fix from Christian Brauner: "The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference. This fixes that bug (with a long commit message for a seven character fix but hopefully it'll help us fix issues faster in the future rather than having to go through the pain of having to relearn everything once more)" * tag 'fs.mount.propagation.fix.v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: pnode: terminate at peers of source commit c3c2e8ebe365ae028ec82ceab039b2035875b6d5 Author: Arnaldo Carvalho de Melo Date: Wed Dec 21 14:08:20 2022 -0300 perf build: Remove explicit reference to python 2.x devel files If the libpython feature test (tools/build/feature/test-libpython.c) fails, then the python-devel is missing, it doesn't mattere if it is for python2 or 3, remove that explicit 2.x reference. Reported-by: Linus Torvalds Signed-off-by: Arnaldo Carvalho de Melo commit 5fe089d3a3eb4c1cd416993cd4bc7e3c0c30297a Author: Sandipan Das Date: Wed Dec 14 13:56:52 2022 +0530 perf vendor events amd: Add Zen 4 mapping Add a regular expression in the map file so that appropriate JSON event files are used for AMD Zen 4 processors. Restrict the regular expression for AMD Zen 3 processors to known model ranges since they also belong to Family 19h. Signed-off-by: Sandipan Das Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jirka Hladky Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20221214082652.419965-5-sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit aba4cb3eb5b8a7ad70a566a25f530c809993e556 Author: Sandipan Das Date: Wed Dec 14 13:56:51 2022 +0530 perf vendor events amd: Add Zen 4 metrics Add metrics taken from Section 2.1.15.2 "Performance Measurement" in the Processor Programming Reference (PPR) for AMD Family 19h Model 11h Revision B1 processors. The recommended metrics are sourced from Table 27 "Guidance for Common Performance Statistics with Complex Event Selects". The pipeline utilization metrics are sourced from Table 28 "Guidance for Pipeline Utilization Analysis Statistics". These are new to Zen 4 processors and useful for finding performance bottlenecks by analyzing activity at different stages of the pipeline. Metric groups have been added for Level 1 and Level 2 analysis. Signed-off-by: Sandipan Das Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jirka Hladky Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20221214082652.419965-4-sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 5b2ca349c313a0e03162e353d898c4f7046c7898 Author: Sandipan Das Date: Wed Dec 14 13:56:50 2022 +0530 perf vendor events amd: Add Zen 4 uncore events Add uncore events taken from Section 2.1.15.5 "L3 Cache Performance Monitor Counter"s and Section 7.1 "Fabric Performance Monitor Counter (PMC) Events" in the Processor Programming Reference (PPR) for AMD Family 19h Model 11h Revision B1 processors. This constitutes events which capture L3 cache activity and data bandwidth for various links and interfaces in the Data Fabric. Signed-off-by: Sandipan Das Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jirka Hladky Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20221214082652.419965-3-sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 658448281d190c1467295914b2e9c1a4490e41b8 Author: Sandipan Das Date: Wed Dec 14 13:56:49 2022 +0530 perf vendor events amd: Add Zen 4 core events Add core events taken from Section 2.1.15.4 "Core Performance Monitor Counters" in the Processor Programming Reference (PPR) for AMD Family 19h Model 11h Revision B1 processors. This constitutes events which capture op dispatch, execution and retirement, branch prediction, L1 and L2 cache activity, TLB activity, etc. Signed-off-by: Sandipan Das Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jirka Hladky Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Link: https://lore.kernel.org/r/20221214082652.419965-2-sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 6abaa0204c34dc185783a23b0dbc35cdf9cc1399 Author: Ian Rogers Date: Wed Dec 14 22:55:10 2022 -0800 perf vendor events intel: Refresh westmereex events Update the westmereex events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-24-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit bcea0838b9dbf70df424d4665feedad95be86d13 Author: Ian Rogers Date: Wed Dec 14 22:55:09 2022 -0800 perf vendor events intel: Refresh westmereep-sp events Update the westmereep-sp events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-23-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 598020743153cb4db77f7a1a0edc476a76a1e50a Author: Ian Rogers Date: Wed Dec 14 22:55:08 2022 -0800 perf vendor events intel: Refresh westmereep-dp events Update the westmereep-dp events using the new tooling from: https://github.com/intel/perfmon The events are unchanged, unused json values are removed and the version number bumped to v3 to match the perfmon mapfile.csv. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-22-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 69f685e0c125a9811b5489c2ece21708878fa6f9 Author: Ian Rogers Date: Wed Dec 14 22:55:07 2022 -0800 perf vendor events intel: Refresh tigerlake metrics and events Update the tigerlake metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are updated to version 1.08 and unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-21-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9b4240831af775ef0730a2fb8f529b4a66d4fc46 Author: Ian Rogers Date: Wed Dec 14 22:55:06 2022 -0800 perf vendor events intel: Refresh snowridgex events Update the snowridgex events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed and descriptions improved. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-20-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ecabdc6a7280f5714fcd978504af72de68e0f327 Author: Ian Rogers Date: Wed Dec 14 22:55:05 2022 -0800 perf vendor events intel: Refresh skylakex metrics and events Update the skylakex metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated with fixes to uncore events and improved descriptions. uncore-other.json changes due to events now being sorted. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-19-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 00ca782ec9f8d32ac65142f96a7423af78356818 Author: Ian Rogers Date: Wed Dec 14 22:55:04 2022 -0800 perf vendor events intel: Refresh skylake metrics and events Update the skylake metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-18-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1b91a994a2ac3cb374249b09bb818375267aea97 Author: Ian Rogers Date: Wed Dec 14 22:55:03 2022 -0800 perf vendor events intel: Refresh silvermont events Update the silvermont events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-17-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 400dd489d42faef3647d990dd67f553371ec204b Author: Ian Rogers Date: Wed Dec 14 22:55:02 2022 -0800 perf vendor events intel: Refresh sapphirerapids metrics and events Update the sapphirerapids metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated to 1.09, in particular uncore, with fixes to uncore events and improved descriptions. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-16-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 28641ef5f387f2c8f57a7273d1ce35d168f14f86 Author: Ian Rogers Date: Wed Dec 14 22:55:01 2022 -0800 perf vendor events intel: Refresh sandybridge metrics and events Update the sandybridge metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-15-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d4e50e519ba0af3ab961de74bd88366ea11f3e62 Author: Ian Rogers Date: Wed Dec 14 22:55:00 2022 -0800 perf vendor events intel: Refresh nehalemex events Update the nehalemex events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-14-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7e353370cd17547620a7757fb1a6c146f3287ea3 Author: Ian Rogers Date: Wed Dec 14 22:54:59 2022 -0800 perf vendor events intel: Refresh nehalemep events Update the nehalemep events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-13-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5362e4d1f24ed4d4edd9dc1cbf846218c88eabc3 Author: Ian Rogers Date: Wed Dec 14 22:54:58 2022 -0800 perf vendor events intel: Refresh meteorlake events Update the meteorlake events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but they are sorted and unused json values are removed. This increases consistency across the json files. The CPUID matching regular expression is updated to match the perfmon one. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-12-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2c3fd22bb3ff166a072c083e6b7468259c37e46a Author: Ian Rogers Date: Wed Dec 14 22:54:57 2022 -0800 perf vendor events intel: Refresh knightslanding events Update the knightslanding events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-11-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e85af8a641ba3e8e4dab3e82f4a17f06378d47ff Author: Ian Rogers Date: Wed Dec 14 22:54:56 2022 -0800 perf vendor events intel: Refresh jaketown metrics and events Update the jaketown metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-10-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8ee37818a0574fac9d42344595236099c153a494 Author: Ian Rogers Date: Wed Dec 14 22:54:55 2022 -0800 perf vendor events intel: Refresh ivytown metrics and events Update the ivytown metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d86ac8d7cd31d9fc79aaac26cf2441e2fdfb6f3e Author: Ian Rogers Date: Wed Dec 14 22:54:54 2022 -0800 perf vendor events intel: Refresh ivybridge metrics and events Update the ivybridge metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but the version number is 23 to match the perfmon version. In the events unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f8e23ad10520876fa9165425235867788383dbbc Author: Ian Rogers Date: Wed Dec 14 22:54:53 2022 -0800 perf vendor events intel: Refresh icelakex metrics and events Update the icelakex metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated to 1.17, in particular uncore, with fixes to uncore events and improved descriptions. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f8473086e3440a787c874531cdefb9bbf101f0cc Author: Ian Rogers Date: Wed Dec 14 22:54:52 2022 -0800 perf vendor events intel: Refresh icelake metrics and events Update the icelake metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 667433c4eb847731ce92af6894ffb095123eff30 Author: Ian Rogers Date: Wed Dec 14 22:54:51 2022 -0800 perf vendor events intel: Refresh haswellx metrics and events Update the haswellx metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated with fixes to uncore events and improved descriptions. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8749311045ef5c727a540bbdfcf54f5b81683312 Author: Ian Rogers Date: Wed Dec 14 22:54:50 2022 -0800 perf vendor events intel: Refresh haswell metrics and events Update the haswell metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a335420d32988f39e889b6ae3be2c965ec32a38e Author: Ian Rogers Date: Wed Dec 14 22:54:49 2022 -0800 perf vendor events intel: Refresh goldmontplus events Update the goldmontplus events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 387bc79f83948e9f6eca6429d3ccdbc96a11228d Author: Ian Rogers Date: Wed Dec 14 22:54:48 2022 -0800 perf vendor events intel: Refresh goldmont events Update the goldmont events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5cebe49ce80391513faf0b9315ca93599407542c Author: Ian Rogers Date: Wed Dec 14 22:54:47 2022 -0800 perf vendor events intel: Refresh elkhartlake events Update the elkhartlake events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065510.1621979-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8358b1222798f1eaec057d770ea43ad9d059abf9 Author: Ian Rogers Date: Wed Dec 14 22:49:53 2022 -0800 perf vendor events intel: Refresh cascadelakex metrics and events Update the cascadelakex metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated with fixes to uncore events and improved descriptions. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065017.1621020-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5e241aad62057b5b3a4fe8bd6ed2fdd906d38a90 Author: Ian Rogers Date: Wed Dec 14 22:49:52 2022 -0800 perf vendor events intel: Refresh broadwellx metrics and events Update the broadwellx metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The order of metrics varies as TMA metrics are first converted and then removed if perfmon versions are found. The events are updated with fixes to uncore events and improved descriptions. The formatting changes increase consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065017.1621020-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f6ee944ce4e857b7ba62218caf392f3cecc90c02 Author: Ian Rogers Date: Wed Dec 14 22:49:51 2022 -0800 perf vendor events intel: Refresh broadwellde metrics and events Update the broadwellde metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics vary as tma_false_sharing, MEM_Parallel_Requests and MEM_Request_Latency are explicitly dropped from having missing events: https://github.com/captain5050/perfmon/blob/main/scripts/create_perf_json.py#L934 The formulas also differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed and implicit umasks of 0 are dropped. This increases consistency across the json files. mapfile.csv's version number is set to match that in the perfmon repository. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215065017.1621020-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit fec57a8e4a2cede35adbd9d70f1826ea312c49b3 Author: Ian Rogers Date: Wed Dec 14 22:47:28 2022 -0800 perf vendor events intel: Refresh broadwell metrics and events Update the broadwell metrics and events using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". The events are unchanged but unused json values are removed, implicit umasks of 0 are dropped and duplicate short and long descriptions have the long one dropped. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215064755.1620246-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6fa91f645f6f17f96f99af9e968e4109f6eb8e72 Author: Ian Rogers Date: Wed Dec 14 22:47:27 2022 -0800 perf vendor events intel: Refresh bonnell events Update the bonnell events using the new tooling from: https://github.com/intel/perfmon The events are unchanged but unused json values are removed and implicit umasks of 0 are dropped. This increases consistency across the json files. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215064755.1620246-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a5abef626f35378a7de2edc399902dc9648f69ef Author: Ian Rogers Date: Wed Dec 14 22:47:26 2022 -0800 perf vendor events intel: Refresh alderlake-n metrics Update the alderlake-n metrics using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215064755.1620246-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 266b2ca72742269340aca6f34356bee277b59c7d Author: Ian Rogers Date: Wed Dec 14 22:47:25 2022 -0800 perf vendor events intel: Refresh alderlake metrics Update the alderlake metrics using the new tooling from: https://github.com/intel/perfmon The metrics are unchanged but the formulas differ due to parentheses, use of exponents and removal of redundant operations like "* 1". Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221215064755.1620246-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ed4c1778cc1abd18d491d0eecb7947c7cac3a598 Author: Ian Rogers Date: Wed Dec 14 22:47:24 2022 -0800 perf test pmu-events: Fake PMU metric workaround We test metrics with fake events with fake values. The fake values may yield division by zero and so we count both up and down to try to avoid this. Unfortunately this isn't sufficient for some metrics and so don't fail the test for them. Add the metric name to debug output. Signed-off-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Caleb Biggers Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20221215064755.1620246-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ad9ef9eb64a2230c12fa5c6c98aed176428012e8 Author: Namhyung Kim Date: Thu Dec 15 11:28:17 2022 -0800 perf hist: Improve srcline_{from,to} sort key performance Likewise, modify ->cmp() callback to compare sample address and map address. And add ->collapse() and ->sort() to check the actual srcfile string. Also add ->init() to make sure it has the srcfile. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-10-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f0cdde28fecc0d7ff85c315b2abf206ef27c0174 Author: Namhyung Kim Date: Thu Dec 15 11:28:16 2022 -0800 perf hist: Improve srcfile sort key performance Likewise, modify ->cmp() callback to compare sample address and map address. And add ->collapse() and ->sort() to check the actual srcfile string. Also add ->init() to make sure it has the srcfile. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-9-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ec222d7e7cfd09276891ffdf57d75858fe148c9f Author: Namhyung Kim Date: Thu Dec 15 11:28:15 2022 -0800 perf hist: Improve srcline sort key performance The sort_entry->cmp() will be called for eventy sample data to find a matching entry. When it has 'srcline' sort key, that means it needs to call addr2line or libbfd everytime. This is not optimal because many samples will have same address and it just can call addr2line once. So postpone the actual srcline check to the sort_entry->collpase() and compare addresses in ->cmp(). Also it needs to add ->init() callback to make sure it has srcline info. If a sample has a unique data, chances are the entry can be sorted out by other (previous) keys and callbacks in sort_srcline never called. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-8-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit cb6e92c764272ca288398ad6442bbb0f064c2da8 Author: Namhyung Kim Date: Thu Dec 15 11:28:14 2022 -0800 perf hist: Add perf_hpp_fmt->init() callback In __hists__insert_output_entry(), it calls fmt->sort() for dynamic entries with NULL to update column width for tracepoint fields. But it's a hacky abuse of the sort callback, better to have a proper callback for that. I'll add more use cases later. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-7-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d5e33ce06ba4a0fcf7815ff9edc3f651f7ae502e Author: Namhyung Kim Date: Thu Dec 15 11:28:13 2022 -0800 perf srcline: Conditionally suppress addr2line warnings It has symbol_conf.disable_add2line_warn to suppress some warnings. Let's make it consistent with others. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-6-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3b27222dd6cf7578c35b5903bf9d183a88d13744 Author: Namhyung Kim Date: Thu Dec 15 11:28:12 2022 -0800 perf srcline: Skip srcline if .debug_line is missing The srcline info is from the .debug_line section. No need to setup addr2line subprocess if the section is missing. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Link: https://lore.kernel.org/r/20221215192817.2734573-5-namhyung@kernel.org Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Milian Wolff Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Leo Yan Cc: Andi Kleen Cc: LKML Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 06ea72a42d96ddcbac53f3b08a1c56d13b1c014a Author: Namhyung Kim Date: Thu Dec 15 11:28:11 2022 -0800 perf symbol: Add filename__has_section() The filename__has_section() is to check if the given section name is in the binary. It'd be used for checking debug info for srcline. Committer notes: Added missing __maybe_unused to the unused filename__has_section() arguments in tools/perf/util/symbol-minimal.c. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ea335ef3ddcdc17d616753743f92718e723341fb Author: Namhyung Kim Date: Thu Dec 15 11:28:09 2022 -0800 perf srcline: Do not return NULL for srcline The code assumes non-NULL srcline value always, let's return the usual SRCLINE_UNKNOWN ("??:0") string instead. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221215192817.2734573-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b50d691e50e600fab82b423be871860537d75dc9 Author: Michael Petlan Date: Mon Dec 19 17:30:08 2022 +0100 perf test: Fix "all PMU test" to skip parametrized events Parametrized events are not only a powerpc domain. They occur on other platforms too (e.g. aarch64). They should be ignored in this testcase, since proper setup of the parameters is out of scope of this script. Let's not filter them out by PMU name, but rather based on the fact that they expect a parameter. Fixes: 451ed8058c69a3fe ("perf test: Fix "all PMU test" to skip hv_24x7/hv_gpci tests on powerpc") Signed-off-by: Michael Petlan Cc: Athira Rajeev Cc: Disha Goel Cc: Ian Rogers Cc: Michael Ellerman Cc: Nageswara R Sastry Link: https://lore.kernel.org/r/20221219163008.9691-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit 0c0a0db87e1c159aa7a2a52bfbec0be604c65f86 Author: Changbin Du Date: Sun Dec 18 06:51:51 2022 +0800 perf tools: Add .DELETE_ON_ERROR special Makefile target to clean up partially updated files on error. As kbuild, this adds .DELETE_ON_ERROR special target to clean up partially updated files on error. A known issue is the empty vmlinux.h generted by bpftool if it failed to dump btf info. Reviewed-by: Leo Yan Signed-off-by: Changbin Du Cc: Alexander Shishkin Cc: Andrii Nakryiko Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221217225151.90387-1-changbin.du@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit cb459c89b734f9fcfd201a6ef993c063a703ec73 Author: Namhyung Kim Date: Mon Dec 19 12:17:32 2022 -0800 perf test: Update 'perf lock contention' test Add more tests for the new filters. $ sudo perf test contention -v 87: kernel lock contention analysis test : --- start --- test child forked, pid 412379 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --type-filter Testing perf lock contention --lock-filter test child finished with 0 ---- end ---- kernel lock contention analysis test: Ok Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-7-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5e3febe7b7b99f942311ddfa05bb06910d06b14d Author: Namhyung Kim Date: Mon Dec 19 12:17:31 2022 -0800 perf lock contention: Support lock addr/name filtering for BPF Likewise, add addr_filter BPF hash map and check it with the lock address. $ sudo ./perf lock con -ab -L tasklist_lock -- ./perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 0.169 [sec] contended total wait max wait avg wait type caller 18 174.09 us 25.31 us 9.67 us rwlock:W do_exit+0x36d 5 32.34 us 10.87 us 6.47 us rwlock:R do_wait+0x8b 4 15.41 us 4.73 us 3.85 us rwlock:W release_task+0x6e Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-6-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 511e19b9e2112463c33a744ecb8a798056074408 Author: Namhyung Kim Date: Mon Dec 19 12:17:30 2022 -0800 perf lock contention: Add -L/--lock-filter option The -L/--lock-filter option is to filter only given locks. The locks can be specified by address or name (if exists). $ sudo ./perf lock record -a sleep 1 $ sudo ./perf lock con -l contended total wait max wait avg wait address symbol 57 1.11 ms 42.83 us 19.54 us ffff9f4140059000 15 280.88 us 23.51 us 18.73 us ffffffff9d007a40 jiffies_lock 1 20.49 us 20.49 us 20.49 us ffffffff9d0d50c0 rcu_state 1 9.02 us 9.02 us 9.02 us ffff9f41759e9ba0 $ sudo ./perf lock con -L jiffies_lock,rcu_state contended total wait max wait avg wait type caller 15 280.88 us 23.51 us 18.73 us spinlock tick_sched_do_timer+0x93 1 20.49 us 20.49 us 20.49 us spinlock __softirqentry_text_start+0xeb $ sudo ./perf lock con -L ffff9f4140059000 contended total wait max wait avg wait type caller 38 779.40 us 42.83 us 20.51 us spinlock worker_thread+0x50 11 216.30 us 39.87 us 19.66 us spinlock queue_work_on+0x39 8 118.13 us 20.51 us 14.77 us spinlock kthread+0xe5 Committer testing: # uname -a Linux quaco 6.0.12-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Dec 8 17:15:53 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux # perf lock record ^C[ perf record: Woken up 1 times to write data ] # perf lock con -L jiffies_lock,rcu_state contended total wait max wait avg wait type caller # perf lock con contended total wait max wait avg wait type caller 1 9.06 us 9.06 us 9.06 us spinlock call_timer_fn+0x24 # perf lock con -L call ignore unknown symbol: call contended total wait max wait avg wait type caller 1 9.06 us 9.06 us 9.06 us spinlock call_timer_fn+0x24 # Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 529772c4df286159fea453957a6052e20b90e8a8 Author: Namhyung Kim Date: Mon Dec 19 12:17:29 2022 -0800 perf lock contention: Support lock type filtering for BPF Likewise, add type_filter BPF hash map and check it when user gave a lock type filter. $ sudo ./perf lock con -ab -Y rwlock -- ./perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 0.203 [sec] contended total wait max wait avg wait type caller 15 156.19 us 19.45 us 10.41 us rwlock:W do_exit+0x36d 1 11.12 us 11.12 us 11.12 us rwlock:R do_wait+0x8b 1 5.09 us 5.09 us 5.09 us rwlock:W release_task+0x6e Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b4a7eff93c39f985b33ac114f83ac5b325f42151 Author: Namhyung Kim Date: Mon Dec 19 12:17:28 2022 -0800 perf lock contention: Add -Y/--type-filter option The -Y/--type-filter option is to filter the result for specific lock types only. It can accept comma-separated values. Note that it would accept type names like one in the output. spinlock, mutex, rwsem:R and so on. For RW-variant lock types, it converts the name to the both variants. In other words, "rwsem" is same as "rwsem:R,rwsem:W". Also note that "mutex" has two different encoding - one for sleeping wait, another for optimistic spinning. Add "mutex-spin" entry for the lock_type_table so that we can add it for "mutex" under the table. $ sudo ./perf lock record -a -- ./perf bench sched messaging $ sudo ./perf lock con -E 5 -Y spinlock contended total wait max wait avg wait type caller 802 1.26 ms 11.73 us 1.58 us spinlock __wake_up_common_lock+0x62 13 787.16 us 105.44 us 60.55 us spinlock remove_wait_queue+0x14 12 612.96 us 78.70 us 51.08 us spinlock prepare_to_wait+0x27 114 340.68 us 12.61 us 2.99 us spinlock try_to_wake_up+0x1f5 83 226.38 us 9.15 us 2.73 us spinlock folio_lruvec_lock_irqsave+0x5e Committer notes: Make get_type_flag() return UINT_MAX for error instad of -1UL, as that function returns 'unsigned int' and we store the value on a 'unsigned int' 'flags' variable which makes clang unhappy: 35 98.23 fedora:37 : FAIL clang version 15.0.6 (Fedora 15.0.6-1.fc37) builtin-lock.c:2012:14: error: result of comparison of constant 18446744073709551615 with expression of type 'unsigned int' is always true [-Werror,-Wtautological-constant-out-of-range-compare] if (flags != -1UL) { ~~~~~ ^ ~~~~ builtin-lock.c:2021:14: error: result of comparison of constant 18446744073709551615 with expression of type 'unsigned int' is always true [-Werror,-Wtautological-constant-out-of-range-compare] if (flags != -1UL) { ~~~~~ ^ ~~~~ builtin-lock.c:2037:14: error: result of comparison of constant 18446744073709551615 with expression of type 'unsigned int' is always true [-Werror,-Wtautological-constant-out-of-range-compare] if (flags != -1UL) { ~~~~~ ^ ~~~~ 3 errors generated. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d264dd3bbbd16b56239e889023fbe49413a58eaf Merge: 5461e079009ae 54f27dc53f176 Author: Linus Torvalds Date: Wed Dec 21 09:48:03 2022 -0800 Merge tag 'for-linus-2022122101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - Four potential NULL pointers dereferences (Bastien Nocera, Enrik Berkhan, Jiasheng Jiang and Roderick Colenbrander) - Allow Wacom devices in bootloader mode to be flashed (Jason Gerecke) - Some assorted devices quirks (José Expósito and Terry Junge) * tag 'for-linus-2022122101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: sony: Fix unused function warning HID: plantronics: Additional PIDs for double volume key presses quirk HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: Ignore HP Envy x360 eu0009nv stylus battery HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: amd_sfh: Add missing check for dma_alloc_coherent HID: playstation: fix free of uninialized pointer for DS4 in Bluetooth. HID: mcp2221: don't connect hidraw HID: logitech-hidpp: Guard FF init code against non-USB devices commit 5461e079009ae2732c833281c4b50dfb58d15ba5 Merge: 7a693ea78e3c4 542d3c03fd895 Author: Linus Torvalds Date: Wed Dec 21 09:44:41 2022 -0800 Merge tag 'media/v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - A regression at V4L2 core breaking string controls - Build warning fixes on sun6i drivers when building with clang * tag 'media/v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: sun6i-isp: params: Unregister pending buffer on cleanup media: sun6i-isp: params: Fix incorrect indentation media: sun6i-isp: capture: Fix uninitialized variable use media: sun6i-isp: proc: Declare subdev ops as static media: sun6i-isp: proc: Error out on invalid port to fix warning media: sun6i-isp: proc: Fix return code handling in stream off path media: sun8i-a83t-mipi-csi2: Clarify return code handling in stream off path media: sun6i-mipi-csi2: Clarify return code handling in stream off path media: sun6i-csi: capture: Remove useless ret initialization media: sun6i-csi: bridge: Error out on invalid port to fix warning media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1 commit 7a693ea78e3c48605a2d849fd241ff15561f10d5 Merge: 9cf5b508bd260 8fa22f4b88e87 Author: Linus Torvalds Date: Wed Dec 21 09:41:28 2022 -0800 Merge tag 'pwm/for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Various changes across the board, mostly improvements and cleanups" * tag 'pwm/for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (42 commits) pwm: pca9685: Convert to i2c's .probe_new() pwm: sun4i: Propagate errors in .get_state() to the caller pwm: Handle .get_state() failures pwm: sprd: Propagate errors in .get_state() to the caller pwm: rockchip: Propagate errors in .get_state() to the caller pwm: mtk-disp: Propagate errors in .get_state() to the caller pwm: imx27: Propagate errors in .get_state() to the caller pwm: cros-ec: Propagate errors in .get_state() to the caller pwm: crc: Propagate errors in .get_state() to the caller leds: qcom-lpg: Propagate errors in .get_state() to the caller drm/bridge: ti-sn65dsi86: Propagate errors in .get_state() to the caller pwm/tracing: Also record trace events for failed API calls pwm: Make .get_state() callback return an error code pwm: pxa: Enable for MMP platform pwm: pxa: Add reference manual link and limitations pwm: pxa: Use abrupt shutdown mode pwm: pxa: Remove clk enable/disable from pxa_pwm_config pwm: pxa: Set duty cycle to 0 when disabling PWM pwm: pxa: Remove pxa_pwm_enable/disable pwm: mediatek: Add support for MT7986 ... commit 9cf5b508bd260d5693d337bcf1f9b82b961b6137 Merge: f2855eec19cad 11c7f9e3131ad Author: Linus Torvalds Date: Wed Dec 21 09:37:14 2022 -0800 Merge tag 'rproc-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "rproc-virtio device names are now auto generated, to avoid conflicts between remoteproc instances. The imx_rproc driver is extended with support for communicating with and attaching to a running M4 on i.MX8QXP, as well as support for attaching to the M4 after self-recovering from a crash. Support is added for i.MX8QM and mailbox channels are reconnected during the recovery process, in order to avoid data corruption. The Xilinx Zynqmp firmware interface is extended and support for the Xilinx R5 RPU is introduced. Various resources leaks, primarily in error paths, throughout the Qualcomm drivers are corrected. Lastly a fix to ensure that pm_relax is invoked even if the remoteproc instance is stopped between a crash is being reported and the recovery handler is scheduled" * tag 'rproc-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (25 commits) remoteproc: core: Do pm_relax when in RPROC_OFFLINE state remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: sysmon: Make QMI message rules const drivers: remoteproc: Add Xilinx r5 remoteproc driver firmware: xilinx: Add RPU configuration APIs firmware: xilinx: Add shutdown/wakeup APIs firmware: xilinx: Add ZynqMP firmware ioctl enums for RPU configuration. arm64: dts: xilinx: zynqmp: Add RPU subsystem device node dt-bindings: remoteproc: Add Xilinx RPU subsystem bindings remoteproc: core: Use device_match_of_node() remoteproc: imx_rproc: Correct i.MX93 DRAM mapping remoteproc: imx_rproc: Enable attach recovery for i.MX8QM/QXP remoteproc: imx_rproc: Request mbox channel later remoteproc: imx_rproc: Support i.MX8QM remoteproc: imx_rproc: Support kicking Mcore from Linux for i.MX8QXP ... commit f2855eec19cadddad2900da3a009ee39df6116a7 Merge: ec34c2b4ec383 53c60d1004270 Author: Linus Torvalds Date: Wed Dec 21 09:31:18 2022 -0800 Merge tag 'mailbox-v6.2' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - qcom: enable sc8280xp, sm8550 and sm4250 support - ti: default to ARCH_K3 for msg manager - mediatek: - add mt8188 and mt8186 support - request irq only after got ready - zynq-ipi: fix error handling after device_register - mpfs: check sys-con status - rockchip: simplify by using device_get_match_data * tag 'mailbox-v6.2' of git://git.linaro.org/landing-teams/working/fujitsu/integration: dt-bindings: mailbox: qcom-ipcc: Add compatible for SM8550 mailbox: mtk-cmdq: Do not request irq until we are ready mailbox: zynq-ipi: fix error handling while device_register() fails mailbox: mtk-cmdq-mailbox: Use platform data directly instead of copying mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() dt-bindings: mailbox: mediatek,gce-mailbox: add mt8188 compatible name dt-bindings: mailbox: add GCE header file for mt8188 mailbox: mpfs: read the system controller's status mailbox: mtk-cmdq: add MT8186 support mailbox: mtk-cmdq: add gce ddr enable support flow mailbox: mtk-cmdq: add gce software ddr enable private data mailbox: mtk-cmdq: Use GCE_CTRL_BY_SW definition instead of number mailbox: rockchip: Use device_get_match_data() to simplify the code dt-bindings: mailbox: qcom-ipcc: Add sc8280xp compatible mailbox: config: ti-msgmgr: Default set to ARCH_K3 for TI msg manager mailbox: qcom-apcs-ipc: Add SM4250 APCS IPC support dt-bindings: mailbox: qcom: Add SM4250 APCS compatible commit ec34c2b4ec383766a42ffd9206dc6605be3c6f6c Merge: 7406fd75a9206 0de796b6047d1 Author: Linus Torvalds Date: Wed Dec 21 09:24:39 2022 -0800 Merge tag 'backlight-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight update from Lee Jones: "Convert a bunch of I2C class drivers over to .probe_new()" * tag 'backlight-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: tosa: Convert to i2c's .probe_new() backlight: lv5207lp: Convert to i2c's .probe_new() backlight: lp855x: Convert to i2c's .probe_new() backlight: lm3639: Convert to i2c's .probe_new() backlight: lm3630a: Convert to i2c's .probe_new() backlight: bd6107: Convert to i2c's .probe_new() backlight: arcxcnn: Convert to i2c's .probe_new() backlight: adp8870: Convert to i2c's .probe_new() backlight: adp8860: Convert to i2c's .probe_new() commit 7406fd75a92066712b6f696983f89438f474049a Merge: 7c0846125358f 37fecbb80721c Author: Linus Torvalds Date: Wed Dec 21 09:19:24 2022 -0800 Merge tag 'mfd-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Add support for Ampere Computing SMpro - Add support for TI TPS65219 PMIC New Functionality: - Add support for multiple devices of the same type; rk808 Fix-ups: - Convert a bunch of I2C class drivers over to .probe_new() - Remove superfluous includes; mc13xxx-*, palmas, timberdale - Use correct includes for GPIO handling; madera-core - Convert to GPIOD; twl6040 - Remove unused platform data handling; twl6040 - Device Tree changes; many - Remove unused drivers; dm355evm_msp, davinci_voicecodec, htc-i2cpld - Add support for modules; palmas - Enable COMPILE_TEST support; intel_soc_pmic* - Trivial: spelling / whitespace fixes; mc13xxx-spi - Replace old PM helpers with new ones; many - Convert deprecated mask_invert usage to unmask_base; many - Use devm_*() calls; qcom_rpm - MAINTAINER fix-ups - Make use of improved / replaced APIs; palmas, fsl-imx25-tsadc, stm32-lptimer, qcom_rpm, rohm-* Bug Fixes: - Add bounds / error checking; mt6360-core - No sleeping inside critical sections; axp20x - Fix missing dependencies; ROHM_BD957XMUF - Repair error paths; qcom-pm8008" * tag 'mfd-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (161 commits) dt-bindings: mfd: da9062: Correct file name for watchdog mfd: pm8008: Fix return value check in pm8008_probe() mfd: rohm: Use dev_err_probe() mfd: Drop obsolete dependencies on COMPILE_TEST dt-bindings: mfd: da9062: Move IRQ to optional properties mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: stm32-lptimer: Use devm_platform_get_and_ioremap_resource() mfd: rohm-bd9576: Convert to i2c's .probe_new() mfd: fsl-imx25-tsadc: Use devm_platform_get_and_ioremap_resource() dt-bindings: Fix maintainer email for a few ROHM ICs mfd: palmas: Use device_get_match_data() to simplify the code Input: Add tps65219 interrupt driven powerbutton mfd: tps65219: Add driver for TI TPS65219 PMIC mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: wcd934x: Convert irq chip to config regs mfd: tps65090: Replace irqchip mask_invert with unmask_base mfd: sun4i-gpadc: Replace irqchip mask_invert with unmask_base mfd: stpmic1: Fix swapped mask/unmask in irq chip mfd: sprd-sc27xx-spi: Replace irqchip mask_invert with unmask_base ... commit 7c0846125358f991d83f34ddde52956b196db3de Author: Linus Torvalds Date: Wed Dec 21 08:56:43 2022 -0800 m68k: remove broken strcmp implementation The m68 hand-written assembler version of strcmp() has always been broken: it returns the difference between the first non-matching byte done as a 8-bit subtraction. That is _almost_ right, but is broken for the overflow case. The strcmp() function should indeed return the sign of the difference between the first byte that differs, but the subtraction needs to be done in a wider type than 'char'. Otherwise the ordering isn't actually stable. This went unnoticed for basically forever, because nobody ever cares about non-US-ASCII orderings in the kernel (in fact, most users only care about "exact match or not"), so overflows don't really happen in practice, even if it was very very wrong. But that mostly unnoticeable bug becomes very noticeable by the recent change to make 'char' be unsigned in the kernel across all architectures (commit 3bc753c06dd0: "kbuild: treat char as always unsigned"). Because the code not only did the subtraction in the wrong type width, it also used 'char' to then make the compiler expand the result from an 8-bit difference to the 'int' return value. So now with an unsigned char that incorrect arithmetic width was then not even sign-expanded, and always returned just a positive integer. We could re-instate the old broken code by just turning the 'char' into 'signed char' as has been done elsewhere where people depended on the signedness of 'char', but since the whole function was broken to begin with, and we have a non-broken default fallback implementation, let's just remove this broken function entirely. Reported-by: Guenter Roeck Link: https://lore.kernel.org/lkml/20221221145332.GA2399037@roeck-us.net/ Cc: Jason Donenfeld Cc: Geert Uytterhoeven Cc: Rasmus Villemoes Signed-off-by: Linus Torvalds commit 609d3bc6230514a8ca79b377775b17e8c3d9ac93 Merge: 878cf96f686c5 19e72b064fc32 Author: Linus Torvalds Date: Wed Dec 21 08:41:32 2022 -0800 Merge tag 'net-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, netfilter and can. Current release - regressions: - bpf: synchronize dispatcher update with bpf_dispatcher_xdp_func - rxrpc: - fix security setting propagation - fix null-deref in rxrpc_unuse_local() - fix switched parameters in peer tracing Current release - new code bugs: - rxrpc: - fix I/O thread startup getting skipped - fix locking issues in rxrpc_put_peer_locked() - fix I/O thread stop - fix uninitialised variable in rxperf server - fix the return value of rxrpc_new_incoming_call() - microchip: vcap: fix initialization of value and mask - nfp: fix unaligned io read of capabilities word Previous releases - regressions: - stop in-kernel socket users from corrupting socket's task_frag - stream: purge sk_error_queue in sk_stream_kill_queues() - openvswitch: fix flow lookup to use unmasked key - dsa: mv88e6xxx: avoid reg_lock deadlock in mv88e6xxx_setup_port() - devlink: - hold region lock when flushing snapshots - protect devlink dump by the instance lock Previous releases - always broken: - bpf: - prevent leak of lsm program after failed attach - resolve fext program type when checking map compatibility - skbuff: account for tail adjustment during pull operations - macsec: fix net device access prior to holding a lock - bonding: switch back when high prio link up - netfilter: flowtable: really fix NAT IPv6 offload - enetc: avoid buffer leaks on xdp_do_redirect() failure - unix: fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() - dsa: microchip: remove IRQF_TRIGGER_FALLING in request_threaded_irq" * tag 'net-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) net: fec: check the return value of build_skb() net: simplify sk_page_frag Treewide: Stop corrupting socket's task_frag net: Introduce sk_use_task_frag in struct sock. mctp: Remove device type check at unregister net: dsa: microchip: remove IRQF_TRIGGER_FALLING in request_threaded_irq can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len can: flexcan: avoid unbalanced pm_runtime_enable warning Documentation: devlink: add missing toc entry for etas_es58x devlink doc mctp: serial: Fix starting value for frame check sequence nfp: fix unaligned io read of capabilities word net: stream: purge sk_error_queue in sk_stream_kill_queues() myri10ge: Fix an error handling path in myri10ge_probe() net: microchip: vcap: Fix initialization of value and mask rxrpc: Fix the return value of rxrpc_new_incoming_call() rxrpc: rxperf: Fix uninitialised variable rxrpc: Fix I/O thread stop rxrpc: Fix switched parameters in peer tracing rxrpc: Fix locking issues in rxrpc_put_peer_locked() rxrpc: Fix I/O thread startup getting skipped ... commit f6594c372afd5cec8b1e9ee9ea8f8819d59c6fb1 Author: Pablo Neira Ayuso Date: Mon Dec 19 20:09:00 2022 +0100 netfilter: nf_tables: perform type checking for existing sets If a ruleset declares a set name that matches an existing set in the kernel, then validate that this declaration really refers to the same set, otherwise bail out with EEXIST. Currently, the kernel reports success when adding a set that already exists in the kernel. This usually results in EINVAL errors at a later stage, when the user adds elements to the set, if the set declaration mismatches the existing set representation in the kernel. Add a new function to check that the set declaration really refers to the same existing set in the kernel. Fixes: 96518518cc41 ("netfilter: add nftables") Reported-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a8fe4154fa5a1bae590b243ed60f871e5a5e1378 Author: Pablo Neira Ayuso Date: Mon Dec 19 18:00:10 2022 +0100 netfilter: nf_tables: add function to create set stateful expressions Add a helper function to allocate and initialize the stateful expressions that are defined in a set. This patch allows to reuse this code from the set update path, to check that type of the update matches the existing set in the kernel. Signed-off-by: Pablo Neira Ayuso commit bed4a63ea4ae77cfe5aae004ef87379f0655260a Author: Pablo Neira Ayuso Date: Mon Dec 19 20:07:52 2022 +0100 netfilter: nf_tables: consolidate set description Add the following fields to the set description: - key type - data type - object type - policy - gc_int: garbage collection interval) - timeout: element timeout This prepares for stricter set type checks on updates in a follow up patch. Signed-off-by: Pablo Neira Ayuso commit 5eb119da94ac5d67a31eaa869621dc6e25eb125e Author: Florian Westphal Date: Thu Dec 15 15:16:33 2022 +0100 netfilter: conntrack: fix ipv6 exthdr error check smatch warnings: net/netfilter/nf_conntrack_proto.c:167 nf_confirm() warn: unsigned 'protoff' is never less than zero. We need to check if ipv6_skip_exthdr() returned an error, but protoff is unsigned. Use a signed integer for this. Fixes: a70e483460d5 ("netfilter: conntrack: merge ipv4+ipv6 confirm functions") Reported-by: kernel test robot Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 878cf96f686c59b82ee76c2b233c41b5fc3c0936 Merge: 222882c2ab122 2c05bf3aa0741 Author: Linus Torvalds Date: Wed Dec 21 08:13:01 2022 -0800 Merge tag 'fs.vfsuid.ima.v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfsuid cleanup from Christian Brauner: "This moves the ima specific vfs{g,u}id_t comparison helpers out of the header and into the one file in ima where they are used. We shouldn't incentivize people to use them by placing them into the header. As discussed and suggested by Linus in [1] let's just define them locally in the one file in ima where they are used" Link: https://lore.kernel.org/lkml/CAHk-=wj4BpEwUd=OkTv1F9uykvSrsBNZJVHMp+p_+e2kiV71_A@mail.gmail.com [1] * tag 'fs.vfsuid.ima.v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: mnt_idmapping: move ima-only helpers to ima commit 222882c2ab1221b6df2d189138638a6435cd8e88 Merge: 19822e3ee4c89 3c202d14a9d73 Author: Linus Torvalds Date: Wed Dec 21 08:02:30 2022 -0800 Merge tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull more random number generator updates from Jason Donenfeld: "Two remaining changes that are now possible after you merged a few other trees: - #include can be removed from random.h now, making the direct use of the arch_random_* API more of a private implementation detail between the archs and random.c, rather than something for general consumers. - Two additional uses of prandom_u32_max() snuck in during the initial phase of pulls, so these have been converted to get_random_u32_below(), and now the deprecated prandom_u32_max() alias -- which was just a wrapper around get_random_u32_below() -- can be removed. In addition, there is one fix: - Check efi_rt_services_supported() before attempting to use an EFI runtime function. This affected EFI systems that disable runtime services yet still boot via EFI (e.g. the reporter's Lenovo Thinkpad X13s laptop), as well systems where EFI runtime services have been forcibly disabled, such as on PREEMPT_RT. On those machines, a very early and hard to diagnose crash would happen, preventing boot" * tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: prandom: remove prandom_u32_max() efi: random: fix NULL-deref when refreshing seed random: do not include from random.h commit 19822e3ee4c891e1e8434e290fbca0af52490240 Merge: b6bb9676f2165 3f6c3d29df58f Author: Linus Torvalds Date: Wed Dec 21 07:59:57 2022 -0800 Merge tag 'rcu-urgent.2022.12.17a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU fix from Paul McKenney: "This fixes a lockdep false positive in synchronize_rcu() that can otherwise occur during early boot. The fix simply avoids invoking lockdep if the scheduler has not yet been initialized, that is, during that portion of boot when interrupts are disabled" * tag 'rcu-urgent.2022.12.17a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: rcu: Don't assert interrupts enabled too early in boot commit 52ea806ad983490b3132a9e526e11a10dc2fd10c Author: Jens Axboe Date: Wed Dec 21 07:05:09 2022 -0700 io_uring: finish waiting before flushing overflow entries If we have overflow entries being generated after we've done the initial flush in io_cqring_wait(), then we could be flushing them in the main wait loop as well. If that's done after having added ourselves to the cq_wait waitqueue, then the task state can be != TASK_RUNNING when we enter the overflow flush. Check for the need to overflow flush, and finish our wait cycle first if we have to do so. Reported-and-tested-by: syzbot+cf6ea1d6bb30a4ce10b2@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/000000000000cb143a05f04eee15@google.com/ Signed-off-by: Jens Axboe commit 4217c6ac817451d5116687f3cc6286220dc43d49 Author: Steven Price Date: Mon Dec 19 14:01:30 2022 +0000 drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then a(nother) reference on the BO was dropped. The _create_with_handle() is a problematic pattern, so ditch it and instead create the handle in panfrost_ioctl_create_bo(). If the call to panfrost_gem_mapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code. Reported-by: Rob Clark Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") Signed-off-by: Steven Price Reviewed-by: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/20221219140130.410578-1-steven.price@arm.com commit 11933cf1d91d57da9e5c53822a540bbdc2656c16 Author: Christian Brauner Date: Sat Dec 17 22:28:40 2022 +0100 pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference. Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users. While fixing this bug we've gotten confused multiple times due to unclear terminology or missing concepts. So let's start this with some clarifications: * The terms "master" or "peer" denote a shared mount. A shared mount belongs to a peer group. * A peer group is a set of shared mounts that propagate to each other. They are identified by a peer group id. The peer group id is available in @shared_mnt->mnt_group_id. Shared mounts within the same peer group have the same peer group id. The peers in a peer group can be reached via @shared_mnt->mnt_share. * The terms "slave mount" or "dependent mount" denote a mount that receives propagation from a peer in a peer group. IOW, shared mounts may have slave mounts and slave mounts have shared mounts as their master. Slave mounts of a given peer in a peer group are listed on that peers slave list available at @shared_mnt->mnt_slave_list. * The term "master mount" denotes a mount in a peer group. IOW, it denotes a shared mount or a peer mount in a peer group. The term "master mount" - or "master" for short - is mostly used when talking in the context of slave mounts that receive propagation from a master mount. A master mount of a slave identifies the closest peer group a slave mount receives propagation from. The master mount of a slave can be identified via @slave_mount->mnt_master. Different slaves may point to different masters in the same peer group. * Multiple peers in a peer group can have non-empty ->mnt_slave_lists. Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to ensure all slave mounts of a peer group are visited the ->mnt_slave_lists of all peers in a peer group have to be walked. * Slave mounts point to a peer in the closest peer group they receive propagation from via @slave_mnt->mnt_master (see above). Together with these peers they form a propagation group (see below). The closest peer group can thus be identified through the peer group id @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave mount receives propagation from. * A shared-slave mount is a slave mount to a peer group pg1 while also a peer in another peer group pg2. IOW, a peer group may receive propagation from another peer group. If a peer group pg1 is a slave to another peer group pg2 then all peers in peer group pg1 point to the same peer in peer group pg2 via ->mnt_master. IOW, all peers in peer group pg1 appear on the same ->mnt_slave_list. IOW, they cannot be slaves to different peer groups. * A pure slave mount is a slave mount that is a slave to a peer group but is not a peer in another peer group. * A propagation group denotes the set of mounts consisting of a single peer group pg1 and all slave mounts and shared-slave mounts that point to a peer in that peer group via ->mnt_master. IOW, all slave mounts such that @slave_mnt->mnt_master->mnt_group_id is equal to @shared_mnt->mnt_group_id. The concept of a propagation group makes it easier to talk about a single propagation level in a propagation tree. For example, in propagate_mnt() the immediate peers of @dest_mnt and all slaves of @dest_mnt's peer group form a propagation group propg1. So a shared-slave mount that is a slave in propg1 and that is a peer in another peer group pg2 forms another propagation group propg2 together with all slaves that point to that shared-slave mount in their ->mnt_master. * A propagation tree refers to all mounts that receive propagation starting from a specific shared mount. For example, for propagate_mnt() @dest_mnt is the start of a propagation tree. The propagation tree ecompasses all mounts that receive propagation from @dest_mnt's peer group down to the leafs. With that out of the way let's get to the actual algorithm. We know that @dest_mnt is guaranteed to be a pure shared mount or a shared-slave mount. This is guaranteed by a check in attach_recursive_mnt(). So propagate_mnt() will first propagate the source mount tree to all peers in @dest_mnt's peer group: for (n = next_peer(dest_mnt); n != dest_mnt; n = next_peer(n)) { ret = propagate_one(n); if (ret) goto out; } Notice, that the peer propagation loop of propagate_mnt() doesn't propagate @dest_mnt itself. @dest_mnt is mounted directly in attach_recursive_mnt() after we propagated to the destination propagation tree. The mount that will be mounted on top of @dest_mnt is @source_mnt. This copy was created earlier even before we entered attach_recursive_mnt() and doesn't concern us a lot here. It's just important to notice that when propagate_mnt() is called @source_mnt will not yet have been mounted on top of @dest_mnt. Thus, @source_mnt->mnt_parent will either still point to @source_mnt or - in the case @source_mnt is moved and thus already attached - still to its former parent. For each peer @m in @dest_mnt's peer group propagate_one() will create a new copy of the source mount tree and mount that copy @child on @m such that @child->mnt_parent points to @m after propagate_one() returns. propagate_one() will stash the last destination propagation node @m in @last_dest and the last copy it created for the source mount tree in @last_source. Hence, if we call into propagate_one() again for the next destination propagation node @m, @last_dest will point to the previous destination propagation node and @last_source will point to the previous copy of the source mount tree and mounted on @last_dest. Each new copy of the source mount tree is created from the previous copy of the source mount tree. This will become important later. The peer loop in propagate_mnt() is straightforward. We iterate through the peers copying and updating @last_source and @last_dest as we go through them and mount each copy of the source mount tree @child on a peer @m in @dest_mnt's peer group. After propagate_mnt() handled the peers in @dest_mnt's peer group propagate_mnt() will propagate the source mount tree down the propagation tree that @dest_mnt's peer group propagates to: for (m = next_group(dest_mnt, dest_mnt); m; m = next_group(m, dest_mnt)) { /* everything in that slave group */ n = m; do { ret = propagate_one(n); if (ret) goto out; n = next_peer(n); } while (n != m); } The next_group() helper will recursively walk the destination propagation tree, descending into each propagation group of the propagation tree. The important part is that it takes care to propagate the source mount tree to all peers in the peer group of a propagation group before it propagates to the slaves to those peers in the propagation group. IOW, it creates and mounts copies of the source mount tree that become masters before it creates and mounts copies of the source mount tree that become slaves to these masters. It is important to remember that propagating the source mount tree to each mount @m in the destination propagation tree simply means that we create and mount new copies @child of the source mount tree on @m such that @child->mnt_parent points to @m. Since we know that each node @m in the destination propagation tree headed by @dest_mnt's peer group will be overmounted with a copy of the source mount tree and since we know that the propagation properties of each copy of the source mount tree we create and mount at @m will mostly mirror the propagation properties of @m. We can use that information to create and mount the copies of the source mount tree that become masters before their slaves. The easy case is always when @m and @last_dest are peers in a peer group of a given propagation group. In that case we know that we can simply copy @last_source without having to figure out what the master for the new copy @child of the source mount tree needs to be as we've done that in a previous call to propagate_one(). The hard case is when we're dealing with a slave mount or a shared-slave mount @m in a destination propagation group that we need to create and mount a copy of the source mount tree on. For each propagation group in the destination propagation tree we propagate the source mount tree to we want to make sure that the copies @child of the source mount tree we create and mount on slaves @m pick an ealier copy of the source mount tree that we mounted on a master @m of the destination propagation group as their master. This is a mouthful but as far as we can tell that's the core of it all. But, if we keep track of the masters in the destination propagation tree @m we can use the information to find the correct master for each copy of the source mount tree we create and mount at the slaves in the destination propagation tree @m. Let's walk through the base case as that's still fairly easy to grasp. If we're dealing with the first slave in the propagation group that @dest_mnt is in then we don't yet have marked any masters in the destination propagation tree. We know the master for the first slave to @dest_mnt's peer group is simple @dest_mnt. So we expect this algorithm to yield a copy of the source mount tree that was mounted on a peer in @dest_mnt's peer group as the master for the copy of the source mount tree we want to mount at the first slave @m: for (n = m; ; n = p) { p = n->mnt_master; if (p == dest_master || IS_MNT_MARKED(p)) break; } For the first slave we walk the destination propagation tree all the way up to a peer in @dest_mnt's peer group. IOW, the propagation hierarchy can be walked by walking up the @mnt->mnt_master hierarchy of the destination propagation tree @m. We will ultimately find a peer in @dest_mnt's peer group and thus ultimately @dest_mnt->mnt_master. Btw, here the assumption we listed at the beginning becomes important. Namely, that peers in a peer group pg1 that are slaves in another peer group pg2 appear on the same ->mnt_slave_list. IOW, all slaves who are peers in peer group pg1 point to the same peer in peer group pg2 via their ->mnt_master. Otherwise the termination condition in the code above would be wrong and next_group() would be broken too. So the first iteration sets: n = m; p = n->mnt_master; such that @p now points to a peer or @dest_mnt itself. We walk up one more level since we don't have any marked mounts. So we end up with: n = dest_mnt; p = dest_mnt->mnt_master; If @dest_mnt's peer group is not slave to another peer group then @p is now NULL. If @dest_mnt's peer group is a slave to another peer group then @p now points to @dest_mnt->mnt_master points which is a master outside the propagation tree we're dealing with. Now we need to figure out the master for the copy of the source mount tree we're about to create and mount on the first slave of @dest_mnt's peer group: do { struct mount *parent = last_source->mnt_parent; if (last_source == first_source) break; done = parent->mnt_master == p; if (done && peers(n, parent)) break; last_source = last_source->mnt_master; } while (!done); We know that @last_source->mnt_parent points to @last_dest and @last_dest is the last peer in @dest_mnt's peer group we propagated to in the peer loop in propagate_mnt(). Consequently, @last_source is the last copy we created and mount on that last peer in @dest_mnt's peer group. So @last_source is the master we want to pick. We know that @last_source->mnt_parent->mnt_master points to @last_dest->mnt_master. We also know that @last_dest->mnt_master is either NULL or points to a master outside of the destination propagation tree and so does @p. Hence: done = parent->mnt_master == p; is trivially true in the base condition. We also know that for the first slave mount of @dest_mnt's peer group that @last_dest either points @dest_mnt itself because it was initialized to: last_dest = dest_mnt; at the beginning of propagate_mnt() or it will point to a peer of @dest_mnt in its peer group. In both cases it is guaranteed that on the first iteration @n and @parent are peers (Please note the check for peers here as that's important.): if (done && peers(n, parent)) break; So, as we expected, we select @last_source, which referes to the last copy of the source mount tree we mounted on the last peer in @dest_mnt's peer group, as the master of the first slave in @dest_mnt's peer group. The rest is taken care of by clone_mnt(last_source, ...). We'll skip over that part otherwise this becomes a blogpost. At the end of propagate_mnt() we now mark @m->mnt_master as the first master in the destination propagation tree that is distinct from @dest_mnt->mnt_master. IOW, we mark @dest_mnt itself as a master. By marking @dest_mnt or one of it's peers we are able to easily find it again when we later lookup masters for other copies of the source mount tree we mount copies of the source mount tree on slaves @m to @dest_mnt's peer group. This, in turn allows us to find the master we selected for the copies of the source mount tree we mounted on master in the destination propagation tree again. The important part is to realize that the code makes use of the fact that the last copy of the source mount tree stashed in @last_source was mounted on top of the previous destination propagation node @last_dest. What this means is that @last_source allows us to walk the destination propagation hierarchy the same way each destination propagation node @m does. If we take @last_source, which is the copy of @source_mnt we have mounted on @last_dest in the previous iteration of propagate_one(), then we know @last_source->mnt_parent points to @last_dest but we also know that as we walk through the destination propagation tree that @last_source->mnt_master will point to an earlier copy of the source mount tree we mounted one an earlier destination propagation node @m. IOW, @last_source->mnt_parent will be our hook into the destination propagation tree and each consecutive @last_source->mnt_master will lead us to an earlier propagation node @m via @last_source->mnt_master->mnt_parent. Hence, by walking up @last_source->mnt_master, each of which is mounted on a node that is a master @m in the destination propagation tree we can also walk up the destination propagation hierarchy. So, for each new destination propagation node @m we use the previous copy of @last_source and the fact it's mounted on the previous propagation node @last_dest via @last_source->mnt_master->mnt_parent to determine what the master of the new copy of @last_source needs to be. The goal is to find the _closest_ master that the new copy of the source mount tree we are about to create and mount on a slave @m in the destination propagation tree needs to pick. IOW, we want to find a suitable master in the propagation group. As the propagation structure of the source mount propagation tree we create mirrors the propagation structure of the destination propagation tree we can find @m's closest master - i.e., a marked master - which is a peer in the closest peer group that @m receives propagation from. We store that closest master of @m in @p as before and record the slave to that master in @n We then search for this master @p via @last_source by walking up the master hierarchy starting from the last copy of the source mount tree stored in @last_source that we created and mounted on the previous destination propagation node @m. We will try to find the master by walking @last_source->mnt_master and by comparing @last_source->mnt_master->mnt_parent->mnt_master to @p. If we find @p then we can figure out what earlier copy of the source mount tree needs to be the master for the new copy of the source mount tree we're about to create and mount at the current destination propagation node @m. If @last_source->mnt_master->mnt_parent and @n are peers then we know that the closest master they receive propagation from is @last_source->mnt_master->mnt_parent->mnt_master. If not then the closest immediate peer group that they receive propagation from must be one level higher up. This builds on the earlier clarification at the beginning that all peers in a peer group which are slaves of other peer groups all point to the same ->mnt_master, i.e., appear on the same ->mnt_slave_list, of the closest peer group that they receive propagation from. However, terminating the walk has corner cases. If the closest marked master for a given destination node @m cannot be found by walking up the master hierarchy via @last_source->mnt_master then we need to terminate the walk when we encounter @source_mnt again. This isn't an arbitrary termination. It simply means that the new copy of the source mount tree we're about to create has a copy of the source mount tree we created and mounted on a peer in @dest_mnt's peer group as its master. IOW, @source_mnt is the peer in the closest peer group that the new copy of the source mount tree receives propagation from. We absolutely have to stop @source_mnt because @last_source->mnt_master either points outside the propagation hierarchy we're dealing with or it is NULL because @source_mnt isn't a shared-slave. So continuing the walk past @source_mnt would cause a NULL dereference via @last_source->mnt_master->mnt_parent. And so we have to stop the walk when we encounter @source_mnt again. One scenario where this can happen is when we first handled a series of slaves of @dest_mnt's peer group and then encounter peers in a new peer group that is a slave to @dest_mnt's peer group. We handle them and then we encounter another slave mount to @dest_mnt that is a pure slave to @dest_mnt's peer group. That pure slave will have a peer in @dest_mnt's peer group as its master. Consequently, the new copy of the source mount tree will need to have @source_mnt as it's master. So we walk the propagation hierarchy all the way up to @source_mnt based on @last_source->mnt_master. So terminate on @source_mnt, easy peasy. Except, that the check misses something that the rest of the algorithm already handles. If @dest_mnt has peers in it's peer group the peer loop in propagate_mnt(): for (n = next_peer(dest_mnt); n != dest_mnt; n = next_peer(n)) { ret = propagate_one(n); if (ret) goto out; } will consecutively update @last_source with each previous copy of the source mount tree we created and mounted at the previous peer in @dest_mnt's peer group. So after that loop terminates @last_source will point to whatever copy of the source mount tree was created and mounted on the last peer in @dest_mnt's peer group. Furthermore, if there is even a single additional peer in @dest_mnt's peer group then @last_source will __not__ point to @source_mnt anymore. Because, as we mentioned above, @dest_mnt isn't even handled in this loop but directly in attach_recursive_mnt(). So it can't even accidently come last in that peer loop. So the first time we handle a slave mount @m of @dest_mnt's peer group the copy of the source mount tree we create will make the __last copy of the source mount tree we created and mounted on the last peer in @dest_mnt's peer group the master of the new copy of the source mount tree we create and mount on the first slave of @dest_mnt's peer group__. But this means that the termination condition that checks for @source_mnt is wrong. The @source_mnt cannot be found anymore by propagate_one(). Instead it will find the last copy of the source mount tree we created and mounted for the last peer of @dest_mnt's peer group again. And that is a peer of @source_mnt not @source_mnt itself. IOW, we fail to terminate the loop correctly and ultimately dereference @last_source->mnt_master->mnt_parent. When @source_mnt's peer group isn't slave to another peer group then @last_source->mnt_master is NULL causing the splat below. For example, assume @dest_mnt is a pure shared mount and has three peers in its peer group: =================================================================================== mount-id mount-parent-id peer-group-id =================================================================================== (@dest_mnt) mnt_master[216] 309 297 shared:216 \ (@source_mnt) mnt_master[218]: 609 609 shared:218 (1) mnt_master[216]: 607 605 shared:216 \ (P1) mnt_master[218]: 624 607 shared:218 (2) mnt_master[216]: 576 574 shared:216 \ (P2) mnt_master[218]: 625 576 shared:218 (3) mnt_master[216]: 545 543 shared:216 \ (P3) mnt_master[218]: 626 545 shared:218 After this sequence has been processed @last_source will point to (P3), the copy generated for the third peer in @dest_mnt's peer group we handled. So the copy of the source mount tree (P4) we create and mount on the first slave of @dest_mnt's peer group: =================================================================================== mount-id mount-parent-id peer-group-id =================================================================================== mnt_master[216] 309 297 shared:216 / / (S0) mnt_slave 483 481 master:216 \ \ (P3) mnt_master[218] 626 545 shared:218 \ / \/ (P4) mnt_slave 627 483 master:218 will pick the last copy of the source mount tree (P3) as master, not (S0). When walking the propagation hierarchy via @last_source's master hierarchy we encounter (P3) but not (S0), i.e., @source_mnt. We can fix this in multiple ways: (1) By setting @last_source to @source_mnt after we processed the peers in @dest_mnt's peer group right after the peer loop in propagate_mnt(). (2) By changing the termination condition that relies on finding exactly @source_mnt to finding a peer of @source_mnt. (3) By only moving @last_source when we actually venture into a new peer group or some clever variant thereof. The first two options are minimally invasive and what we want as a fix. The third option is more intrusive but something we'd like to explore in the near future. This passes all LTP tests and specifically the mount propagation testsuite part of it. It also holds up against all known reproducers of this issues. Final words. First, this is a clever but __worringly__ underdocumented algorithm. There isn't a single detailed comment to be found in next_group(), propagate_one() or anywhere else in that file for that matter. This has been a giant pain to understand and work through and a bug like this is insanely difficult to fix without a detailed understanding of what's happening. Let's not talk about the amount of time that was sunk into fixing this. Second, all the cool kids with access to unshare --mount --user --map-root --propagation=unchanged are going to have a lot of fun. IOW, triggerable by unprivileged users while namespace_lock() lock is held. [ 115.848393] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 115.848967] #PF: supervisor read access in kernel mode [ 115.849386] #PF: error_code(0x0000) - not-present page [ 115.849803] PGD 0 P4D 0 [ 115.850012] Oops: 0000 [#1] PREEMPT SMP PTI [ 115.850354] CPU: 0 PID: 15591 Comm: mount Not tainted 6.1.0-rc7 #3 [ 115.850851] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 115.851510] RIP: 0010:propagate_one.part.0+0x7f/0x1a0 [ 115.851924] Code: 75 eb 4c 8b 05 c2 25 37 02 4c 89 ca 48 8b 4a 10 49 39 d0 74 1e 48 3b 81 e0 00 00 00 74 26 48 8b 92 e0 00 00 00 be 01 00 00 00 <48> 8b 4a 10 49 39 d0 75 e2 40 84 f6 74 38 4c 89 05 84 25 37 02 4d [ 115.853441] RSP: 0018:ffffb8d5443d7d50 EFLAGS: 00010282 [ 115.853865] RAX: ffff8e4d87c41c80 RBX: ffff8e4d88ded780 RCX: ffff8e4da4333a00 [ 115.854458] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8e4d88ded780 [ 115.855044] RBP: ffff8e4d88ded780 R08: ffff8e4da4338000 R09: ffff8e4da43388c0 [ 115.855693] R10: 0000000000000002 R11: ffffb8d540158000 R12: ffffb8d5443d7da8 [ 115.856304] R13: ffff8e4d88ded780 R14: 0000000000000000 R15: 0000000000000000 [ 115.856859] FS: 00007f92c90c9800(0000) GS:ffff8e4dfdc00000(0000) knlGS:0000000000000000 [ 115.857531] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.858006] CR2: 0000000000000010 CR3: 0000000022f4c002 CR4: 00000000000706f0 [ 115.858598] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 115.859393] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 115.860099] Call Trace: [ 115.860358] [ 115.860535] propagate_mnt+0x14d/0x190 [ 115.860848] attach_recursive_mnt+0x274/0x3e0 [ 115.861212] path_mount+0x8c8/0xa60 [ 115.861503] __x64_sys_mount+0xf6/0x140 [ 115.861819] do_syscall_64+0x5b/0x80 [ 115.862117] ? do_faccessat+0x123/0x250 [ 115.862435] ? syscall_exit_to_user_mode+0x17/0x40 [ 115.862826] ? do_syscall_64+0x67/0x80 [ 115.863133] ? syscall_exit_to_user_mode+0x17/0x40 [ 115.863527] ? do_syscall_64+0x67/0x80 [ 115.863835] ? do_syscall_64+0x67/0x80 [ 115.864144] ? do_syscall_64+0x67/0x80 [ 115.864452] ? exc_page_fault+0x70/0x170 [ 115.864775] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.865187] RIP: 0033:0x7f92c92b0ebe [ 115.865480] Code: 48 8b 0d 75 4f 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 42 4f 0c 00 f7 d8 64 89 01 48 [ 115.866984] RSP: 002b:00007fff000aa728 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 115.867607] RAX: ffffffffffffffda RBX: 000055a77888d6b0 RCX: 00007f92c92b0ebe [ 115.868240] RDX: 000055a77888d8e0 RSI: 000055a77888e6e0 RDI: 000055a77888e620 [ 115.868823] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 115.869403] R10: 0000000000001000 R11: 0000000000000246 R12: 000055a77888e620 [ 115.869994] R13: 000055a77888d8e0 R14: 00000000ffffffff R15: 00007f92c93e4076 [ 115.870581] [ 115.870763] Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables nfnetlink qrtr snd_intel8x0 sunrpc snd_ac97_codec ac97_bus snd_pcm snd_timer intel_rapl_msr intel_rapl_common snd vboxguest intel_powerclamp video rapl joydev soundcore i2c_piix4 wmi fuse zram xfs vmwgfx crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic drm_ttm_helper ttm e1000 ghash_clmulni_intel serio_raw ata_generic pata_acpi scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_multipath [ 115.875288] CR2: 0000000000000010 [ 115.875641] ---[ end trace 0000000000000000 ]--- [ 115.876135] RIP: 0010:propagate_one.part.0+0x7f/0x1a0 [ 115.876551] Code: 75 eb 4c 8b 05 c2 25 37 02 4c 89 ca 48 8b 4a 10 49 39 d0 74 1e 48 3b 81 e0 00 00 00 74 26 48 8b 92 e0 00 00 00 be 01 00 00 00 <48> 8b 4a 10 49 39 d0 75 e2 40 84 f6 74 38 4c 89 05 84 25 37 02 4d [ 115.878086] RSP: 0018:ffffb8d5443d7d50 EFLAGS: 00010282 [ 115.878511] RAX: ffff8e4d87c41c80 RBX: ffff8e4d88ded780 RCX: ffff8e4da4333a00 [ 115.879128] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8e4d88ded780 [ 115.879715] RBP: ffff8e4d88ded780 R08: ffff8e4da4338000 R09: ffff8e4da43388c0 [ 115.880359] R10: 0000000000000002 R11: ffffb8d540158000 R12: ffffb8d5443d7da8 [ 115.880962] R13: ffff8e4d88ded780 R14: 0000000000000000 R15: 0000000000000000 [ 115.881548] FS: 00007f92c90c9800(0000) GS:ffff8e4dfdc00000(0000) knlGS:0000000000000000 [ 115.882234] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.882713] CR2: 0000000000000010 CR3: 0000000022f4c002 CR4: 00000000000706f0 [ 115.883314] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 115.883966] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: f2ebb3a921c1 ("smarter propagate_mnt()") Fixes: 5ec0811d3037 ("propogate_mnt: Handle the first propogated copy being a slave") Cc: Reported-by: Ditang Chen Signed-off-by: Seth Forshee (Digital Ocean) Signed-off-by: Christian Brauner (Microsoft) --- If there are no big objections I'll get this to Linus rather sooner than later. commit 9a9134fd56f6ba614ff7b2b3b0bac0bf1d0dc0c9 Author: Curtis Malainey Date: Tue Dec 20 14:56:29 2022 +0200 ASoC: SOF: Add FW state to debugfs Allow system health detection mechanisms to check the FW state, this will allow them to check if the FW is in its "crashed" state going forward to help automatically diagnose driver state. Signed-off-by: Curtis Malainey Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20221220125629.8469-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit d185e0689abc98ef55fb7a7d75aa0c48a0ed5838 Author: Ranjani Sridharan Date: Tue Dec 20 14:56:28 2022 +0200 ASoC: SOF: pm: Always tear down pipelines before DSP suspend When the DSP is suspended while the firmware is in the crashed state, we skip tearing down the pipelines. This means that the widget reference counts will not get to reset to 0 before suspend. This will lead to errors with resuming audio after system resume. To fix this, invoke the tear_down_all_pipelines op before skipping to DSP suspend. Signed-off-by: Ranjani Sridharan Reviewed-by: Curtis Malainey Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20221220125629.8469-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 6f95eec6fb89e195dbdf30de65553c7fc57d9372 Author: Ranjani Sridharan Date: Tue Dec 20 14:56:27 2022 +0200 ASoC: SOF: pm: Set target state earlier If the DSP crashes before the system suspends, the setting of target state will be skipped because the firmware state will no longer be SOF_FW_BOOT_COMPLETE. This leads to the incorrect assumption that the DSP should suspend to D0I3 instead of suspending to D3. To fix this, set the target_state before we skip to DSP suspend even when the DSP has crashed. Signed-off-by: Ranjani Sridharan Reviewed-by: Curtis Malainey Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20221220125629.8469-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 24b333a866a10d4be47b9968b9c05a3e9f326ff5 Author: Florian Fainelli Date: Tue Dec 20 11:09:46 2022 -0800 MIPS: dts: bcm63268: Add missing properties to the TWD node We currently have a DTC warning with the current DTS due to the lack of a suitable #address-cells and #size-cells property: DTC arch/mips/boot/dts/brcm/bcm63268-comtrend-vr-3032u.dtb arch/mips/boot/dts/brcm/bcm63268.dtsi:115.5-22: Warning (reg_format): /ubus/timer-mfd@10000080/timer@0:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) arch/mips/boot/dts/brcm/bcm63268.dtsi:120.5-22: Warning (reg_format): /ubus/timer-mfd@10000080/watchdog@1c:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) arch/mips/boot/dts/brcm/bcm63268.dtsi:111.4-35: Warning (ranges_format): /ubus/timer-mfd@10000080:ranges: "ranges" property has invalid length (12 bytes) (parent #address-cells == 1, child #address-cells == 2, #size-cells == 1) Fixes: d3db4b96ab7f ("mips: dts: bcm63268: add TWD block timer") Signed-off-by: Florian Fainelli Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit 76ce51798cb16738a4a28a6662e7344aaf7ef769 Author: Sergio Paracuellos Date: Sat Dec 17 08:48:06 2022 +0100 MIPS: ralink: mt7621: avoid to init common ralink reset controller Commit 38a8553b0a22 ("clk: ralink: make system controller node a reset provider") make system controller a reset provider for mt7621 ralink SoCs. Ralink init code also tries to start previous common reset controller which at the end tries to find device tree node 'ralink,rt2880-reset'. mt7621 device tree file is not using at all this node anymore. Hence avoid to init this common reset controller for mt7621 ralink SoCs to avoid 'Failed to find reset controller node' boot error trace error. Fixes: 64b2d6ffff86 ("staging: mt7621-dts: align resets with binding documentation") Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 841734234a28fd5cd0889b84bd4d93a0988fa11e Author: Keith Busch Date: Mon Dec 19 13:54:55 2022 -0800 nvme-pci: fix page size checks The size allocated out of the dma pool is at most NVME_CTRL_PAGE_SIZE, which may be smaller than the PAGE_SIZE. Fixes: c61b82c7b7134 ("nvme-pci: fix PRP pool size") Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit c89a529e823d51dd23c7ec0c047c7a454a428541 Author: Keith Busch Date: Mon Dec 19 10:59:06 2022 -0800 nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. Cc: Jens Axboe Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") Signed-off-by: Keith Busch Reviewed-by: Jens Axboe Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit b5f96cb719d8ba220b565ddd3ba4ac0d8bcfb130 Author: Klaus Jensen Date: Tue Dec 13 09:58:07 2022 +0100 nvme-pci: fix doorbell buffer value endianness When using shadow doorbells, the event index and the doorbell values are written to host memory. Prior to this patch, the values written would erroneously be written in host endianness. This causes trouble on big-endian platforms. Fix this by adding missing endian conversions. This issue was noticed by Guenter while testing various big-endian platforms under QEMU[1]. A similar fix required for hw/nvme in QEMU is up for review as well[2]. [1]: https://lore.kernel.org/qemu-devel/20221209110022.GA3396194@roeck-us.net/ [2]: https://lore.kernel.org/qemu-devel/20221212114409.34972-4-its@irrelevant.dk/ Fixes: f9f38e33389c ("nvme: improve performance for virtual NVMe devices") Reported-by: Guenter Roeck Signed-off-by: Klaus Jensen Signed-off-by: Christoph Hellwig commit 3622b86f49f84e52fb41fee9eb55f9290613dfc3 Author: Christoph Hellwig Date: Tue Dec 20 09:08:12 2022 +0100 dma-mapping: reject GFP_COMP for noncoherent allocations While not quite as bogus as for the dma-coherent allocations that were fixed earlier, GFP_COMP for these allocations has no benefits for the dma-direct case, and can't be supported at all by dma dma-iommu backend which splits up allocations into smaller orders. Due to an oversight in ffcb75458460 that flag stopped being cleared for all dma allocations, but only got rejected for coherent ones, so fix up these callers to not allow __GFP_COMP as well after the sound code has been fixed to not ask for it. Fixes: ffcb75458460 ("dma-mapping: reject __GFP_COMP in dma_alloc_attrs") Reported-by: Mikhail Gavrilov Reported-by: Kai Vehmanen Signed-off-by: Christoph Hellwig Acked-by: Takashi Iwai Tested-by: Mikhail Gavrilov Tested-by: Kai Vehmanen commit db918321275d648294a3fb2bdefeb99e33f00467 Author: Christoph Hellwig Date: Tue Dec 20 09:05:36 2022 +0100 ALSA: memalloc: don't use GFP_COMP for non-coherent dma allocations While not quite as bogus as for the dma-coherent allocations that were fixed earlier, GFP_COMP for these allocations has no benefits for the dma-direct case, and can't be supported at all by dma dma-iommu backend which splits up allocations into smaller orders. Due to an oversight in ffcb75458460 that flag stopped being cleared for all dma allocations, but only got rejected for coherent ones. Start fixing this by not requesting __GFP_COMP in the sound code, which is the only place that did this. Fixes: ffcb75458460 ("dma-mapping: reject __GFP_COMP in dma_alloc_attrs") Reported-by: Mikhail Gavrilov Reported-by: Kai Vehmanen Signed-off-by: Christoph Hellwig Acked-by: Takashi Iwai Tested-by: Mikhail Gavrilov Tested-by: Kai Vehmanen commit 54c3f1a81421f85e60ae2eaae7be3727a09916ee Author: Jakub Kicinski Date: Mon Dec 19 16:47:00 2022 -0800 bpf: pull before calling skb_postpull_rcsum() Anand hit a BUG() when pulling off headers on egress to a SW tunnel. We get to skb_checksum_help() with an invalid checksum offset (commit d7ea0d9df2a6 ("net: remove two BUG() from skb_checksum_help()") converted those BUGs to WARN_ONs()). He points out oddness in how skb_postpull_rcsum() gets used. Indeed looks like we should pull before "postpull", otherwise the CHECKSUM_PARTIAL fixup from skb_postpull_rcsum() will not be able to do its job: if (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start_offset(skb) < 0) skb->ip_summed = CHECKSUM_NONE; Reported-by: Anand Parthasarathy Fixes: 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper") Signed-off-by: Jakub Kicinski Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20221220004701.402165-1-kuba@kernel.org Signed-off-by: Martin KaFai Lau commit 1644d755d0b06d0f1ee93e1c44336c29386546b4 Merge: b29e6ece454f7 b6bb9676f2165 Author: Andrew Morton Date: Tue Dec 20 15:02:03 2022 -0800 Merge branch 'linus' commit 19e72b064fc32cd58f6fc0b1eb64ac2e4f770e76 Author: Wei Fang Date: Mon Dec 19 10:27:55 2022 +0800 net: fec: check the return value of build_skb() The build_skb might return a null pointer but there is no check on the return value in the fec_enet_rx_queue(). So a null pointer dereference might occur. To avoid this, we check the return value of build_skb. If the return value is a null pointer, the driver will recycle the page and update the statistic of ndev. Then jump to rx_processing_done to clear the status flags of the BD so that the hardware can recycle the BD. Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers") Signed-off-by: Wei Fang Reviewed-by: Shenwei Wang Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20221219022755.1047573-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit fee4c19937439693f2420a916169d08e88576e8e Author: Filipe Manana Date: Tue Dec 20 11:13:33 2022 +0000 btrfs: fix fscrypt name leak after failure to join log transaction When logging a new name, we don't expect to fail joining a log transaction since we know at least one of the inodes was logged before in the current transaction. However if we fail for some unexpected reason, we end up not freeing the fscrypt name we previously allocated. So fix that by freeing the name in case we failed to join a log transaction. Fixes: ab3c5c18e8fa ("btrfs: setup qstr from dentrys using fscrypt helper") Reviewed-by: Sweet Tea Dorminy Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e7fc357ec03ee109da503af0dd31bbf68514e481 Author: Josef Bacik Date: Fri Dec 16 11:48:00 2022 -0500 btrfs: scrub: fix uninitialized return value in recover_scrub_rbio Commit 75b470332965 ("btrfs: raid56: migrate recovery and scrub recovery path to use error_bitmap") introduced an uninitialized return variable. This can be caught by gcc 12.1 by -Wmaybe-uninitialized: CC [M] fs/btrfs/raid56.o fs/btrfs/raid56.c: In function ‘scrub_rbio’: fs/btrfs/raid56.c:2801:15: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized] 2801 | ret = recover_scrub_rbio(rbio); | ^~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/raid56.c:2649:13: note: ‘ret’ was declared here 2649 | int ret; The warning is disabled by default so we haven't caught that. Due to the bug the raid56 scrub fstests have been failing since the patch was merged, so initialize that. Fixes: 75b470332965 ("btrfs: raid56: migrate recovery and scrub recovery path to use error_bitmap") Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 Author: Boris Burkov Date: Wed Dec 14 15:05:08 2022 -0800 btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of an inline extent followed by a regular or prealloc extent, then a legitimate attempt to resolve a logical address in the non-inline region will result in add_all_parents reading the invalid offset field of the inline extent. If the inline extent item is placed in the leaf eb s.t. it is the first item, attempting to access the offset field will not only be meaningless, it will go past the end of the eb and cause this panic: [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8 [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI [17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199 [17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110 [17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202 [17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000 [17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001 [17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff [17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918 [17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd [17.663617] FS: 00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000 [17.666525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0 [17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [17.676034] PKRU: 55555554 [17.677004] Call Trace: [17.677877] add_all_parents+0x276/0x480 [17.679325] find_parent_nodes+0xfae/0x1590 [17.680771] btrfs_find_all_leafs+0x5e/0xa0 [17.682217] iterate_extent_inodes+0xce/0x260 [17.683809] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.685597] ? iterate_inodes_from_logical+0xa1/0xd0 [17.687404] iterate_inodes_from_logical+0xa1/0xd0 [17.689121] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.691010] btrfs_ioctl_logical_to_ino+0x131/0x190 [17.692946] btrfs_ioctl+0x104a/0x2f60 [17.694384] ? selinux_file_ioctl+0x182/0x220 [17.695995] ? __x64_sys_ioctl+0x84/0xc0 [17.697394] __x64_sys_ioctl+0x84/0xc0 [17.698697] do_syscall_64+0x33/0x40 [17.700017] entry_SYSCALL_64_after_hwframe+0x44/0xae [17.701753] RIP: 0033:0x7f64e72761b7 [17.709355] RSP: 002b:00007ffefb067f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [17.712088] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f64e72761b7 [17.714667] RDX: 00007ffefb067fb0 RSI: 00000000c0389424 RDI: 0000000000000003 [17.717386] RBP: 00007ffefb06d188 R08: 000055d4a390d2b0 R09: 00007f64e7340a60 [17.719938] R10: 0000000000000231 R11: 0000000000000246 R12: 0000000000000001 [17.722383] R13: 0000000000000000 R14: 00000000c0389424 R15: 000055d4a38fd2a0 [17.724839] Modules linked in: Fix the bug by detecting the inline extent item in add_all_parents and skipping to the next extent item. CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 8660495a9c5b9afeec4cc006b3b75178f0fb2f10 Author: Tim Huang Date: Mon Dec 19 18:32:32 2022 +0800 drm/amdgpu: skip mes self test after s0i3 resume for MES IP v11.0 MES is part of gfxoff and MES suspend and resume are skipped for S0i3. But the mes_self_test call path is still in the amdgpu_device_ip_late_init. it's should also be skipped for s0ix as no hardware re-initialization happened. Besides, mes_self_test will free the BO that triggers a lot of warning messages while in the suspend state. [ 81.656085] WARNING: CPU: 2 PID: 1550 at drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:425 amdgpu_bo_free_kernel+0xfc/0x110 [amdgpu] [ 81.679435] Call Trace: [ 81.679726] [ 81.679981] amdgpu_mes_remove_hw_queue+0x17a/0x230 [amdgpu] [ 81.680857] amdgpu_mes_self_test+0x390/0x430 [amdgpu] [ 81.681665] mes_v11_0_late_init+0x37/0x50 [amdgpu] [ 81.682423] amdgpu_device_ip_late_init+0x53/0x280 [amdgpu] [ 81.683257] amdgpu_device_resume+0xae/0x2a0 [amdgpu] [ 81.684043] amdgpu_pmops_resume+0x37/0x70 [amdgpu] [ 81.684818] pci_pm_resume+0x5c/0xa0 [ 81.685247] ? pci_pm_thaw+0x90/0x90 [ 81.685658] dpm_run_callback+0x4e/0x160 [ 81.686110] device_resume+0xad/0x210 [ 81.686529] async_resume+0x1e/0x40 [ 81.686931] async_run_entry_fn+0x33/0x120 [ 81.687405] process_one_work+0x21d/0x3f0 [ 81.687869] worker_thread+0x4a/0x3c0 [ 81.688293] ? process_one_work+0x3f0/0x3f0 [ 81.688777] kthread+0xff/0x130 [ 81.689157] ? kthread_complete_and_exit+0x20/0x20 [ 81.689707] ret_from_fork+0x22/0x30 [ 81.690118] [ 81.690380] ---[ end trace 0000000000000000 ]--- v2: make the comment clean and use adev->in_s0ix instead of adev->suspend Signed-off-by: Tim Huang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0, 6.1 commit e73fc71e8f015d61f3adca7659cb209fd5117aa5 Author: Evan Quan Date: Fri Dec 16 17:04:24 2022 +0800 drm/amd/pm: correct the fan speed retrieving in PWM for some SMU13 asics For SMU 13.0.0 and 13.0.7, the output from PMFW is in percent. Driver need to convert that into correct PMW(255) based. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0, 6.1 commit 272b981416f8be0180c4d8066f90635fa7c1c501 Author: Evan Quan Date: Thu Dec 15 13:38:46 2022 +0800 drm/amd/pm: bump SMU13.0.0 driver_if header to version 0x34 To fit the latest PMFW and suppress the warning emerged on driver loading. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0, 6.1 commit 59119c09ae748c6398e44925346ed9e3fa2b4679 Author: Namhyung Kim Date: Mon Dec 19 12:17:27 2022 -0800 perf lock contention: Factor out lock_type_table Move it out of get_type_str() so that we can reuse the table for others later. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221219201732.460111-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8b269b75551227796c1ddac2dbdb2ba504158c61 Author: Yang Jihong Date: Tue Dec 20 11:57:02 2022 +0800 perf probe: Check -v and -q options in the right place Check the -q and -v options first to return earlier on error. Before: # perf probe -q -v test probe-definition(0): test symbol:test file:(null) line:0 offset:0 return:0 lazy:(null) 0 arguments Error: -v and -q are exclusive. After: # perf probe -q -v test Error: -v and -q are exclusive. Fixes: 5e17b28f1e246b98 ("perf probe: Add --quiet option to suppress output result message") Reviewed-by: Adrian Hunter Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Andi Kleen Cc: Carsten Haitzler Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Masami Hiramatsu Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20221220035702.188413-4-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 7c0a6144f9a6a53b1cf2f78f09ca35d59d267f1e Author: Yang Jihong Date: Tue Dec 20 11:57:01 2022 +0800 perf tools: Fix usage of the verbose variable The data type of the verbose variable is integer and can be negative, replace improperly used cases in a unified manner: 1. if (verbose) => if (verbose > 0) 2. if (!verbose) => if (verbose <= 0) 3. if (XX && verbose) => if (XX && verbose > 0) 4. if (XX && !verbose) => if (XX && verbose <= 0) Reviewed-by: Adrian Hunter Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Andi Kleen Cc: Carsten Haitzler Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20221220035702.188413-3-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 188ac720d364035008a54d249cf47b4cc100f819 Author: Yang Jihong Date: Tue Dec 20 11:57:00 2022 +0800 perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() When perf uses quiet mode, perf_quiet_option() sets the 'debug_peo_args' variable to -1, and display_attr() incorrectly determines the value of 'debug_peo_args'. As a result, unexpected information is displayed. Before: # perf record --quiet -- ls > /dev/null ------------------------------------------------------------ perf_event_attr: size 128 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|PERIOD read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 freq 1 enable_on_exec 1 task 1 precise_ip 3 sample_id_all 1 exclude_guest 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 ------------------------------------------------------------ ... After: # perf record --quiet -- ls > /dev/null # redirect_to_stderr is a similar problem. Fixes: f78eaef0e0493f60 ("perf tools: Allow to force redirect pr_debug to stderr.") Fixes: ccd26741f5e6bdf2 ("perf tool: Provide an option to print perf_event_open args and return value") Suggested-by: Adrian Hunter Reviewed-by: Adrian Hunter Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Andi Kleen Cc: Carsten Haitzler Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: martin.lau@kernel.org Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20221220035702.188413-2-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit b235e5b51f7d557cf10cbb1245b6cdeb341e1e2b Author: Arnaldo Carvalho de Melo Date: Sun May 9 09:39:02 2021 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: 86bdf3ebcfe1ded0 ("KVM: Support dirty ring in conjunction with bitmap") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This is also by now used by tools/testing/selftests/kvm/, a simple test build didn't succeed, but for another reason: lib/kvm_util.c: In function ‘vm_enable_dirty_ring’: lib/kvm_util.c:125:30: error: ‘KVM_CAP_DIRTY_LOG_RING_ACQ_REL’ undeclared (first use in this function); did you mean ‘KVM_CAP_DIRTY_LOG_RING’? 125 | if (vm_check_cap(vm, KVM_CAP_DIRTY_LOG_RING_ACQ_REL)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | KVM_CAP_DIRTY_LOG_RING I'll send a separate patch for that. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: Gavin Shan Cc: Ian Rogers Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/Y6H3b1Q4Msjy5Yz3@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit afa6646b1c5d3affd541f76bd7476e4b835a9174 Author: Alex Deucher Date: Fri Dec 16 11:42:20 2022 -0500 drm/amdgpu: skip MES for S0ix as well since it's part of GFX It's also part of gfxoff. Cc: stable@vger.kernel.org # 6.0, 6.1 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit d118b18fb1da02b41df2da78cb2794b3638d89cd Author: Arnd Bergmann Date: Thu Dec 15 17:36:31 2022 +0100 drm/amd/pm: avoid large variable on kernel stack The activity_monitor_external[] array is too big to fit on the kernel stack, resulting in this warning with clang: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0_7_ppt.c:1438:12: error: stack frame size (1040) exceeds limit (1024) in 'smu_v13_0_7_get_power_profile_mode' [-Werror,-Wframe-larger-than] Use dynamic allocation instead. It should also be possible to have single element here instead of the array, but this seems easier. v2: fix up argument to sizeof() (Alex) Fixes: 334682ae8151 ("drm/amd/pm: enable workload type change on smu_v13_0_7") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 1a799c4c190ea9f0e81028e3eb3037ed0ab17ff5 Author: Philip Yang Date: Tue Dec 13 00:50:03 2022 -0500 drm/amdkfd: Fix double release compute pasid If kfd_process_device_init_vm returns failure after vm is converted to compute vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_file reference. As a result, drm close file handler maybe called to release the compute pasid before KFD process destroy worker to release the same pasid and set vm->pasid to zero, this generates below WARNING backtrace and NULL pointer access. Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step of kfd_process_device_init_vm, to ensure vm pasid is the original pasid if acquiring vm failed or is the compute pasid with pdd->drm_file reference taken to avoid double release same pasid. amdgpu: Failed to create process VM object ida_free called for id=32770 which is not allocated. WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140 RIP: 0010:ida_free+0x96/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:ida_free+0x76/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 29d48b87db64b6697ddad007548e51d032081c59 Author: Philip Yang Date: Wed Dec 14 10:15:17 2022 -0500 drm/amdkfd: Fix kfd_process_device_init_vm error handling Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid NULL pointer access in process destroy worker. BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu] kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu] kfd_process_destroy_pdds+0x71/0x190 [amdgpu] kfd_process_wq_release+0x2a2/0x3b0 [amdgpu] process_one_work+0x2a1/0x600 worker_thread+0x39/0x3d0 Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit a6b9d2fa0024e7e399c26facd0fb466b7396e2b9 Author: Olga Kornievskaia Date: Tue Dec 20 12:31:29 2022 -0500 pNFS/filelayout: Fix coalescing test for single DS When there is a single DS no striping constraints need to be placed on the IO. When such constraint is applied then buffered reads don't coalesce to the DS's rsize. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 6d5edd15c982b4e3768919776422ba8f01388be3 Author: Arnaldo Carvalho de Melo Date: Wed Sep 8 16:09:08 2021 -0300 tools headers UAPI: Sync powerpc syscall table with the kernel sources To pick the changes in these csets: ce883a2ba310cd7c ("powerpc/32: fix syscall wrappers with 64-bit arguments") That doesn't cause any changes in the perf tools. This table is used in tools perf to allow features as described in the last update to this file. This addresses this perf build warning: Warning: Kernel ABI header at 'tools/perf/arch/powerpc/entry/syscalls/syscall.tbl' differs from latest version at 'arch/powerpc/kernel/syscalls/syscall.tbl' diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl Cc: Adrian Hunter Cc: Andreas Schwab Cc: Ian Rogers Cc: Jiri Olsa Cc: Michael Ellerman Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/Y6H0C5plZ4V4aiPm@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a66558dcb1079c198ab0f56896195a353dae4428 Author: Arnaldo Carvalho de Melo Date: Fri Aug 7 08:45:47 2020 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes in: 97fa21f65c3eb5bb ("x86/resctrl: Move MSR defines into msr-index.h") 7420ae3bb977b46e ("x86/intel_epb: Set Alder Lake N and Raptor Lake P normal EPB") Addressing these tools/perf build warnings: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2022-12-20 14:28:40.893794072 -0300 +++ after 2022-12-20 14:28:54.831993914 -0300 @@ -266,6 +266,7 @@ [0xc0000104 - x86_64_specific_MSRs_offset] = "AMD64_TSC_RATIO", [0xc000010e - x86_64_specific_MSRs_offset] = "AMD64_LBR_SELECT", [0xc000010f - x86_64_specific_MSRs_offset] = "AMD_DBG_EXTN_CFG", + [0xc0000200 - x86_64_specific_MSRs_offset] = "IA32_MBA_BW_BASE", [0xc0000300 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS", [0xc0000301 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_CTL", [0xc0000302 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_CLR", $ Now one can trace systemwide asking to see backtraces to where that MSR is being read/written, see this example with a previous update: # perf trace -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" ^C# If we use -v (verbose mode) we can see what it does behind the scenes: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" Using CPUID AuthenticAMD-25-21-0 0x6a0 0x6a8 New filter for msr:read_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) 0x6a0 0x6a8 New filter for msr:write_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) mmap size 528384B ^C# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Cc: Adrian Hunter Cc: Borislav Petkov Cc: Dave Hansen Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Srinivas Pandruvada Link: https://lore.kernel.org/lkml/Y6HyTOGRNvKfCVe4@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit eeac18e2bff3e1f62f59059d34c37e75f350a119 Author: Arnaldo Carvalho de Melo Date: Tue Dec 20 14:16:01 2022 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick up the changes in: bc7ed4d30815bc43 ("drm/i915/perf: Apply Wa_18013179988") 81d5f7d91492aa3a ("drm/i915/perf: Add 32-bit OAG and OAR formats for DG2") 8133a6daad4e7274 ("drm/i915: enable PS64 support for DG2") b76c14c8fb2af1e4 ("drm/i915/huc: better define HuC status getparam possible return values.") 94dfc73e7cf4a31d ("treewide: uapi: Replace zero-length arrays with flexible-array members") That doesn't add any ioctl, so no changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Adrian Hunter Cc: Daniele Ceraolo Spurio Cc: Gustavo A. R. Silva Cc: Ian Rogers Cc: Jiri Olsa Cc: John Harrison Cc: Matthew Auld Cc: Namhyung Kim Cc: Umesh Nerlige Ramappa Link: https://lore.kernel.org/lkml/Y6HukoRaZh2R4j5U@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bfa87ac86ce9ff879c5ac49bf09c3999859a8968 Author: Alessandro Carminati Date: Tue Nov 22 18:36:48 2022 +0100 rv/monitors: Move monitor structure in rodata It makes sense to move the important monitor structure into rodata to prevent accidental structure modification. Link: https://lkml.kernel.org/r/20221122173648.4732-1-acarmina@redhat.com Signed-off-by: Alessandro Carminati Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit b6bb9676f2165d518b35ba3bea5f1fcfc0d969bf Merge: 32d528c4b8851 af5d74e32eb8e Author: Linus Torvalds Date: Tue Dec 20 08:56:35 2022 -0600 Merge tag 'm68knommu-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu update from Greg Ungerer: "Only a single change to use the safer strscpy() instead of strncpy() when setting up the cmdline" * tag 'm68knommu-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: use strscpy() to instead of strncpy() commit 32d528c4b885108694f613406d9f39fa4873bd37 Merge: 3e0caea754543 6cad1ecd4e321 Author: Linus Torvalds Date: Tue Dec 20 08:53:16 2022 -0600 Merge tag 'spdx-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX/License additions from Greg KH: "Here are two small updates for LICENSES and some kernel files that add the Copyleft-next license and use it in a SPDX tag as a dual-license for some kernel files. These have been discussed thoroughly in public on the linux-spdx mailing list, and have the needed acks on them, as well as having been in linux-next with no reported issues for quite some time" * tag 'spdx-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: testing: use the copyleft-next-0.3.1 SPDX tag LICENSES: Add the copyleft-next-0.3.1 license commit 3e0caea7545430a530bec19bb0de6c1c56c04924 Merge: 35f79d0e2c98f 3367934dd3035 Author: Linus Torvalds Date: Tue Dec 20 08:48:24 2022 -0600 Merge tag 'devicetree-for-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull more devicetree updates from Rob Herring: "This is mostly a treewide clean-up from Krzysztof. There's also a couple of fixes and things that fell thru the cracks. I must say this has been a nice merge window without bindings dumped in at the last minute introducing warnings. Summary: - Treewide dropping of redundant 'binding' or 'schema' from schema titles. This will be followed up with a automated check to catch these. - Re-sort vendor-prefies - Convert GPIO based watchdog to schema - Handle all the variations for clocks, resets, power domains in i.MX PCIe binding - Document missing 'power-domains' property in mxsfb - Fix error with path references in Tegra XUSB example - Honor CONFIG_CMDLINE* even without /chosen node" * tag 'devicetree-for-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: drop redundant part of title (manual) dt-bindings: clock: drop redundant part of title dt-bindings: drop redundant part of title (beginning) dt-bindings: drop redundant part of title (end, part three) dt-bindings: drop redundant part of title (end, part two) dt-bindings: drop redundant part of title (end) dt-bindings: clock: st,stm32mp1-rcc: add proper title dt-bindings: memory-controllers: ti,gpmc-child: drop redundant part of title dt-bindings: drop redundant part of title of shared bindings dt-bindings: watchdog: gpio: Convert bindings to YAML dt-bindings: imx6q-pcie: Handle more resets on legacy platforms dt-bindings: imx6q-pcie: Handle various PD configurations dt-bindings: imx6q-pcie: Handle various clock configurations dt-bindings: hwmon: ntc-thermistor: drop Naveen Krishna Chatradhi from maintainers dt-bindings: mxsfb: Document i.MX8M/i.MX6SX/i.MX6SL power-domains property dt-bindings: vendor-prefixes: sort entries alphabetically dt-bindings: usb: tegra-xusb: Remove path references of: fdt: Honor CONFIG_CMDLINE* even without /chosen node commit 35f79d0e2c98ff6ecb9b5fc33113158dc7f7353c Merge: 70b07bec95b6d 4934fbfb3ff09 Author: Linus Torvalds Date: Tue Dec 20 08:43:53 2022 -0600 Merge tag 'parisc-for-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "There is one noteable patch, which allows the parisc kernel to use the same MADV_xxx constants as the other architectures going forward. With that change only alpha has one entry left (MADV_DONTNEED is 6 vs 4 on others) which is different. To prevent an ABI breakage, a wrapper is included which translates old MADV values to the new ones, so existing userspace isn't affected. Reason for that patch is, that some applications wrongly used the standard MADV_xxx values even on some non-x86 platforms and as such those programs failed to run correctly on parisc (examples are qemu-user, tor browser and boringssl). Then the kgdb console and the LED code received some fixes, and some 0-day warnings are now gone. Finally, the very last compile warning which was visible during a kernel build is now fixed too (in the vDSO code). The majority of the patches are tagged for stable series and in summary this patchset is quite small and drops more code than it adds: Fixes: - Fix potential null-ptr-deref in start_task() - Fix kgdb console on serial port - Add missing FORCE prerequisites in Makefile - Drop PMD_SHIFT from calculation in pgtable.h Enhancements: - Implement a wrapper to align madvise() MADV_* constants with other architectures - If machine supports running MPE/XL, show the MPE model string Cleanups: - Drop duplicate kgdb console code - Indenting fixes in setup_cmdline()" * tag 'parisc-for-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Show MPE/iX model string at bootup parisc: Add missing FORCE prerequisites in Makefile parisc: Move pdc_result struct to firmware.c parisc: Drop locking in pdc console code parisc: Drop duplicate kgdb_pdc console parisc: Fix locking in pdc_iodc_print() firmware call parisc: Drop PMD_SHIFT from calculation in pgtable.h parisc: Align parisc MADV_XXX constants with all other architectures parisc: led: Fix potential null-ptr-deref in start_task() parisc: Fix inconsistent indenting in setup_cmdline() commit 54f27dc53f1764986d417cfafe1013806deba668 Author: José Expósito Date: Mon Nov 28 17:55:24 2022 +0100 HID: sony: Fix unused function warning Compiling this driver without setting "CONFIG_SONY_FF" generates the following warning: drivers/hid/hid-sony.c:2358:20: warning: unused function 'sony_send_output_report' [-Wunused-function] static inline void sony_send_output_report(struct sony_sc *sc) ^ 1 warning generated. Add the missing preprocessor check to fix it. Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit 3d57f36c89d8ba32b2c312f397a37fd1a2dc7cfc Author: Terry Junge Date: Thu Dec 8 15:05:06 2022 -0800 HID: plantronics: Additional PIDs for double volume key presses quirk I no longer work for Plantronics (aka Poly, aka HP) and do not have access to the headsets in order to test. However, as noted by Maxim, the other 32xx models that share the same base code set as the 3220 would need the same quirk. This patch adds the PIDs for the rest of the Blackwire 32XX product family that require the quirk. Plantronics Blackwire 3210 Series (047f:c055) Plantronics Blackwire 3215 Series (047f:c057) Plantronics Blackwire 3225 Series (047f:c058) Quote from previous patch by Maxim Mikityanskiy Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice for each volume key press. This patch adds a quirk to hid-plantronics for this product ID, which will ignore the second volume key press if it happens within 5 ms from the last one that was handled. The patch was tested on the mentioned model only, it shouldn't affect other models, however, this quirk might be needed for them too. Auto-repeat (when a key is held pressed) is not affected, because the rate is about 3 times per second, which is far less frequent than once in 5 ms. End quote Signed-off-by: Terry Junge Signed-off-by: Jiri Kosina commit 4eab1c2fe06c98a4dff258dd64800b6986c101e9 Author: José Expósito Date: Mon Nov 28 17:57:05 2022 +0100 HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint The HID descriptor of this device contains two mouse collections, one for mouse emulation and the other for the trackpoint. Both collections get merged and, because the first one defines X and Y, the movemenent events reported by the trackpoint collection are ignored. Set the MT_CLS_WIN_8_FORCE_MULTI_INPUT class for this device to be able to receive its reports. This fix is similar to/based on commit 40d5bb87377a ("HID: multitouch: enable multi-input as a quirk for some devices"). Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/825 Reported-by: Akito Tested-by: Akito Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit cec827d658dd5c287ea8925737d45f0a60e47422 Author: José Expósito Date: Thu Nov 24 18:49:32 2022 +0100 HID: Ignore HP Envy x360 eu0009nv stylus battery Battery status is reported for the HP Envy x360 eu0009nv stylus even though it does not have battery. Prevent it from always reporting the battery as low (1%). Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/823 Reported-by: Ioannis Iliopoulos Tested-by: Ioannis Iliopoulos Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit 70b07bec95b6d369f68fb85bc3fe60c423d8b91b Merge: 850f7a5cab331 32975c491ee41 Author: Linus Torvalds Date: Tue Dec 20 08:32:11 2022 -0600 Merge tag 'asm-generic-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "There are only three fairly simple patches. The #include change to linux/swab.h addresses a userspace build issue, and the change to the mmio tracing logic helps provide more useful traces" * tag 'asm-generic-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: uapi: Add missing _UAPI prefix to include guard asm-generic/io: Add _RET_IP_ to MMIO trace for more accurate debug info include/uapi/linux/swab: Fix potentially missing __always_inline commit 1db1f392591aff13fd643f0ec7c1d5e27391d700 Author: Jason Gerecke Date: Thu Dec 1 15:11:41 2022 -0800 HID: wacom: Ensure bootloader PID is usable in hidraw mode Some Wacom devices have a special "bootloader" mode that is used for firmware flashing. When operating in this mode, the device cannot be used for input, and the HID descriptor is not able to be processed by the driver. The driver generates an "Unknown device_type" warning and then returns an error code from wacom_probe(). This is a problem because userspace still needs to be able to interact with the device via hidraw to perform the firmware flash. This commit adds a non-generic device definition for 056a:0094 which is used when devices are in "bootloader" mode. It marks the devices with a special BOOTLOADER type that is recognized by wacom_probe() and wacom_raw_event(). When we see this type we ensure a hidraw device is created and otherwise keep our hands off so that userspace is in full control. Signed-off-by: Jason Gerecke Tested-by: Tatsunosuke Tobita Cc: Signed-off-by: Jiri Kosina commit b7dc753fe33a707379e2254317794a4dad6c0fe2 Author: Arnd Bergmann Date: Thu Dec 15 17:55:42 2022 +0100 wifi: ath9k: use proper statements in conditionals A previous cleanup patch accidentally broke some conditional expressions by replacing the safe "do {} while (0)" constructs with empty macros. gcc points this out when extra warnings are enabled: drivers/net/wireless/ath/ath9k/hif_usb.c: In function 'ath9k_skb_queue_complete': drivers/net/wireless/ath/ath9k/hif_usb.c:251:57: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 251 | TX_STAT_INC(hif_dev, skb_failed); Make both sets of macros proper expressions again. Fixes: d7fc76039b74 ("ath9k: htc: clean up statistics macros") Signed-off-by: Arnd Bergmann Acked-by: Toke Høiland-Jørgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221215165553.1950307-1-arnd@kernel.org commit 37fc9ad1617a303bbfd28870eb25aaa4766e79ab Author: Arnd Bergmann Date: Thu Dec 15 17:31:10 2022 +0100 wifi: mt76: mt7996: select CONFIG_RELAY Without CONFIG_RELAY, the driver fails to link: ERROR: modpost: "relay_flush" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_switch_subbuf" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_open" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_reset" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_file_operations" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! The same change was done in mt7915 for the corresponding copy of the code. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") See-also: 988845c9361a ("mt76: mt7915: add support for passing chip/firmware debug data to user space") Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221215163133.4152299-1-arnd@kernel.org commit 1c4c0b28b517d778d37900deedfe91088839f07a Author: Johannes Berg Date: Tue Dec 13 23:15:04 2022 +0200 wifi: iwlwifi: fw: skip PPAG for JF For JF RFs we don't support PPAG, but many firmware images lie about it. Always skip support for JF to avoid firmware errors when sending the command. Reported-and-tested-by: Íñigo Huguet Link: https://lore.kernel.org/linux-wireless/CACT4oufQsqHGp6bah2c4+jPn2wG1oZqY=UKa_TmPx=F6Lxng8Q@mail.gmail.com Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221213225723.2a43415d8990.I9ac210740a45b41f1b2e15274e1daf4284f2808a@changeid commit 53ffa6a9f83b2170c60591da1ead8791d5a42e81 Author: Jiasheng Jiang Date: Tue Dec 20 10:49:21 2022 +0800 HID: amd_sfh: Add missing check for dma_alloc_coherent Add check for the return value of the dma_alloc_coherent since it may return NULL pointer if allocation fails. Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)") Signed-off-by: Jiasheng Jiang Acked-by: Basavaraj Natikar Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221220024921.21992-1-jiasheng@iscas.ac.cn commit 38624d2c972e7692ca59d0d3b97741a3313addb3 Merge: 5504eb164eecd ad0fca2dceeab Author: Dave Airlie Date: Tue Dec 20 15:43:06 2022 +1000 Merge tag 'drm-intel-next-fixes-2022-12-15' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Documentation fixe (Matt, Miaoqian) - OA-perf related fix (Umesh) - VLV/CHV HDMI/DP audio fix (Ville) - Display DDI/Transcoder fix (Khaled) - Migrate fixes (Chris, Matt) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y5uFYOJ/1jgf2eSE@intel.com commit 5504eb164eecdcc1fcb7d7a3d05c29b3bbbcfa78 Merge: 66efff515a650 7a18e089eff02 Author: Dave Airlie Date: Tue Dec 20 15:21:18 2022 +1000 Merge tag 'amd-drm-fixes-6.2-2022-12-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.2-2022-12-15: amdgpu: - Spelling fix - BO pin fix - Properly handle polaris 10/11 overlap asics - GMC9 fix - SR-IOV suspend fix - DCN 3.1.4 fix - KFD userptr locking fix - SMU13.x fixes - GDS/GWS/OA handling fix - Reserved VMID handling fixes - FRU EEPROM fix - BO validation fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20221215224936.6438-1-alexander.deucher@amd.com commit 3c202d14a9d73fb63c3dccb18feac5618c21e1c4 Author: Jason A. Donenfeld Date: Sun Oct 9 20:45:07 2022 -0600 prandom: remove prandom_u32_max() Convert the final two users of prandom_u32_max() that slipped in during 6.2-rc1 to use get_random_u32_below(). Then, with no more users left, we can finally remove the deprecated function. Signed-off-by: Jason A. Donenfeld commit 41a15855c1ee390a0ae9d0c29d32b451dd30a600 Author: Johan Hovold Date: Fri Dec 16 10:15:14 2022 +0100 efi: random: fix NULL-deref when refreshing seed Do not try to refresh the RNG seed in case the firmware does not support setting variables. This is specifically needed to prevent a NULL-pointer dereference on the Lenovo X13s with some firmware revisions, or more generally, whenever the runtime services have been disabled (e.g. efi=noruntime or with PREEMPT_RT). Fixes: e7b813b32a42 ("efi: random: refresh non-volatile random seed when RNG is initialized") Reported-by: Steev Klimaszewski Reported-by: Bjorn Andersson Tested-by: Steev Klimaszewski Tested-by: Andrew Halaney # sc8280xp-lenovo-thinkpad-x13s Signed-off-by: Johan Hovold Signed-off-by: Jason A. Donenfeld commit 6bb20c152b6bf7dd8ffb248f33c2593fd9aeb318 Author: Jason A. Donenfeld Date: Sat Oct 29 01:42:02 2022 +0200 random: do not include from random.h The header is a random.c private detail, not something to be called by other code. As such, don't make it automatically available by way of random.h. Cc: Michael Ellerman Acked-by: Heiko Carstens Reviewed-by: Christophe Leroy Signed-off-by: Jason A. Donenfeld commit 4be84df38a6f49b81e5909ede78242ba1538c1e6 Merge: 918fb1aaa2581 f006229135b7d Author: Jakub Kicinski Date: Mon Dec 19 17:47:59 2022 -0800 Merge tag 'linux-can-fixes-for-6.2-20221219' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2022-12-19 The first patch is by Vincent Mailhol and adds the etas_es58x devlink documentation to the index. Haibo Chen's patch for the flexcan driver fixes a unbalanced pm_runtime_enable warning. The last patch is by me, targets the kvaser_usb driver and fixes an error occurring with gcc-13. * tag 'linux-can-fixes-for-6.2-20221219' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len can: flexcan: avoid unbalanced pm_runtime_enable warning Documentation: devlink: add missing toc entry for etas_es58x devlink doc ==================== Link: https://lore.kernel.org/r/20221219155210.1143439-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 918fb1aaa25812a277ab469679df17f45ce92313 Merge: b389a902dd5be 08f65892c5ee1 Author: Jakub Kicinski Date: Mon Dec 19 17:28:51 2022 -0800 Merge branch 'stop-corrupting-socket-s-task_frag' Benjamin Coddington says: ==================== Stop corrupting socket's task_frag The networking code uses flags in sk_allocation to determine if it can use current->task_frag, however in-kernel users of sockets may stop setting sk_allocation when they convert to the preferred memalloc_nofs_save/restore, as SUNRPC has done in commit a1231fda7e94 ("SUNRPC: Set memalloc_nofs_save() on all rpciod/xprtiod jobs"). This will cause corruption in current->task_frag when recursing into the network layer for those subsystems during page fault or reclaim. The corruption is difficult to diagnose because stack traces may not contain the offending subsystem at all. The corruption is unlikely to show up in testing because it requires memory pressure, and so subsystems that convert to memalloc_nofs_save/restore are likely to continue to run into this issue. Previous reports and proposed fixes: https://lore.kernel.org/netdev/96a18bd00cbc6cb554603cc0d6ef1c551965b078.1663762494.git.gnault@redhat.com/ https://lore.kernel.org/netdev/b4d8cb09c913d3e34f853736f3f5628abfd7f4b6.1656699567.git.gnault@redhat.com/ https://lore.kernel.org/linux-nfs/de6d99321d1dcaa2ad456b92b3680aa77c07a747.1665401788.git.gnault@redhat.com/ Guilluame Nault has done all of the hard work tracking this problem down and finding the best fix for this issue. I'm just taking a turn posting another fix. ==================== Link: https://lore.kernel.org/r/cover.1671194454.git.bcodding@redhat.com Signed-off-by: Jakub Kicinski commit 08f65892c5ee15806dce7259e06c384b8cd768d7 Author: Benjamin Coddington Date: Fri Dec 16 07:45:28 2022 -0500 net: simplify sk_page_frag Now that in-kernel socket users that may recurse during reclaim have benn converted to sk_use_task_frag = false, we can have sk_page_frag() simply check that value. Signed-off-by: Benjamin Coddington Reviewed-by: Guillaume Nault Signed-off-by: Jakub Kicinski commit 98123866fcf3fe95a0c1b198ef122dfdbd351916 Author: Benjamin Coddington Date: Fri Dec 16 07:45:27 2022 -0500 Treewide: Stop corrupting socket's task_frag Since moving to memalloc_nofs_save/restore, SUNRPC has stopped setting the GFP_NOIO flag on sk_allocation which the networking system uses to decide when it is safe to use current->task_frag. The results of this are unexpected corruption in task_frag when SUNRPC is involved in memory reclaim. The corruption can be seen in crashes, but the root cause is often difficult to ascertain as a crashing machine's stack trace will have no evidence of being near NFS or SUNRPC code. I believe this problem to be much more pervasive than reports to the community may indicate. Fix this by having kernel users of sockets that may corrupt task_frag due to reclaim set sk_use_task_frag = false. Preemptively correcting this situation for users that still set sk_allocation allows them to convert to memalloc_nofs_save/restore without the same unexpected corruptions that are sure to follow, unlikely to show up in testing, and difficult to bisect. CC: Philipp Reisner CC: Lars Ellenberg CC: "Christoph Böhmwalder" CC: Jens Axboe CC: Josef Bacik CC: Keith Busch CC: Christoph Hellwig CC: Sagi Grimberg CC: Lee Duncan CC: Chris Leech CC: Mike Christie CC: "James E.J. Bottomley" CC: "Martin K. Petersen" CC: Valentina Manea CC: Shuah Khan CC: Greg Kroah-Hartman CC: David Howells CC: Marc Dionne CC: Steve French CC: Christine Caulfield CC: David Teigland CC: Mark Fasheh CC: Joel Becker CC: Joseph Qi CC: Eric Van Hensbergen CC: Latchesar Ionkov CC: Dominique Martinet CC: Ilya Dryomov CC: Xiubo Li CC: Chuck Lever CC: Jeff Layton CC: Trond Myklebust CC: Anna Schumaker CC: Steffen Klassert CC: Herbert Xu Suggested-by: Guillaume Nault Signed-off-by: Benjamin Coddington Reviewed-by: Guillaume Nault Signed-off-by: Jakub Kicinski commit fb87bd47516d9a26b6d549231aa743b20fd4a569 Author: Guillaume Nault Date: Fri Dec 16 07:45:26 2022 -0500 net: Introduce sk_use_task_frag in struct sock. Sockets that can be used while recursing into memory reclaim, like those used by network block devices and file systems, mustn't use current->task_frag: if the current process is already using it, then the inner memory reclaim call would corrupt the task_frag structure. To avoid this, sk_page_frag() uses ->sk_allocation to detect sockets that mustn't use current->task_frag, assuming that those used during memory reclaim had their allocation constraints reflected in ->sk_allocation. This unfortunately doesn't cover all cases: in an attempt to remove all usage of GFP_NOFS and GFP_NOIO, sunrpc stopped setting these flags in ->sk_allocation, and used memalloc_nofs critical sections instead. This breaks the sk_page_frag() heuristic since the allocation constraints are now stored in current->flags, which sk_page_frag() can't read without risking triggering a cache miss and slowing down TCP's fast path. This patch creates a new field in struct sock, named sk_use_task_frag, which sockets with memory reclaim constraints can set to false if they can't safely use current->task_frag. In such cases, sk_page_frag() now always returns the socket's page_frag (->sk_frag). The first user is sunrpc, which needs to avoid using current->task_frag but can keep ->sk_allocation set to GFP_KERNEL otherwise. Eventually, it might be possible to simplify sk_page_frag() by only testing ->sk_use_task_frag and avoid relying on the ->sk_allocation heuristic entirely (assuming other sockets will set ->sk_use_task_frag according to their constraints in the future). The new ->sk_use_task_frag field is placed in a hole in struct sock and belongs to a cache line shared with ->sk_shutdown. Therefore it should be hot and shouldn't have negative performance impacts on TCP's fast path (sk_shutdown is tested just before the while() loop in tcp_sendmsg_locked()). Link: https://lore.kernel.org/netdev/b4d8cb09c913d3e34f853736f3f5628abfd7f4b6.1656699567.git.gnault@redhat.com/ Signed-off-by: Guillaume Nault Reviewed-by: Benjamin Coddington Signed-off-by: Jakub Kicinski commit b389a902dd5be4ece505a2e0463b9b034de04bf5 Author: Matt Johnston Date: Thu Dec 15 13:49:33 2022 +0800 mctp: Remove device type check at unregister The unregister check could be incorrectly triggered if a netdev changes its type after register. That is possible for a tun device using TUNSETLINK ioctl, resulting in mctp unregister failing and the netdev unregister waiting forever. This was encountered by https://github.com/openthread/openthread/issues/8523 Neither check at register or unregister is required. They were added in an attempt to track down mctp_ptr being set unexpectedly, which should not happen in normal operation. Fixes: 7b1871af75f3 ("mctp: Warn if pointer is set for a wrong dev type") Signed-off-by: Matt Johnston Link: https://lore.kernel.org/r/20221215054933.2403401-1-matt@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 62e027fb0e5293d95e8d36655757ef4687c8795d Author: Arun Ramadoss Date: Tue Dec 13 15:44:40 2022 +0530 net: dsa: microchip: remove IRQF_TRIGGER_FALLING in request_threaded_irq KSZ swithes used interrupts for detecting the phy link up and down. During registering the interrupt handler, it used IRQF_TRIGGER_FALLING flag. But this flag has to be retrieved from device tree instead of hard coding in the driver, so removing the flag. Fixes: ff319a644829 ("net: dsa: microchip: move interrupt handling logic from lan937x to ksz_common") Reported-by: Christian Eggers Signed-off-by: Arun Ramadoss Link: https://lore.kernel.org/r/20221213101440.24667-1-arun.ramadoss@microchip.com Signed-off-by: Jakub Kicinski commit 850f7a5cab3314fb26547d636893eb55b4c5527a Merge: 6feb57c2fd7c7 6f85602d5fdea Author: Linus Torvalds Date: Mon Dec 19 16:07:59 2022 -0600 Merge tag 'soc-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "These are a couple of build fixes from randconfig testing, plus a set of Mediatek SoC specific fixes, all trivial" * tag 'soc-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: soc: tegra: fix CPU_BIG_ENDIAN dependencies ARM: disallow pre-ARMv5 builds with ld.lld ARM: pxa: fix building with clang MAINTAINERS: add related dts to IXP4xx ARM: dts: spear: drop 0x from unit address arm64: dts: mt8183: Fix Mali GPU clock arm64: dts: mediatek: mt8195-demo: fix the memory size of node secmon soc: mediatek: pm-domains: Fix the power glitch issue commit cc074822465d18a2d39e0b3e2b48b6766a568db2 Author: Hou Tao Date: Sat Dec 17 14:21:44 2022 +0800 bpf: Define sock security related BTF IDs under CONFIG_SECURITY_NETWORK There are warnings reported from resolve_btfids when building vmlinux with CONFIG_SECURITY_NETWORK disabled: WARN: resolve_btfids: unresolved symbol bpf_lsm_sk_free_security WARN: resolve_btfids: unresolved symbol bpf_lsm_sk_alloc_security So only define BTF IDs for these LSM hooks when CONFIG_SECURITY_NETWORK is enabled. Fixes: c0c852dd1876 ("bpf: Do not mark certain LSM hook arguments as trusted") Signed-off-by: Hou Tao Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20221217062144.2507222-1-houtao@huaweicloud.com commit 6feb57c2fd7c787aecf2846a535248899e7b70fa Merge: 158738ea75059 731c4eac848ff Author: Linus Torvalds Date: Mon Dec 19 12:33:32 2022 -0600 Merge tag 'kbuild-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Support zstd-compressed debug info - Allow W=1 builds to detect objects shared among multiple modules - Add srcrpm-pkg target to generate a source RPM package - Make the -s option detection work for future GNU Make versions - Add -Werror to KBUILD_CPPFLAGS when CONFIG_WERROR=y - Allow W=1 builds to detect -Wundef warnings in any preprocessed files - Raise the minimum supported version of binutils to 2.25 - Use $(intcmp ...) to compare integers if GNU Make >= 4.4 is used - Use $(file ...) to read a file if GNU Make >= 4.2 is used - Print error if GNU Make older than 3.82 is used - Allow modpost to detect section mismatches with Clang LTO - Include vmlinuz.efi into kernel tarballs for arm64 CONFIG_EFI_ZBOOT=y * tag 'kbuild-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (29 commits) buildtar: fix tarballs with EFI_ZBOOT enabled modpost: Include '.text.*' in TEXT_SECTIONS padata: Mark padata_work_init() as __ref kbuild: ensure Make >= 3.82 is used kbuild: refactor the prerequisites of the modpost rule kbuild: change module.order to list *.o instead of *.ko kbuild: use .NOTINTERMEDIATE for future GNU Make versions kconfig: refactor Makefile to reduce process forks kbuild: add read-file macro kbuild: do not sort after reading modules.order kbuild: add test-{ge,gt,le,lt} macros Documentation: raise minimum supported version of binutils to 2.25 kbuild: add -Wundef to KBUILD_CPPFLAGS for W=1 builds kbuild: move -Werror from KBUILD_CFLAGS to KBUILD_CPPFLAGS kbuild: Port silent mode detection to future gnu make. init/version.c: remove #include firmware_loader: remove #include modpost: Mark uuid_le type to be suitable only for MEI kbuild: add ability to make source rpm buildable using koji kbuild: warn objects shared among multiple modules ... commit 158738ea75059fb4ddf812e2cb9fe1ff6e22bc70 Merge: aeba12b26c79f 70d822cfb782e Author: Linus Torvalds Date: Mon Dec 19 12:26:03 2022 -0600 Merge tag 'zstd-linus-v6.2' of https://github.com/terrelln/linux Pull zstd updates from Nick Terrell: "Update the kernel to upstream zstd v1.5.2 [0]. Specifically to the tag v1.5.2-kernel [1] which includes several cherrypicked fixes for the kernel on top of v1.5.2. Excepting the MAINTAINERS change, all the changes in this can be generated by: git clone https://github.com/facebook/zstd cd zstd/contrib/linux-kernel git checkout v1.5.2-kernel LINUX=/path/to/linux/repo make import Additionally, this includes several minor typo fixes, which have all been fixed upstream so they are maintained on the next import" Link: https://github.com/facebook/zstd/releases/tag/v1.5.2 [0] Link: https://github.com/facebook/zstd/tree/v1.5.2-kernel [1] Link: https://lore.kernel.org/lkml/20221024202606.404049-1-nickrterrell@gmail.com/ Link: https://github.com/torvalds/linux/commit/637a642f5ca5e850186bb64ac75ebb0f124b458d * tag 'zstd-linus-v6.2' of https://github.com/terrelln/linux: zstd: import usptream v1.5.2 zstd: Move zstd-common module exports to zstd_common_module.c lib: zstd: Fix comment typo lib: zstd: fix repeated words in comments MAINTAINERS: git://github -> https://github.com for terrelln lib: zstd: clean up double word in comment. commit 5ad70eb27d2b87ec722fedd23638354be37ea0b0 Author: Ammar Faizi Date: Mon Dec 19 23:45:21 2022 +0700 MAINTAINERS: io_uring: Add include/trace/events/io_uring.h This header file was introduced in commit c826bd7a743f ("io_uring: add set of tracing events"). It didn't get added to the io_uring maintainers section. Add this header file to the io_uring maintainers section. Signed-off-by: Ammar Faizi Link: https://lore.kernel.org/r/20221219164521.2481728-1-ammar.faizi@intel.com Signed-off-by: Jens Axboe commit 6f85602d5fdea936077060ca6853587f01716a45 Merge: b9cb6be06b56f dba8eb83af9dd Author: Arnd Bergmann Date: Mon Dec 19 16:47:40 2022 +0100 Merge tag 'v6.1-soc-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into arm/fixes PM domains: enable isolation before resetting power * tag 'v6.1-soc-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: soc: mediatek: pm-domains: Fix the power glitch issue Link: https://lore.kernel.org/r/29c8b913-53cf-096f-fe44-832ceaeac116@suse.com Signed-off-by: Arnd Bergmann commit b9cb6be06b56f9ad73072c2728138fb339da7d32 Merge: ba4b4d0293ed1 ad2631b5645a1 Author: Arnd Bergmann Date: Mon Dec 19 16:47:18 2022 +0100 Merge tag 'v6.1-dts64-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into arm/fixes MT8183: fix phandle for GPU clock MT8195 demo: fix size of secmon reserved memory area * tag 'v6.1-dts64-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: arm64: dts: mt8183: Fix Mali GPU clock arm64: dts: mediatek: mt8195-demo: fix the memory size of node secmon Link: https://lore.kernel.org/r/af4c45ce-a150-438f-dab4-e47b120c32c4@suse.com Signed-off-by: Arnd Bergmann commit ba4b4d0293ed12ec2eda09e0329d9831243ca699 Author: Arnd Bergmann Date: Thu Dec 15 17:53:21 2022 +0100 soc: tegra: fix CPU_BIG_ENDIAN dependencies My previous patch to prevent BPMP from being enabled on big endian kernels caused a build regression: WARNING: unmet direct dependencies detected for TEGRA_BPMP Depends on [n]: ARCH_TEGRA [=y] && TEGRA_HSP_MBOX [=y] && TEGRA_IVC [=y] && !CPU_BIG_ENDIAN [=y] Selected by [y]: - ARCH_TEGRA_186_SOC [=y] && ARCH_TEGRA [=y] && ARM64 [=y] - ARCH_TEGRA_194_SOC [=y] && ARCH_TEGRA [=y] && ARM64 [=y] - ARCH_TEGRA_234_SOC [=y] && ARCH_TEGRA [=y] && ARM64 [=y] Add even more such dependencies for the SoC types that use the BPMP driver. Fixes: 4ddb1bf1a837 ("tegra: mark BPMP driver as little-endian only") Signed-off-by: Arnd Bergmann Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20221215165336.1781080-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit 6a7ee50f8f56dc181e1150cc101896053b02d220 Author: Arnd Bergmann Date: Thu Dec 15 17:26:20 2022 +0100 ARM: disallow pre-ARMv5 builds with ld.lld lld cannot build for ARMv4/v4T targets because it inserts 'blx' instructions that are unsupported there: ld.lld: warning: lld uses blx instruction, no object with architecture supporting feature detected Add a Kconfig time dependency to prevent those targets from being selected in randconfig builds. Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Link: https://github.com/llvm/llvm-project/issues/50764 Link: https://github.com/ClangBuiltLinux/linux/issues/964 Link: https://lore.kernel.org/r/20221215162635.3750763-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit 43a3ce77aee917ac3b247e925853646fac4c05a6 Author: Arnaldo Carvalho de Melo Date: Thu Dec 17 14:58:51 2020 -0300 tools headers UAPI: Sync linux/fscrypt.h with the kernel sources To pick the changes from: f8b435f93b7630af ("fscrypt: remove unused Speck definitions") e0cefada1383c5ce ("fscrypt: Add SM4 XTS/CTS symmetric algorithm support") That don't result in any changes in tooling, just causes this to be rebuilt: CC /tmp/build/perf-urgent/trace/beauty/sync_file_range.o LD /tmp/build/perf-urgent/trace/beauty/perf-in.o addressing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fscrypt.h' differs from latest version at 'include/uapi/linux/fscrypt.h' diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h Cc: Adrian Hunter Cc: Eric Biggers Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Tianjia Zhang Link: https://lore.kernel.org/lkml/Y6CHSS6Rn9YOqpAd@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4b88615950fc805690b92b46c8ab794beb4bd6aa Author: Arnd Bergmann Date: Thu Dec 15 17:25:14 2022 +0100 ARM: pxa: fix building with clang The integrated assembler in clang does not understand the xscale specific mra/mar instructions: arch/arm/mach-pxa/pxa27x.c:136:15: error: unsupported architectural extension: xscale asm volatile(".arch_extension xscale\n\t" arch/arm/mach-pxa/pxa27x.c:136:40: error: invalid instruction, did you mean: mcr, mla, mrc, mrs, msr? mra r2, r3, acc0 Since these are coprocessor features, the same can be expressed using mrrc/mcrr, so use that for builds with IAS. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20221215162529.3659187-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit 4c03c4188cfb831e4ac093599192aedd60625a45 Author: Corentin Labbe Date: Wed Dec 14 21:42:23 2022 +0100 MAINTAINERS: add related dts to IXP4xx get_maintainer.pl currently give no maintainer on all IXP4xx DTS files. Add them to the set of files handled by IXP4xx maintainers. Signed-off-by: Corentin Labbe Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20221005105734.3513581-1-clabbe@baylibre.com Link: https://lore.kernel.org/r/20221214204223.177807-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 2b76cfe190305fe02d8120df64f2a1bb6a3d3889 Author: Krzysztof Kozlowski Date: Sat Dec 10 12:33:46 2022 +0100 ARM: dts: spear: drop 0x from unit address By coding style, unit address should not start with 0x. Signed-off-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20221210113347.63939-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 51c4f2bf5397b34b79a6712221606e0ab2e6f7ed Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: 5e85c4ebf206e50c ("x86: KVM: Advertise AVX-IFMA CPUID to user space") af2872f622547656 ("x86: KVM: Advertise AMX-FP16 CPUID to user space") 6a19d7aa5821522e ("x86: KVM: Advertise CMPccXADD CPUID to user space") aaa65d17eec372c6 ("x86/tsx: Add a feature bit for TSX control MSR support") b1599915f09157e9 ("x86/cpufeatures: Move X86_FEATURE_CALL_DEPTH from bit 18 to bit 19 of word 11, to leave space for WIP X86_FEATURE_SGX_EDECCSSA bit") 16a7fe3728a8b832 ("KVM/VMX: Allow exposing EDECCSSA user leaf function to KVM guest") 80e4c1cd42fff110 ("x86/retbleed: Add X86_FEATURE_CALL_DEPTH") 7df548840c496b01 ("x86/bugs: Add "unknown" reporting for MMIO Stale Data") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Chang S. Bae Cc: Dave Hansen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiaxi Chen Cc: Jiri Olsa Cc: Kai Huang Cc: Namhyung Kim Cc: Pawan Gupta Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lore.kernel.org/lkml/Y6CD%2FIcEbDW5X%2FpN@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 6c3e8955d4bd9811a6e1761eea412a14fb51a2e6 Author: Pavel Begunkov Date: Mon Dec 19 15:11:40 2022 +0000 io_uring/net: fix cleanup after recycle Don't access io_async_msghdr io_netmsg_recycle(), it may be reallocated. Cc: stable@vger.kernel.org Fixes: 9bb66906f23e5 ("io_uring: support multishot in recvmsg") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9e326f4ad4046ddadf15bf34bf3fa58c6372f6b5.1671461985.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0bc1d0e2c16736a75f73a94d3a73370801a6ceb2 Author: Arnaldo Carvalho de Melo Date: Mon Dec 19 12:21:58 2022 -0300 tools headers disabled-cpufeatures: Sync with the kernel sources To pick the changes from: 15e15d64bd8e12d8 ("x86/cpufeatures: Add X86_FEATURE_XENPV to disabled-features.h") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Cc: Hunter Cc: Borislav Petkov Cc: Ian Rogers Cc: Jiri Olsa Cc: Juergen Gross Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/Y6B2w3WqifB%2FV70T@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 30d647f5ba9ebefa153ad2bc3f05e3a7c7d90d1c Merge: 66dfc517e8ec5 aeba12b26c79f Author: Arnaldo Carvalho de Melo Date: Mon Dec 19 12:27:25 2022 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To pick up fixes. Signed-off-by: Arnaldo Carvalho de Melo commit 66dfc517e8ec530b1d8d4776c05e3f264f38ecb8 Author: Arnaldo Carvalho de Melo Date: Sat Dec 17 11:37:15 2022 -0300 perf python: Don't stop building if python setuptools isn't installed The python3-setuptools package is needed to build the python binding, so that one can use things like: # ~acme/git/perf/tools/perf/python/twatch.py cpu: 6, pid: 4573, tid: 2184618 { type: exit, pid: 4573, ppid: 4172, tid: 2184618, ptid: 4172, time: 12563190090107} cpu: 24, pid: 4573, tid: 4573 { type: fork, pid: 4573, ppid: 4573, tid: 2190991, ptid: 4573, time: 12563415289331} cpu: 29, pid: 4573, tid: 2190991 { type: comm, pid: 4573, tid: 2190991, comm: StreamT~ns #401 } cpu: 29, pid: 4573, tid: 2190991 { type: comm, pid: 4573, tid: 2190991, comm: StreamT~ns #401 } ^CTraceback (most recent call last): File "/var/home/acme/git/perf/tools/perf/python/twatch.py", line 61, in main() File "/var/home/acme/git/perf/tools/perf/python/twatch.py", line 33, in main evlist.poll(timeout = -1) KeyboardInterrupt # That have 'import perf;'. But distros don't always have that python3-setuptools (or equivalent) installed, which was breaking the build. Just check if it is installed and emit a warning that such binding isn't being built and continue the build without it: With it: $ rpm -q python3-setuptools python3-setuptools-59.6.0-3.fc36.noarch $ rm -rf /tmp/build/perf; mkdir -p /tmp/build/perf $ make O=/tmp/build/perf -C tools/perf install-bin make: Entering directory '/var/home/acme/git/perf/tools/perf' ... libpython: [ on ] GEN /tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so $ ls -la /tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so -rwxr-xr-x. 1 acme acme 1609112 Dec 17 11:39 /tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so $ Without it: $ sudo rpm -e python3-setuptools $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf $ make O=/tmp/build/perf -C tools/perf install-bin make: Entering directory '/var/home/acme/git/perf/tools/perf' ... libpython: [ on ] $ ls -la /tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so ls: cannot access '/tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so': No such file or directory $ Reported-by: Linus Torvalds Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/Y53XHw3rlsaaUgOs@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit aeba12b26c79fc35e07e511f692a8907037d95da Merge: acd04af6e4765 75333d48f9225 Author: Linus Torvalds Date: Mon Dec 19 09:10:33 2022 -0600 Merge tag 'nfsd-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull more nfsd updates from Chuck Lever: "This contains a number of crasher fixes that were not ready for the initial pull request last week. In particular, Jeff's patch attempts to address reference count underflows in NFSD's filecache, which have been very difficult to track down because there is no reliable reproducer. Common failure modes: https://bugzilla.kernel.org/show_bug.cgi?id=216691#c11 https://bugzilla.kernel.org/show_bug.cgi?id=216674#c6 https://bugzilla.redhat.com/show_bug.cgi?id=2138605 The race windows were found by inspection and the clean-ups appear sensible and pass regression testing, so we include them here in the hope that they address the problem. However we remain vigilant because we don't have 100% certainty yet that the problem is fully addressed. Summary: - Address numerous reports of refcount underflows in NFSD's filecache - Address a UAF in callback setup error handling - Address a UAF during server-to-server copy" * tag 'nfsd-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: fix use-after-free in __nfs42_ssc_open() nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure nfsd: rework refcounting in filecache commit 4934fbfb3ff09b8500f63d4624ed8b41647bb822 Author: Helge Deller Date: Fri Oct 21 10:03:52 2022 +0200 parisc: Show MPE/iX model string at bootup Some (mostly 64-bit machines) machines allow to run MPE/iX and report the MPE model string via firmware call. Enhance the pdc_model_sysmodel() function to report that model string. Note that some 32-bit machines like the B160L wrongly report success for the firmware call, so include a check to prevent showing wrong info. Signed-off-by: Helge Deller commit f006229135b7debf4037adb1eb93e358559593db Author: Marc Kleine-Budde Date: Mon Dec 19 11:39:27 2022 +0100 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len Debian's gcc-13 [1] throws the following error in kvaser_usb_hydra_cmd_size(): [1] gcc version 13.0.0 20221214 (experimental) [master r13-4693-g512098a3316] (Debian 13-20221214-1) | drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:502:65: error: | array subscript ‘struct kvaser_cmd_ext[0]’ is partly outside array | bounds of ‘unsigned char[32]’ [-Werror=array-bounds=] | 502 | ret = le16_to_cpu(((struct kvaser_cmd_ext *)cmd)->len); kvaser_usb_hydra_cmd_size() returns the size of given command. It depends on the command number (cmd->header.cmd_no). For extended commands (cmd->header.cmd_no == CMD_EXTENDED) the above shown code is executed. Help gcc to recognize that this code path is not taken in all cases, by calling kvaser_usb_hydra_cmd_size() directly after assigning the command number. Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") Cc: Jimmy Assarsson Cc: Anssi Hannula Link: https://lore.kernel.org/all/20221219110104.1073881-1-mkl@pengutronix.de Tested-by: Jimmy Assarsson Signed-off-by: Marc Kleine-Budde commit 3bc2afcba81275306adfbfca83f38a52858c5940 Author: Haibo Chen Date: Tue Dec 13 17:43:51 2022 +0800 can: flexcan: avoid unbalanced pm_runtime_enable warning When do suspend/resume, meet the following warning message: [ 30.028336] flexcan 425b0000.can: Unbalanced pm_runtime_enable! Balance the pm_runtime_force_suspend() and pm_runtime_force_resume(). Fixes: 8cb53b485f18 ("can: flexcan: add auto stop mode for IMX93 to support wakeup") Signed-off-by: Haibo Chen Link: https://lore.kernel.org/all/20221213094351.3023858-1-haibo.chen@nxp.com Signed-off-by: Marc Kleine-Budde commit 115dd5469019296040359060743de77071ccb6ec Author: Vincent Mailhol Date: Tue Dec 13 14:11:36 2022 +0900 Documentation: devlink: add missing toc entry for etas_es58x devlink doc toc entry is missing for etas_es58x devlink doc and triggers this warning: Documentation/networking/devlink/etas_es58x.rst: WARNING: document isn't included in any toctree Add the missing toc entry. Fixes: 9f63f96aac92 ("Documentation: devlink: add devlink documentation for the etas_es58x driver") Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221213051136.721887-1-mailhol.vincent@wanadoo.fr Reported-by: Stephen Rothwell Reported-by: kernel test robot Signed-off-by: Marc Kleine-Budde commit acd04af6e4765bdc322adab3bf72e249b8b65457 Merge: 9322af3e6aeae e88f319a2546f Author: Linus Torvalds Date: Mon Dec 19 09:00:00 2022 -0600 Merge tag 'rtc-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Most of the changes are a rework of the cmos driver by Rafael and fixes for issues found using static checkers. The removal of a driver leads to a reduction of the number of LOC of the subsystem. Removed driver: - davinci Updates: - convert i2c drivers to .probe_new - fix spelling mistakes and duplicated words in comments - cmos: rework wake setup and ACPI event handling - cros-ec: Limit RTC alarm range to fix alarmtimer - ds1347: fix century register handling - efi: wakeup support - isl12022: temperature sensor support - pcf85063: fix read_alarm and clkout - pcf8523: use stop bit to detect invalid time - pcf8563: use RTC_FEATURE_ALARM - snvs: be more flexible on LPSRT reads - many static checker fixes" * tag 'rtc-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (48 commits) rtc: ds1742: use devm_platform_get_and_ioremap_resource() rtc: mxc_v2: Add missing clk_disable_unprepare() rtc: rs5c313: correct some spelling mistakes rtc: at91rm9200: Fix syntax errors in comments rtc: remove duplicated words in comments rtc: rv3028: Use IRQ flags obtained from device tree if available rtc: ds1307: use sysfs_emit() to instead of scnprintf() rtc: isl12026: drop obsolete dependency on COMPILE_TEST dt-bindings: rtc: m41t80: Convert text schema to YAML one rtc: pcf85063: fix pcf85063_clkout_control rtc: rx6110: fix warning with !OF rtc: rk808: reduce 'struct rk808' usage rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe() dt-bindings: rtc: convert rtc-meson.txt to dt-schema rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pcf85063: Fix reading alarm rtc: pcf8523: fix for stop bit rtc: efi: Add wakeup support rtc: pcf8563: clear RTC_FEATURE_ALARM if no irq ... commit 9322af3e6aeae04c7eda3e6a0c977e97a13cf6ed Merge: 1b6a349a40b9d 25483dedd2f5d Author: Linus Torvalds Date: Mon Dec 19 08:54:17 2022 -0600 Merge tag 'dmaengine-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New support: - Qualcomm SDM670, SM6115 and SM6375 GPI controller support - Ingenic JZ4755 dmaengine support - Removal of iop-adma driver Updates: - Tegra support for dma-channel-mask - at_hdmac cleanup and virt-chan support for this driver" * tag 'dmaengine-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (46 commits) dmaengine: Revert "dmaengine: remove s3c24xx driver" dmaengine: tegra: Add support for dma-channel-mask dt-bindings: dmaengine: Add dma-channel-mask to Tegra GPCDMA dmaengine: idxd: Remove linux/msi.h include dt-bindings: dmaengine: qcom: gpi: add compatible for SM6375 dmaengine: idxd: Fix crc_val field for completion record dmaengine: at_hdmac: Convert driver to use virt-dma dmaengine: at_hdmac: Remove unused member of at_dma_chan dmaengine: at_hdmac: Rename "chan_common" to "dma_chan" dmaengine: at_hdmac: Rename "dma_common" to "dma_device" dmaengine: at_hdmac: Use bitfield access macros dmaengine: at_hdmac: Keep register definitions and structures private to at_hdmac.c dmaengine: at_hdmac: Set include entries in alphabetic order dmaengine: at_hdmac: Use pm_ptr() dmaengine: at_hdmac: Use devm_clk_get() dmaengine: at_hdmac: Use devm_platform_ioremap_resource dmaengine: at_hdmac: Use devm_kzalloc() and struct_size() dmaengine: at_hdmac: Introduce atc_get_llis_residue() dmaengine: at_hdmac: s/atc_get_bytes_left/atc_get_residue dmaengine: at_hdmac: Pass residue by address to avoid unnecessary implicit casts ... commit 1b6a349a40b9dc5fc510c856080e468e3782e5a9 Merge: e79041113b19b 7cbf00bd4142c Author: Linus Torvalds Date: Mon Dec 19 08:47:33 2022 -0600 Merge tag 'soundwire-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "This include bunch of Intel driver code reorganization and support for qcom v1.7.0 controller: - intel: reorganization of hw_ops callbacks, splitting files etc - qcom: support for v1.7.0 qcom controllers" * tag 'soundwire-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel: split auxdevice to different file soundwire: intel: add in-band wake callbacks in hw_ops soundwire: intel: add link power management callbacks in hw_ops soundwire: intel: add bus management callbacks in hw_ops soundwire: intel: add register_dai callback in hw_ops soundwire: intel: add debugfs callbacks in hw_ops soundwire: intel: start using hw_ops dt-bindings: soundwire: Convert text bindings to DT Schema soundwire: cadence: use dai_runtime_array instead of dma_data soundwire: cadence: rename sdw_cdns_dai_dma_data as sdw_cdns_dai_runtime soundwire: qcom: add support for v1.7 Soundwire Controller dt-bindings: soundwire: qcom: add v1.7.0 support soundwire: qcom: make reset optional for v1.6 controller soundwire: qcom: remove unused SWRM_SPECIAL_CMD_ID soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15 commit e79041113b19b8c7b8410d862d4a3630debded58 Merge: b8fd76f418209 bea3ce759b466 Author: Linus Torvalds Date: Mon Dec 19 08:40:58 2022 -0600 Merge tag 'phy-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "This tme we have again a big pile of qcom-qmp-* changes, one new driver and bunch of new hardware support. New hardware support: - Allwinner H616 USB PHY and A100 DPHY support - TI J721s2, J784s4 and J721e support - Freescale i.MX8MP PCIe PHY support - New driver for Renesas Ethernet SERDES supporting R-Car S4-8 - Qualcomm SM8450 PCIe1 PHY support in EP mode - Qualcomm SC8280XP PCIe PHY support (including x4 mode) - Fixed Qualcomm SC8280XP USB4-USB3-DP PHY DT bindings Updates: - A big pile of updates on qcom-qmp-* drivers following the driver split and reorganization merged earlier - Phy order of API calls documentation update" * tag 'phy-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (174 commits) phy: ti: phy-j721e-wiz: add j721s2-wiz-10g module support dt-bindings: phy-j721e-wiz: add j721s2 compatible string phy: use devm_platform_get_and_ioremap_resource() phy: allwinner: phy-sun6i-mipi-dphy: Add the A100 DPHY variant phy: allwinner: phy-sun6i-mipi-dphy: Add a variant power-on hook phy: allwinner: phy-sun6i-mipi-dphy: Set the enable bit last phy: allwinner: phy-sun6i-mipi-dphy: Make RX support optional dt-bindings: sun6i-a31-mipi-dphy: Add the A100 DPHY variant dt-bindings: sun6i-a31-mipi-dphy: Add the interrupts property phy: qcom-qmp-pcie: drop redundant clock allocation phy: qcom-qmp-usb: drop redundant clock allocation phy: qcom-qmp: drop unused type header phy: qcom-qmp-usb: drop sc8280xp reference-clock source dt-bindings: phy: qcom,sc8280xp-qmp-usb3-uni: drop reference-clock source phy: qcom-qmp-combo: add support for updated sc8280xp binding phy: qcom-qmp-combo: rename DP_PHY register pointer phy: qcom-qmp-combo: rename common-register pointers phy: qcom-qmp-combo: clean up DP clock callbacks phy: qcom-qmp-combo: separate clock and provider registration phy: qcom-qmp-combo: add clock registration helper ... commit 990a4de57e44f4f4cfc33c90d2ec5d285b7c8342 Author: Jens Axboe Date: Mon Dec 19 07:28:26 2022 -0700 io_uring/net: ensure compat import handlers clear free_iov If we're not allocating the vectors because the count is below UIO_FASTIOV, we still do need to properly clear ->free_iov to prevent an erronous free of on-stack data. Reported-by: Jiri Slaby Fixes: 4c17a496a7a0 ("io_uring/net: fix cleanup double free free_iov init") Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe commit b8fd76f41820951d8a6e2521c25f54afadf338bd Merge: 2f26e424552ef e3eca2e4f6489 Author: Linus Torvalds Date: Mon Dec 19 08:34:39 2022 -0600 Merge tag 'iommu-updates-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: "Core code: - map/unmap_pages() cleanup - SVA and IOPF refactoring - Clean up and document return codes from device/domain attachment AMD driver: - Rework and extend parsing code for ivrs_ioapic, ivrs_hpet and ivrs_acpihid command line options - Some smaller cleanups Intel driver: - Blocking domain support - Cleanups S390 driver: - Fixes and improvements for attach and aperture handling PAMU driver: - Resource leak fix and cleanup Rockchip driver: - Page table permission bit fix Mediatek driver: - Improve safety from invalid dts input - Smaller fixes and improvements Exynos driver: - Fix driver initialization sequence Sun50i driver: - Remove IOMMU_DOMAIN_IDENTITY as it has not been working forever - Various other fixes" * tag 'iommu-updates-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (74 commits) iommu/mediatek: Fix forever loop in error handling iommu/mediatek: Fix crash on isr after kexec() iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY iommu/amd: Fix typo in macro parameter name iommu/mediatek: Remove unused "mapping" member from mtk_iommu_data iommu/mediatek: Improve safety for mediatek,smi property in larb nodes iommu/mediatek: Validate number of phandles associated with "mediatek,larbs" iommu/mediatek: Add error path for loop of mm_dts_parse iommu/mediatek: Use component_match_add iommu/mediatek: Add platform_device_put for recovering the device refcnt iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() iommu/vt-d: Use real field for indication of first level iommu/vt-d: Remove unnecessary domain_context_mapped() iommu/vt-d: Rename domain_add_dev_info() iommu/vt-d: Rename iommu_disable_dev_iotlb() iommu/vt-d: Add blocking domain support iommu/vt-d: Add device_block_translation() helper iommu/vt-d: Allocate pasid table in device probe path iommu/amd: Check return value of mmu_notifier_register() iommu/amd: Fix pci device refcount leak in ppr_notifier() ... commit 2f26e424552efd50722f4cf61f7f080373adbb1e Merge: 96bab5b926e4c 5535f4f70cfc1 Author: Linus Torvalds Date: Mon Dec 19 08:23:27 2022 -0600 Merge tag 'loongarch-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Switch to relative exception tables - Add unaligned access support - Add alternative runtime patching mechanism - Add FDT booting support from efi system table - Add suspend/hibernation (ACPI S3/S4) support - Add basic STACKPROTECTOR support - Add ftrace (function tracer) support - Update the default config file * tag 'loongarch-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (24 commits) LoongArch: Update Loongson-3 default config file LoongArch: modules/ftrace: Initialize PLT at load time LoongArch/ftrace: Add HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support LoongArch/ftrace: Add HAVE_DYNAMIC_FTRACE_WITH_ARGS support LoongArch/ftrace: Add HAVE_DYNAMIC_FTRACE_WITH_REGS support LoongArch/ftrace: Add dynamic function graph tracer support LoongArch/ftrace: Add dynamic function tracer support LoongArch/ftrace: Add recordmcount support LoongArch/ftrace: Add basic support LoongArch: module: Use got/plt section indices for relocations LoongArch: Add basic STACKPROTECTOR support LoongArch: Add hibernation (ACPI S4) support LoongArch: Add suspend (ACPI S3) support LoongArch: Add processing ISA Node in DeviceTree LoongArch: Add FDT booting support from efi system table LoongArch: Use alternative to optimize libraries LoongArch: Add alternative runtime patching mechanism LoongArch: Add unaligned access support LoongArch: BPF: Add BPF exception tables LoongArch: Remove the .fixup section usage ... commit aacfc939cc42293fbcfe113040b4e8abaef68429 Author: Steve French Date: Thu Dec 15 20:03:17 2022 -0600 cifs: update internal module number To 2.41 Signed-off-by: Steve French commit f60ffa662d1427cfd31fe9d895c3566ac50bfe52 Author: Paulo Alcantara Date: Mon Dec 19 10:21:50 2022 -0300 cifs: don't leak -ENOMEM in smb2_open_file() A NULL error response might be a valid case where smb2_reconnect() failed to reconnect the session and tcon due to a disconnected server prior to issuing the I/O operation, so don't leak -ENOMEM to userspace on such occasions. Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7ad54b98fc1f141cfb70cfe2a3d6def5a85169ff Author: Paulo Alcantara Date: Sun Dec 18 14:37:32 2022 -0300 cifs: use origin fullpath for automounts Use TCP_Server_Info::origin_fullpath instead of cifs_tcon::tree_name when building source paths for automounts as it will be useful for domain-based DFS referrals where the connections and referrals would get either re-used from the cache or re-created when chasing the dfs link. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 25cf01b7c9200d6ace5a59125d8166435dd9dea7 Author: Paulo Alcantara Date: Sat Dec 17 21:04:14 2022 -0300 cifs: set correct status of tcon ipc when reconnecting The status of tcon ipcs were not being set to TID_NEED_RECO when marking sessions and tcons to be reconnected, therefore not sending tree connect to those ipcs in cifs_tree_connect() and leaving them disconnected. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 6fbdd5ab240443e3f8574eb9d407d03daace1ddc Author: Paulo Alcantara Date: Sat Dec 17 00:46:11 2022 -0300 cifs: optimize reconnect of nested links There is no point going all the way back to the original dfs full path if reconnect of tcon did not finish due a nested link found as newly resolved target for the current referral. So, just mark current server for reconnect as we already set @current_fullpath to the new dfs referral in update_server_fullpath(). Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 466611e4af8252dce253cfaebdc7b0019acdbe7e Author: Paulo Alcantara Date: Fri Dec 16 23:25:38 2022 -0300 cifs: fix source pathname comparison of dfs supers We store the TCP_Server_Info::origin_fullpath path canonicalised (e.g. with '\\' path separators), so ignore separators when comparing it with smb3_fs_context::source. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit a85ceafd41927e41a4103d228a993df7edd8823b Author: Paulo Alcantara Date: Fri Dec 16 22:03:41 2022 -0300 cifs: fix confusing debug message Since rc was initialised to -ENOMEM in cifs_get_smb_ses(), when an existing smb session was found, free_xid() would be called and then print CIFS: fs/cifs/connect.c: Existing tcp session with server found CIFS: fs/cifs/connect.c: VFS: in cifs_get_smb_ses as Xid: 44 with uid: 0 CIFS: fs/cifs/connect.c: Existing smb sess found (status=1) CIFS: fs/cifs/connect.c: VFS: leaving cifs_get_smb_ses (xid = 44) rc = -12 Fix this by initialising rc to 0 and then let free_xid() print this instead CIFS: fs/cifs/connect.c: Existing tcp session with server found CIFS: fs/cifs/connect.c: VFS: in cifs_get_smb_ses as Xid: 14 with uid: 0 CIFS: fs/cifs/connect.c: Existing smb sess found (status=1) CIFS: fs/cifs/connect.c: VFS: leaving cifs_get_smb_ses (xid = 14) rc = 0 Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 1d04a6fe75eef16dd1816b112edb4406fd1fbffd Author: Paulo Alcantara Date: Fri Dec 16 21:41:31 2022 -0300 cifs: don't block in dfs_cache_noreq_update_tgthint() Avoid blocking in dfs_cache_noreq_update_tgthint() while reconnecting servers or tcons as the cache refresh worker or new mounts might already be updating their targets. Move some more dfs related code out of connect.c while at it. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 8332858569a096cff02e157555d839e0be921ec7 Author: Paulo Alcantara Date: Tue Dec 13 11:30:30 2022 -0300 cifs: refresh root referrals Also refresh cached root referrals so the other cached referrals may have a better chance to have a working root server to issue the referrals on. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 6916881f443f67f6893b504fa2171468c8aed915 Author: Paulo Alcantara Date: Tue Dec 13 01:23:16 2022 -0300 cifs: fix refresh of cached referrals We can't rely on cifs_tcon::ses to refresh cached referral as the server target might not respond to referrals, e.g. share is not hosted in a DFS root server. Consider the following mount //dom/dfs/link -> /root1/dfs/link -> /fs0/share where fs0 can't get a referral for "/root1/dfs/link". To simplify and fix the access of dfs root sessions, store the dfs root session pointer directly to new sessions so making it easier to select the appropriate ipc connection and use it for failover or cache refresh. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit cb3f6d8764529c33269c3478c17641cb097a615b Author: Paulo Alcantara Date: Tue Dec 13 00:29:22 2022 -0300 cifs: don't refresh cached referrals from unactive mounts There is no point refreshing cached referrals from unactive mounts as they will no longer be used and new mounts will either create or refresh them anyway. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit a1c0d00572fca4adcb40e1fbd3acd481fc75e20b Author: Paulo Alcantara Date: Thu Nov 17 13:23:49 2022 -0300 cifs: share dfs connections and supers When matching DFS superblocks we can't rely on either the server's address or tcon's UNC name from mount(2) as the existing servers and tcons might be connected to somewhere else. Instead, check if superblock is dfs, and if so, match its original source pathname with the new mount's source pathname. For DFS connections, instead of checking server's address, match its referral path as it could be connected to different targets. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit a73a26d97eca082fe13c964e5541543c1e78dc55 Author: Paulo Alcantara Date: Tue Oct 11 18:16:07 2022 -0300 cifs: split out ses and tcon retrieval from mount_get_conns() Introduce and export two helpers for getting session and tcon during mount(2). Those will be used by dfs when retrieving sessions and tcons separately while chasing referrals. Besides, export cifs_mount_ctx structure as it will be used by dfs code as well. No functional changes. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 6d740164d8903e6a0e98c30f80fac6af19ce0a21 Author: Paulo Alcantara Date: Tue Oct 4 18:41:36 2022 -0300 cifs: set resolved ip in sockaddr All callers from dns_resolve_server_name_to_ip() used to convert the ip addr string back to sockaddr, so do that inside dns_resolve_server_name_to_ip() and avoid duplicating code. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 2301bc103ac4acb6d6b6e5860eeed448c4ba2df0 Author: Paulo Alcantara Date: Tue Oct 4 18:41:31 2022 -0300 cifs: remove unused smb3_fs_context::mount_options Just remove it as it's no longer used during mount. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit abdb1742a312388651f04ca04e6e2ec2b0af5288 Author: Paulo Alcantara Date: Tue Oct 4 18:41:27 2022 -0300 cifs: get rid of mount options string parsing After switching to filesystem context support, we no longer need to handle mount options string when chasing dfs referrals. Now, we set the new values directly into smb3_fs_context. Start working on a separate source file to handle most dfs related mount functions as connect.c has already became too big. The remaining functions will be moved gradually in follow-up patches. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9fd29a5bae6e8f94b410374099a6fddb253d2d5f Author: Paulo Alcantara Date: Tue Oct 4 18:41:20 2022 -0300 cifs: use fs_context for automounts Use filesystem context support to handle dfs links. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit c877ce47e1378dbafa6f1bf84c0c83a05ca8972a Author: Paulo Alcantara Date: Mon Dec 12 23:39:37 2022 -0300 cifs: reduce roundtrips on create/qinfo requests To work around some Window servers that return STATUS_OBJECT_NAME_INVALID on query infos under DFS namespaces that contain non-ASCII characters, we started checking for -ENOENT on every file open, and if so, then send additional requests to figure out whether it is a DFS link or not. It means that all those requests will be sent to every non-existing file. So, in order to reduce the number of roundtrips, check earlier whether status code is STATUS_OBJECT_NAME_INVALID and tcon supports dfs, and if so, then map -ENOENT to -EREMOTE so mount or automount will take care of chasing the DFS link -- if it isn't an DFS link, then -ENOENT will be returned appropriately. Before patch SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND After patch SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 96bab5b926e4c2d970f70495f4554f905babd09d Merge: 5f6e430f931d2 7e2004906fb52 Author: Linus Torvalds Date: Mon Dec 19 07:51:30 2022 -0600 Merge tag 'csky-for-linus-6.2-rc1' of https://github.com/c-sky/csky-linux Pull arch/csky updates from Guo Ren: - Revert rseq support - it wasn't ready - Add current_stack_pointer support - Typo fixup * tag 'csky-for-linus-6.2-rc1' of https://github.com/c-sky/csky-linux: Revert "csky: Add support for restartable sequence" Revert "csky: Fixup CONFIG_DEBUG_RSEQ" csky: Kconfig: Fix spelling mistake "Meory" -> "Memory" csky: add arch support current_stack_pointer commit 5f6e430f931d245da838db3e10e918681207029b Merge: a6e3e6f138058 980411a4d1bb9 Author: Linus Torvalds Date: Mon Dec 19 07:13:33 2022 -0600 Merge tag 'powerpc-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Add powerpc qspinlock implementation optimised for large system scalability and paravirt. See the merge message for more details - Enable objtool to be built on powerpc to generate mcount locations - Use a temporary mm for code patching with the Radix MMU, so the writable mapping is restricted to the patching CPU - Add an option to build the 64-bit big-endian kernel with the ELFv2 ABI - Sanitise user registers on interrupt entry on 64-bit Book3S - Many other small features and fixes Thanks to Aboorva Devarajan, Angel Iglesias, Benjamin Gray, Bjorn Helgaas, Bo Liu, Chen Lifu, Christoph Hellwig, Christophe JAILLET, Christophe Leroy, Christopher M. Riedl, Colin Ian King, Deming Wang, Disha Goel, Dmitry Torokhov, Finn Thain, Geert Uytterhoeven, Gustavo A. R. Silva, Haowen Bai, Joel Stanley, Jordan Niethe, Julia Lawall, Kajol Jain, Laurent Dufour, Li zeming, Miaoqian Lin, Michael Jeanson, Nathan Lynch, Naveen N. Rao, Nayna Jain, Nicholas Miehlbradt, Nicholas Piggin, Pali Rohár, Randy Dunlap, Rohan McLure, Russell Currey, Sathvika Vasireddy, Shaomin Deng, Stephen Kitt, Stephen Rothwell, Thomas Weißschuh, Tiezhu Yang, Uwe Kleine-König, Xie Shaowen, Xiu Jianfeng, XueBing Chen, Yang Yingliang, Zhang Jiaming, ruanjinjie, Jessica Yu, and Wolfram Sang. * tag 'powerpc-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (181 commits) powerpc/code-patching: Fix oops with DEBUG_VM enabled powerpc/qspinlock: Fix 32-bit build powerpc/prom: Fix 32-bit build powerpc/rtas: mandate RTAS syscall filtering powerpc/rtas: define pr_fmt and convert printk call sites powerpc/rtas: clean up includes powerpc/rtas: clean up rtas_error_log_max initialization powerpc/pseries/eeh: use correct API for error log size powerpc/rtas: avoid scheduling in rtas_os_term() powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtasd: use correct OF API for event scan rate powerpc/rtas: document rtas_call() powerpc/pseries: unregister VPA when hot unplugging a CPU powerpc/pseries: reset the RCU watchdogs after a LPM powerpc: Take in account addition CPU node when building kexec FDT powerpc: export the CPU node count powerpc/cpuidle: Set CPUIDLE_FLAG_POLLING for snooze state powerpc/dts/fsl: Fix pca954x i2c-mux node names cxl: Remove unnecessary cxl_pci_window_alignment() selftests/powerpc: Fix resource leaks ... commit a6e3e6f138058ff184d8ef5064a033b3f5fee8f8 Merge: 1ea9d333ba475 f9eeef5918bbe Author: Linus Torvalds Date: Mon Dec 19 07:03:44 2022 -0600 Merge tag 'mm-nonmm-stable-2022-12-17-20-32' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull fault-injection updates from Andrew Morton: "Some fault-injection improvements from Wei Yongjun which enable stacktrace filtering on x86_64" * tag 'mm-nonmm-stable-2022-12-17-20-32' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: fault-injection: make stacktrace filter works as expected fault-injection: make some stack filter attrs more readable fault-injection: skip stacktrace filtering by default fault-injection: allow stacktrace filter for x86-64 commit 1ea9d333ba475041efe43d9d9bc32e64aea2ea2b Merge: 4f292c4de4f6f 8b777594d2341 Author: Linus Torvalds Date: Mon Dec 19 06:58:57 2022 -0600 Merge tag 'mm-stable-2022-12-17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more mm updates from Andrew Morton: - A few late-breaking minor fixups - Two minor feature patches which were awkwardly dependent on mm-nonmm. I need to set up a new branch to handle such things. * tag 'mm-stable-2022-12-17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: zram: zsmalloc: Add an additional co-maintainer mm/kmemleak: use %pK to display kernel pointers in backtrace mm: use stack_depot for recording kmemleak's backtrace maple_tree: update copyright dates for test code maple_tree: fix mas_find_rev() comment mm/gup_test: free memory allocated via kvcalloc() using kvfree() commit 2856a62762c8409e360d4fd452194c8e57ba1058 Author: Jeremy Kerr Date: Fri Dec 16 11:44:09 2022 +0800 mctp: serial: Fix starting value for frame check sequence RFC1662 defines the start state for the crc16 FCS to be 0xffff, but we're currently starting at zero. This change uses the correct start state. We're only early in the adoption for the serial binding, so there aren't yet any other users to interface to. Fixes: a0c2ccd9b5ad ("mctp: Add MCTP-over-serial transport binding") Reported-by: Harsh Tyagi Tested-by: Harsh Tyagi Signed-off-by: Jeremy Kerr Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller commit 1b0c84a32e37cf85d552261005091eb695313f38 Author: Huanhuan Wang Date: Fri Dec 16 15:31:01 2022 +0100 nfp: fix unaligned io read of capabilities word The address of 32-bit extend capability is not qword aligned, and may cause exception in some arch. Fixes: 484963ce9f1e ("nfp: extend capability and control words") Signed-off-by: Huanhuan Wang Reviewed-by: Niklas Söderlund Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3 Author: Eric Dumazet Date: Fri Dec 16 16:29:17 2022 +0000 net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization against concurrent writers. Fixes: 24bcbe1cc69f ("net: stream: don't purge sk_error_queue in sk_stream_kill_queues()") Reported-by: Changheon Lee Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit d83b950d44d2982c0e62e3d81b0f35ab09431008 Author: Christophe JAILLET Date: Sun Dec 18 19:08:40 2022 +0100 myri10ge: Fix an error handling path in myri10ge_probe() Some memory allocated in myri10ge_probe_slices() is not released in the error handling path of myri10ge_probe(). Add the corresponding kfree(), as already done in the remove function. Fixes: 0dcffac1a329 ("myri10ge: add multislices support") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 10073399cb5e389ab275bd1c9df4b486a2f0c9d4 Author: Horatiu Vultur Date: Mon Dec 19 09:22:15 2022 +0100 net: microchip: vcap: Fix initialization of value and mask Fix the following smatch warning: smatch warnings: drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c:103 vcap_debugfs_show_rule_keyfield() error: uninitialized symbol 'value'. drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c:106 vcap_debugfs_show_rule_keyfield() error: uninitialized symbol 'mask'. In case the vcap field was VCAP_FIELD_U128 and the key was different than IP6_S/DIP then the value and mask were not initialized, therefore initialize them. Fixes: 610c32b2ce66 ("net: microchip: vcap: Add vcap_get_rule") Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Saeed Mahameed Signed-off-by: Horatiu Vultur Reviewed-by: Michal Swiatkowski Signed-off-by: David S. Miller commit 0ee29814c6be17a924761d3712eb8ad63cfe13ac Author: Roderick Colenbrander Date: Mon Dec 12 20:49:35 2022 -0800 HID: playstation: fix free of uninialized pointer for DS4 in Bluetooth. The 'buf' variable is only used in the USB (if-path) and not in the Bluetooth else-path. Since it is not set to NULL. this results in freeing an uninitialized pointer. Since the else code-path doesn't need buf, just return 0. Fixes: 2d77474a2392 ("HID: playstation: add DualShock4 bluetooth support.") Signed-off-by: Roderick Colenbrander Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221213044935.1775499-2-roderick.colenbrander@sony.com commit 67c90d14018775556d5420382ace86521421f9ff Author: Enrik Berkhan Date: Thu Nov 3 23:27:12 2022 +0100 HID: mcp2221: don't connect hidraw The MCP2221 driver should not connect to the hidraw userspace interface, as it needs exclusive access to the chip. If you want to use /dev/hidrawX with the MCP2221, you need to avoid binding this driver to the device and use the hid generic driver instead (e.g. using udev rules). Cc: stable@vger.kernel.org Reported-by: Sven Zühlsdorf Signed-off-by: Enrik Berkhan Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221103222714.21566-2-Enrik.Berkhan@inka.de commit 0e13e7b448005612972eae36c0f698c21d1e2f8a Author: Bastien Nocera Date: Thu Dec 15 16:44:16 2022 +0100 HID: logitech-hidpp: Guard FF init code against non-USB devices The Force Feedback code assumes that all the devices passed to it will be USB devices, but that might not be the case for emulated devices. Guard against a crash by checking the device type before poking at USB properties. Cc: stable@vger.kernel.org # v5.16+ Reported-by: Benjamin Tissoires Signed-off-by: Bastien Nocera Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221215154416.111704-1-hadess@hadess.net commit 71a06f1034b91e15d3ba6b5539c7d3a2d7f13030 Author: Miquel Raynal Date: Sat Dec 17 00:57:42 2022 +0100 mac802154: Fix possible double free upon parsing error Commit 4d1c7d87030b ("mac802154: Move an skb free within the rx path") tried to simplify error handling within the receive path by moving the kfree_skb() call at the very end of the top-level function but missed one kfree_skb() called upon frame parsing error. Prevent this possible double free from happening. Fixes: 4d1c7d87030b ("mac802154: Move an skb free within the rx path") Reported-by: Dan Carpenter Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20221216235742.646134-1-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 98dbec0a0adc10d9441b6c29315406e275532eb3 Merge: 9cd3fd2054c3b 31d35a02ad5b8 Author: David S. Miller Date: Mon Dec 19 09:51:31 2022 +0000 Merge branch 'rxrpc-fixes' David Howells says: ==================== rxrpc: Fixes for I/O thread conversion/SACK table expansion Here are some fixes for AF_RXRPC: (1) Fix missing unlock in rxrpc's sendmsg. (2) Fix (lack of) propagation of security settings to rxrpc_call. (3) Fix NULL ptr deref in rxrpc_unuse_local(). (4) Fix problem with kthread_run() not invoking the I/O thread function if the kthread gets stopped first. Possibly this should actually be fixed in the kthread code. (5) Fix locking problem as putting a peer (which may be done from RCU) may now invoke kthread_stop(). (6) Fix switched parameters in a couple of trace calls. (7) Fix I/O thread's checking for kthread stop to make sure it completes all outstanding work before returning so that calls are cleaned up. (8) Fix an uninitialised var in the new rxperf test server. (9) Fix the return value of rxrpc_new_incoming_call() so that the checks on it work correctly. The patches fix at least one syzbot bug[1] and probably some others that don't have reproducers[2][3][4]. I think it also fixes another[5], but that showed another failure during testing that was different to the original. There's also an outstanding bug in rxrpc_put_peer()[6] that is fixed by a combination of several patches in my rxrpc-next branch, but I haven't included that here. ==================== Tested-by: Marc Dionne Tested-by: kafs-testing+fedora36_64checkkafs-build-164@auristor.com Signed-off-by: David S. Miller commit 31d35a02ad5b803354fe0727686fcbace7a343fe Author: David Howells Date: Thu Dec 15 16:20:55 2022 +0000 rxrpc: Fix the return value of rxrpc_new_incoming_call() Dan Carpenter sayeth[1]: The patch 5e6ef4f1017c: "rxrpc: Make the I/O thread take over the call and local processor work" from Jan 23, 2020, leads to the following Smatch static checker warning: net/rxrpc/io_thread.c:283 rxrpc_input_packet() warn: bool is not less than zero. Fix this (for now) by changing rxrpc_new_incoming_call() to return an int with 0 or error code rather than bool. Note that the actual return value of rxrpc_input_packet() is currently ignored. I have a separate patch to clean that up. Fixes: 5e6ef4f1017c ("rxrpc: Make the I/O thread take over the call and local processor work") Reported-by: Dan Carpenter Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2022-December/006123.html [1] Signed-off-by: David S. Miller commit 11e1706bc84f60040578056f8cef3d0139b92dda Author: David Howells Date: Thu Dec 15 16:20:46 2022 +0000 rxrpc: rxperf: Fix uninitialised variable Dan Carpenter sayeth[1]: The patch 75bfdbf2fca3: "rxrpc: Implement an in-kernel rxperf server for testing purposes" from Nov 3, 2022, leads to the following Smatch static checker warning: net/rxrpc/rxperf.c:337 rxperf_deliver_to_call() error: uninitialized symbol 'ret'. Fix this by initialising ret to 0. The value is only used for tracing purposes in the rxperf server. Fixes: 75bfdbf2fca3 ("rxrpc: Implement an in-kernel rxperf server for testing purposes") Reported-by: Dan Carpenter Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2022-December/006124.html [1] Signed-off-by: David S. Miller commit 743d1768a008c8eae56ead497c9ba8237b14ee81 Author: David Howells Date: Thu Dec 15 16:20:38 2022 +0000 rxrpc: Fix I/O thread stop The rxrpc I/O thread checks to see if there's any work it needs to do, and if not, checks kthread_should_stop() before scheduling, and if it should stop, breaks out of the loop and tries to clean up and exit. This can, however, race with socket destruction, wherein outstanding calls are aborted and released from the socket and then the socket unuses the local endpoint, causing kthread_stop() to be issued. The abort is deferred to the I/O thread and the event can by issued between the I/O thread checking if there's any work to be done (such as processing call aborts) and the stop being seen. This results in the I/O thread stopping processing of events whilst call cleanup events are still outstanding, leading to connections or other objects still being around and uncleaned up, which can result in assertions being triggered, e.g.: rxrpc: AF_RXRPC: Leaked client conn 00000000e8009865 {2} ------------[ cut here ]------------ kernel BUG at net/rxrpc/conn_client.c:64! Fix this by retrieving the kthread_should_stop() indication, then checking to see if there's more work to do, and going back round the loop if there is, and breaking out of the loop only if there wasn't. This was triggered by a syzbot test that produced some other symptom[1]. Fixes: a275da62e8c1 ("rxrpc: Create a per-local endpoint receive queue and I/O thread") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/0000000000002b4a9f05ef2b616f@google.com/ [1] Signed-off-by: David S. Miller commit c838f1a73d77abadb0810eff0e150ac88fef3da5 Author: David Howells Date: Thu Dec 15 16:20:30 2022 +0000 rxrpc: Fix switched parameters in peer tracing Fix the switched parameters on rxrpc_alloc_peer() and rxrpc_get_peer(). The ref argument and the why argument got mixed. Fixes: 47c810a79844 ("rxrpc: trace: Don't use __builtin_return_address for rxrpc_peer tracing") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 608aecd16a31269485e2980898029dd01b03a73e Author: David Howells Date: Thu Dec 15 16:20:21 2022 +0000 rxrpc: Fix locking issues in rxrpc_put_peer_locked() Now that rxrpc_put_local() may call kthread_stop(), it can't be called under spinlock as it might sleep. This can cause a problem in the peer keepalive code in rxrpc as it tries to avoid dropping the peer_hash_lock from the point it needs to re-add peer->keepalive_link to going round the loop again in rxrpc_peer_keepalive_dispatch(). Fix this by just dropping the lock when we don't need it and accepting that we'll have to take it again. This code is only called about every 20s for each peer, so not very often. This allows rxrpc_put_peer_unlocked() to be removed also. If triggered, this bug produces an oops like the following, as reproduced by a syzbot reproducer for a different oops[1]: BUG: sleeping function called from invalid context at kernel/sched/completion.c:101 ... RCU nest depth: 0, expected: 0 3 locks held by kworker/u9:0/50: #0: ffff88810e74a138 ((wq_completion)krxrpcd){+.+.}-{0:0}, at: process_one_work+0x294/0x636 #1: ffff8881013a7e20 ((work_completion)(&rxnet->peer_keepalive_work)){+.+.}-{0:0}, at: process_one_work+0x294/0x636 #2: ffff88817d366390 (&rxnet->peer_hash_lock){+.+.}-{2:2}, at: rxrpc_peer_keepalive_dispatch+0x2bd/0x35f ... Call Trace: dump_stack_lvl+0x4c/0x5f __might_resched+0x2cf/0x2f2 __wait_for_common+0x87/0x1e8 kthread_stop+0x14d/0x255 rxrpc_peer_keepalive_dispatch+0x333/0x35f rxrpc_peer_keepalive_worker+0x2e9/0x449 process_one_work+0x3c1/0x636 worker_thread+0x25f/0x359 kthread+0x1a6/0x1b5 ret_from_fork+0x1f/0x30 Fixes: a275da62e8c1 ("rxrpc: Create a per-local endpoint receive queue and I/O thread") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/0000000000002b4a9f05ef2b616f@google.com/ [1] Signed-off-by: David S. Miller commit 8fbcc83334a7b5b42b6bc1fae2458bf25eb57768 Author: David Howells Date: Thu Dec 15 16:20:13 2022 +0000 rxrpc: Fix I/O thread startup getting skipped When starting a kthread, the __kthread_create_on_node() function, as called from kthread_run(), waits for a completion to indicate that the task_struct (or failure state) of the new kernel thread is available before continuing. This does not wait, however, for the thread function to be invoked and, indeed, will skip it if kthread_stop() gets called before it gets there. If this happens, though, kthread_run() will have returned successfully, indicating that the thread was started and returning the task_struct pointer. The actual error indication is returned by kthread_stop(). Note that this is ambiguous, as the caller cannot tell whether the -EINTR error code came from kthread() or from the thread function. This was encountered in the new rxrpc I/O thread, where if the system is being pounded hard by, say, syzbot, the check of KTHREAD_SHOULD_STOP can be delayed long enough for kthread_stop() to get called when rxrpc releases a socket - and this causes an oops because the I/O thread function doesn't get started and thus doesn't remove the rxrpc_local struct from the local_endpoints list. Fix this by using a completion to wait for the thread to actually enter rxrpc_io_thread(). This makes sure the thread can't be prematurely stopped and makes sure the relied-upon cleanup is done. Fixes: a275da62e8c1 ("rxrpc: Create a per-local endpoint receive queue and I/O thread") Reported-by: syzbot+3538a6a72efa8b059c38@syzkaller.appspotmail.com Signed-off-by: David Howells cc: Marc Dionne cc: Hillf Danton Link: https://lore.kernel.org/r/000000000000229f1505ef2b6159@google.com/ Signed-off-by: David S. Miller commit eaa02390adb03b82f04babebf0cdd233793aecf5 Author: David Howells Date: Thu Dec 15 16:20:04 2022 +0000 rxrpc: Fix NULL deref in rxrpc_unuse_local() Fix rxrpc_unuse_local() to get the debug_id *after* checking to see if local is NULL. Fixes: a2cf3264f331 ("rxrpc: Fold __rxrpc_unuse_local() into rxrpc_unuse_local()") Reported-by: syzbot+3538a6a72efa8b059c38@syzkaller.appspotmail.com Signed-off-by: David Howells Tested-by: syzbot+3538a6a72efa8b059c38@syzkaller.appspotmail.com cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit fdb99487b0189f0ef883e353ad7484c78a8bd425 Author: David Howells Date: Thu Dec 15 16:19:56 2022 +0000 rxrpc: Fix security setting propagation Fix the propagation of the security settings from sendmsg to the rxrpc_call struct. Fixes: f3441d4125fc ("rxrpc: Copy client call parameters into rxrpc_call earlier") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 4feb2c44629e6f9b459b41a5a60491069d346a95 Author: David Howells Date: Thu Dec 15 16:19:47 2022 +0000 rxrpc: Fix missing unlock in rxrpc_do_sendmsg() One of the error paths in rxrpc_do_sendmsg() doesn't unlock the call mutex before returning. Fix it to do this. Note that this still doesn't get rid of the checker warning: ../net/rxrpc/sendmsg.c:617:5: warning: context imbalance in 'rxrpc_do_sendmsg' - wrong count at exit I think the interplay between the socket lock and the call's user_mutex may be too complicated for checker to analyse, especially as rxrpc_new_client_call_for_sendmsg(), which it calls, returns with the call's user_mutex if successful but unconditionally drops the socket lock. Fixes: e754eba685aa ("rxrpc: Provide a cmsg to specify the amount of Tx data for a call") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 Author: Cong Wang Date: Sat Dec 17 14:17:07 2022 -0800 net_sched: reject TCF_EM_SIMPLE case for complex ematch module When TCF_EM_SIMPLE was introduced, it is supposed to be convenient for ematch implementation: https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/ "You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE set will simply result in allocating & copy. It's an optimization, nothing more." So if an ematch module provides ops->datalen that means it wants a complex data structure (saved in its em->data) instead of a simple u32 value. We should simply reject such a combination, otherwise this u32 could be misinterpreted as a pointer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com Reported-by: Jun Nie Cc: Jamal Hadi Salim Cc: Paolo Abeni Signed-off-by: Cong Wang Acked-by: Paolo Abeni Signed-off-by: David S. Miller commit 53c60d1004270045d63cdee91aa77c145282d7e4 Author: Abel Vesa Date: Wed Nov 16 13:34:57 2022 +0200 dt-bindings: mailbox: qcom-ipcc: Add compatible for SM8550 Document the compatible for SM8550 mailbox. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 16edcfef77147748c43c9c58ce18f59c61d1c357 Author: Ricardo Ribalda Date: Wed Nov 30 13:58:22 2022 +0100 mailbox: mtk-cmdq: Do not request irq until we are ready If the system comes from kexec() the peripheral might trigger an IRQ befoe we are ready for it. Triggering a crash due to an access to invalid memory. Signed-off-by: Ricardo Ribalda Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chun-Kuang Hu Signed-off-by: Jassi Brar commit a6792a0cdef0b1c2d77920246283a72537e60e94 Author: Yang Yingliang Date: Thu Nov 10 23:08:22 2022 +0800 mailbox: zynq-ipi: fix error handling while device_register() fails If device_register() fails, it has two issues: 1. The name allocated by dev_set_name() is leaked. 2. The parent of device is not NULL, device_unregister() is called in zynqmp_ipi_free_mboxes(), it will lead a kernel crash because of removing not added device. Call put_device() to give up the reference, so the name is freed in kobject_cleanup(). Add device registered check in zynqmp_ipi_free_mboxes() to avoid null-ptr-deref. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Yang Yingliang Signed-off-by: Jassi Brar commit acabe12c6106b105ac8285d6d5ba2aeeab74fd47 Author: AngeloGioacchino Del Regno Date: Wed Nov 2 11:07:36 2022 +0100 mailbox: mtk-cmdq-mailbox: Use platform data directly instead of copying Copying platform data to struct cmdq serves to no purpose, as that data is never modified during runtime: it's worth at this point storing a pointer to gce_plat in gce and. Remove all duplicated `struct gce_plat` members from `struct gce` and reuse the platform data across the driver to save some memory. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Reviewed-by: Chun-Kuang Hu Signed-off-by: Jassi Brar commit 165b7643f2df890066b1b4e8a387888a600ca9bf Author: Yang Yingliang Date: Fri Nov 25 14:35:48 2022 +0800 mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() If devm_of_iomap() fails, it returns ERR_PTR() and never return NULL, so replace NULL pointer check with IS_ERR() to fix this problem. Fixes: 5a6338cce9f4 ("mailbox: arm_mhuv2: Add driver") Signed-off-by: Yang Yingliang Acked-by: Viresh Kumar Signed-off-by: Jassi Brar commit f2b53c2956207b76c42407f3c089a2c1561a58ef Author: Elvis Wang Date: Thu Dec 1 15:13:16 2022 +0800 dt-bindings: mailbox: mediatek,gce-mailbox: add mt8188 compatible name Add mt8188 compatible name. Signed-off-by: Elvis Wang Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 359f608f66b4434fb83b74e23ad14631ea3efc4e Author: Elvis Wang Date: Thu Dec 1 15:13:15 2022 +0800 dt-bindings: mailbox: add GCE header file for mt8188 Add Global Command Engine(GCE) header file to define the GCE thread priority, GCE subsys id, event and constant for mt8188. Signed-off-by: Elvis Wang Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit ab47d0bfdf88faac0eb02749e5bfaa306e004300 Author: Conor Dooley Date: Wed Nov 23 17:56:52 2022 +0000 mailbox: mpfs: read the system controller's status Some services explicitly return an error code in their response, but others rely on the system controller to set a status in its status register. The meaning of the bits varies based on what service is requested, so pass it back up to the driver that requested the service in the first place. The field in the message struct already existed, but was unused until now. If the system controller is busy, in which case we should never actually be in the interrupt handler, or if the service fails the mailbox itself should not be read. Callers should check the status before operating on the response. There's an existing, but unused, #define for the mailbox mask - but it was incorrect. It was doing a GENMASK_ULL(32, 16) which should've just been a GENMASK(31, 16), so fix that up and start using it. Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") Signed-off-by: Conor Dooley Reviewed-by: Palmer Dabbelt Signed-off-by: Jassi Brar commit 926d6214f66955f0c066175127cbcf2eaae5ad6b Author: Yongqiang Niu Date: Thu Dec 15 15:28:06 2022 +0800 mailbox: mtk-cmdq: add MT8186 support add MT8186 cmdq support Signed-off-by: Yongqiang Niu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Signed-off-by: Jassi Brar commit 7abd037aa581dcdc16c30ebdea758a4e3877f8e1 Author: Yongqiang Niu Date: Thu Dec 15 15:28:05 2022 +0800 mailbox: mtk-cmdq: add gce ddr enable support flow add gce ddr enable control flow when gce suspend/resume when all cmdq instruction task has been processed done, we need set this gce ddr enable to disable status to tell cmdq hardware gce there is none task need process, and the hardware can go into idle mode and no access ddr anymore, then the spm can go into suspend. the original issue is gce still access ddr when cmdq suspend function call, but there is no task run. so, we need control gce access ddr with this flow. when cmdq suspend function, there is no task need process, we can disable gce access ddr, to make sure system go into suspend success. Signed-off-by: Yongqiang Niu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Signed-off-by: Jassi Brar commit 63f40a7f5dbdb70f8574754475346a9e72ccef6c Author: Yongqiang Niu Date: Thu Dec 15 15:28:04 2022 +0800 mailbox: mtk-cmdq: add gce software ddr enable private data if gce work control by software, we need set software enable for MT8186 Soc there is a handshake flow between gce and ddr hardware, if not set ddr enable flag of gce, ddr will fall into idle mode, then gce instructions will not process done. we need set this flag of gce to tell ddr when gce is idle or busy controlled by software flow. 0x48[2:0] means control by software 0x48[18:16] means ddr enable 0x48[2:0] is pre-condition of 0x48[18:16]. if we want set 0x48[18:16] ddr enable, 0x48[2:0] must be set at same time. and only these bits is useful, other bits is useless bits Signed-off-by: Yongqiang Niu Reviewed-by: CK Hu Signed-off-by: Jassi Brar commit 23ba2e7fa282dd8e6c51c284ab1ea184c96c88b2 Author: Yongqiang Niu Date: Thu Dec 15 15:28:03 2022 +0800 mailbox: mtk-cmdq: Use GCE_CTRL_BY_SW definition instead of number Use GCE_CTRL_BY_SW definition instead of number Signed-off-by: Yongqiang Niu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Signed-off-by: Jassi Brar commit 8b9b08bd8d6adda032ae65a3a2f87ee989500c02 Author: ye xingchen Date: Thu Nov 17 19:29:11 2022 +0800 mailbox: rockchip: Use device_get_match_data() to simplify the code Directly get the match data with device_get_match_data(). Signed-off-by: ye xingchen Signed-off-by: Jassi Brar commit 76f708f635403d826ebea17ccce60d47c6671e22 Author: Luca Weiss Date: Sun Oct 16 11:00:32 2022 +0200 dt-bindings: mailbox: qcom-ipcc: Add sc8280xp compatible Document the sc8280xp compatible, and at the same time also make sure the list is sorted alphabetically. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 31c8d06e55acc325c64596f148d5405dbe4adf30 Author: Nicolas Frayer Date: Tue Nov 22 21:22:44 2022 +0100 mailbox: config: ti-msgmgr: Default set to ARCH_K3 for TI msg manager Defaulting the build to ARCH_K3 for the TI message manager driver. Signed-off-by: Nicolas Frayer Signed-off-by: Jassi Brar commit e2cb0eac3d1d1acc8203634f3243859d95e4b37c Author: Bhupesh Sharma Date: Mon Nov 28 01:24:18 2022 +0530 mailbox: qcom-apcs-ipc: Add SM4250 APCS IPC support Enable SM4250 APCS IPC support by adding the compatible. It reuses msm8994_apcs_data. Signed-off-by: Bhupesh Sharma Signed-off-by: Jassi Brar commit e0cb05a02c5333323a32324d8e4048b7575d8ff5 Author: Bhupesh Sharma Date: Mon Nov 28 01:24:17 2022 +0530 dt-bindings: mailbox: qcom: Add SM4250 APCS compatible Add compatible for the Qualcomm SM4250 APCS block. Signed-off-by: Bhupesh Sharma Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 9086e6017957c5cd6ea28d94b70e0d513d6b7800 Author: Helge Deller Date: Sat Dec 17 20:05:43 2022 +0100 parisc: Add missing FORCE prerequisites in Makefile Fix those make warnings: arch/parisc/kernel/vdso32/Makefile:30: FORCE prerequisite is missing arch/parisc/kernel/vdso64/Makefile:30: FORCE prerequisite is missing Add the missing FORCE prerequisites for all build targets identified by "make help". Fixes: e1f86d7b4b2a5213 ("kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and filechk") Signed-off-by: Helge Deller Cc: # 5.18+ commit 4add395bc77f19e2e5cedbef4368ffdebc89b165 Author: Helge Deller Date: Sat Dec 17 18:38:03 2022 +0100 parisc: Move pdc_result struct to firmware.c Signed-off-by: Helge Deller commit 7dc4dbfe750e1f18c511e73c8ed114da8de9ff85 Author: Helge Deller Date: Sat Dec 17 17:45:40 2022 +0100 parisc: Drop locking in pdc console code No need to have specific locking for console I/O since the PDC functions provide an own locking. Signed-off-by: Helge Deller Cc: # 6.1+ commit 7e6652c79ecd74e1112500668d956367dc3772a5 Author: Helge Deller Date: Sat Nov 26 21:35:29 2022 +0100 parisc: Drop duplicate kgdb_pdc console The kgdb console is already implemented and registered in pdc_cons.c, so the duplicate code can be dropped. Signed-off-by: Helge Deller Cc: # 6.1+ commit 7236aae5f81f3efbd93d0601e74fc05994bc2580 Author: Helge Deller Date: Sat Nov 26 21:29:31 2022 +0100 parisc: Fix locking in pdc_iodc_print() firmware call Utilize pdc_lock spinlock to protect parallel modifications of the iodc_dbuf[] buffer, check length to prevent buffer overflow of iodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong indentings. Signed-off-by: Helge Deller Cc: # 6.0+ commit 89529367293c975c3580f49f38568f44848d5683 Merge: 2d7afdcbc9d32 72abeedd83982 Author: David S. Miller Date: Sun Dec 18 21:00:40 2022 +0000 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-12-15 (igc) Muhammad Husaini Zulkifli says: This patch series fixes bugs for the Time-Sensitive Networking(TSN) Qbv Scheduling features. An overview of each patch series is given below: Patch 1: Using a first flag bit to schedule a packet to the next cycle if packet cannot fit in current Qbv cycle. Patch 2: Enable strict cycle for Qbv scheduling. Patch 3: Prevent user to set basetime less than zero during tc config. Patch 4: Allow the basetime enrollment with zero value. Patch 5: Calculate the new end time value to exclude the time interval that exceed the cycle time as user can specify the cycle time in tc config. Patch 6: Resolve the HW bugs where the gate is not fully closed. --- This contains the net patches from this original pull request: https://lore.kernel.org/netdev/20221205212414.3197525-1-anthony.l.nguyen@intel.com/ ==================== Signed-off-by: David S. Miller commit b29e6ece454f7f4822b40441da393c3969c312b3 Merge: 77856d911a8c8 f9ff5644bcc04 Author: Andrew Morton Date: Sat Dec 17 20:39:52 2022 -0800 Resync master with latest Linus upstream commit 35d90f95cfa773b7e3b1f57ba15ce06a470f354c Author: Jens Axboe Date: Sat Dec 17 13:42:24 2022 -0700 io_uring: include task_work run after scheduling in wait for events It's quite possible that we got woken up because task_work was queued, and we need to process this task_work to generate the events waited for. If we return to the wait loop without running task_work, we'll end up adding the task to the waitqueue again, only to call io_cqring_wait_schedule() again which will run the task_work. This is less efficient than it could be, as it requires adding to the cq_wait queue again. It also triggers the wakeup path for completions as cq_wait is now non-empty with the task itself, and it'll require another lock grab and deletion to remove ourselves from the waitqueue. Signed-off-by: Jens Axboe commit 3f6c3d29df58f391cf487b50a24ebd24045ba569 Author: Paul E. McKenney Date: Thu Dec 15 09:26:09 2022 -0800 rcu: Don't assert interrupts enabled too early in boot The rcu_poll_gp_seq_end() and rcu_poll_gp_seq_end_unlocked() both check that interrupts are enabled, as they normally should be when waiting for an RCU grace period. Except that it is legal to wait for grace periods during early boot, before interrupts have been enabled for the first time, and polling for grace periods is required to work during this time. This can result in false-positive lockdep splats in the presence of boot-time-initiated tracing. This commit therefore conditions those interrupts-enabled checks on rcu_scheduler_active having advanced past RCU_SCHEDULER_INACTIVE, by which time interrupts have been enabled. Reported-by: Steven Rostedt Signed-off-by: Paul E. McKenney Tested-by: Steven Rostedt (Google) commit fe94cb1a614d2df2764d49ac959d8b7e4cb98e15 Author: Helge Deller Date: Wed Dec 14 22:17:57 2022 +0100 parisc: Drop PMD_SHIFT from calculation in pgtable.h PMD_SHIFT isn't defined if CONFIG_PGTABLE_LEVELS == 3, and as such the kernel test robot found this warning: In file included from include/linux/pgtable.h:6, from arch/parisc/kernel/head.S:23: arch/parisc/include/asm/pgtable.h:169:32: warning: "PMD_SHIFT" is not defined, evaluates to 0 [-Wundef] 169 | #if (KERNEL_INITIAL_ORDER) >= (PMD_SHIFT) Avoid the warning by using PLD_SHIFT and BITS_PER_PTE. Signed-off-by: Helge Deller Reported-by: kernel test robot Cc: # 6.0+ commit 71bdea6f798b425bc0003780b13e3fdecb16a010 Author: Helge Deller Date: Sun Dec 11 19:50:20 2022 +0100 parisc: Align parisc MADV_XXX constants with all other architectures Adjust some MADV_XXX constants to be in sync what their values are on all other platforms. There is currently no reason to have an own numbering on parisc, but it requires workarounds in many userspace sources (e.g. glibc, qemu, ...) - which are often forgotten and thus introduce bugs and different behaviour on parisc. A wrapper avoids an ABI breakage for existing userspace applications by translating any old values to the new ones, so this change allows us to move over all programs to the new ABI over time. Signed-off-by: Helge Deller commit 41f563ab3c33698bdfc3403c7c2e6c94e73681e4 Author: Shang XiaoJing Date: Thu Nov 17 10:45:14 2022 +0800 parisc: led: Fix potential null-ptr-deref in start_task() start_task() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may happen: start_task() create_singlethread_workqueue() # failed, led_wq is NULL queue_delayed_work() queue_delayed_work_on() __queue_delayed_work() # warning here, but continue __queue_work() # access wq->flags, null-ptr-deref Check the ret value and return -ENOMEM if it is NULL. Fixes: 3499495205a6 ("[PARISC] Use work queue in LED/LCD driver instead of tasklet.") Signed-off-by: Shang XiaoJing Signed-off-by: Helge Deller Cc: commit 6434ec0186b80c734aa7a2acf95f75f5c6dd943b Author: Jens Axboe Date: Sat Dec 17 13:40:17 2022 -0700 io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work Use task_work_pending() as a better test for whether we have task_work or not, TIF_NOTIFY_SIGNAL is only valid if the any of the task_work items had been queued with TWA_SIGNAL as the notification mechanism. Hence task_work_pending() is a more reliable check. Signed-off-by: Jens Axboe commit 4f292c4de4f6fb83776c0ff22674121eb6ddfa2f Merge: 03d84bd6d4326 3e844d842d49c Author: Linus Torvalds Date: Sat Dec 17 14:06:53 2022 -0600 Merge tag 'x86_mm_for_6.2_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Dave Hansen: "New Feature: - Randomize the per-cpu entry areas Cleanups: - Have CR3_ADDR_MASK use PHYSICAL_PAGE_MASK instead of open coding it - Move to "native" set_memory_rox() helper - Clean up pmd_get_atomic() and i386-PAE - Remove some unused page table size macros" * tag 'x86_mm_for_6.2_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (35 commits) x86/mm: Ensure forced page table splitting x86/kasan: Populate shadow for shared chunk of the CPU entry area x86/kasan: Add helpers to align shadow addresses up and down x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area x86/mm: Recompute physical address for every page of per-CPU CEA mapping x86/mm: Rename __change_page_attr_set_clr(.checkalias) x86/mm: Inhibit _PAGE_NX changes from cpa_process_alias() x86/mm: Untangle __change_page_attr_set_clr(.checkalias) x86/mm: Add a few comments x86/mm: Fix CR3_ADDR_MASK x86/mm: Remove P*D_PAGE_MASK and P*D_PAGE_SIZE macros mm: Convert __HAVE_ARCH_P..P_GET to the new style mm: Remove pointless barrier() after pmdp_get_lockless() x86/mm/pae: Get rid of set_64bit() x86_64: Remove pointless set_64bit() usage x86/mm/pae: Be consistent with pXXp_get_and_clear() x86/mm/pae: Use WRITE_ONCE() x86/mm/pae: Don't (ab)use atomic64 mm/gup: Fix the lockless PMD access ... commit 03d84bd6d43269df2dc63b2945dfed6610fac526 Merge: f9ff5644bcc04 4545c6a3d6ba7 Author: Linus Torvalds Date: Sat Dec 17 13:58:09 2022 -0600 Merge tag 'msi-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms Pull MSI fixes from Marc Zyngier: "Thomas tasked me with sending out a few urgent fixes after the giant MSI rework that landed in 6.2, as both s390 and powerpc ended-up suffering from it (they do not use the full core code infrastructure, leading to these previously undetected issues): - Return MSI_XA_DOMAIN_SIZE as the maximum MSI index when the architecture does not make use of irq domains instead of returning 0, which is pretty limiting. - Check for the presence of an irq domain when validating the MSI iterator, as s390/powerpc won't have one. - Fix powerpc's MSI backends which fail to clear the descriptor's IRQ field on teardown, leading to a splat and leaked descriptors" * tag 'msi-fixes-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms: powerpc/msi: Fix deassociation of MSI descriptors genirq/msi: Return MSI_XA_DOMAIN_SIZE as the maximum MSI index when no domain is present genirq/msi: Check for the presence of an irq domain when validating msi_ctrl commit f9ff5644bcc04221bae56f922122f2b7f5d24d62 Merge: b220f31147d7b 3ffa9f713c39a Author: Linus Torvalds Date: Sat Dec 17 08:55:19 2022 -0600 Merge tag 'hsi-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: - misc small fixes * tag 'hsi-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_core: Fix error handling in ssi_init() headers: Remove some left-over license text in include/uapi/linux/hsi/ HSI: omap_ssi_core: fix possible memory leak in ssi_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: ssi_protocol: Fix return type of ssip_pn_xmit() commit b220f31147d7b5b504c1d27ae0d631f5bb1964af Merge: b611996ef270a 104bb8a663451 Author: Linus Torvalds Date: Sat Dec 17 08:39:31 2022 -0600 Merge tag 'for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - bq25890: add charge voltage/current support - bd99954: convert to linear range - convert all i2c drivers to use probe_new - misc fixes and cleanups * tag 'for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (51 commits) power: supply: fix null pointer dereferencing in power_supply_get_battery_info power: supply: bq25890: Fix usb-notifier probe and remove races power: supply: bq25890: Ensure pump_express_work is cancelled on remove power: supply: Fix refcount leak in rk817_charger_probe power: supply: bq25890: Only use pdata->regulator_init_data for vbus power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe() power: supply: z2_battery: Fix possible memleak in z2_batt_probe() power: supply: z2_battery: Convert to i2c's .probe_new() power: supply: ucs1002: Convert to i2c's .probe_new() power: supply: smb347: Convert to i2c's .probe_new() power: supply: sbs-manager: Convert to i2c's .probe_new() power: supply: sbs: Convert to i2c's .probe_new() power: supply: rt9455: Convert to i2c's .probe_new() power: supply: rt5033_battery: Convert to i2c's .probe_new() power: supply: max17042_battery: Convert to i2c's .probe_new() power: supply: max17040: Convert to i2c's .probe_new() power: supply: max14656: Convert to i2c's .probe_new() power: supply: ltc4162-l: Convert to i2c's .probe_new() power: supply: ltc2941: Convert to i2c's .probe_new() ... commit b611996ef270a88ebb350c82832c4d76913887e9 Merge: 75caf5940899a 9ec0b7e06835b Author: Linus Torvalds Date: Sat Dec 17 08:34:01 2022 -0600 Merge tag 'linux-watchdog-6.2-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add Advantech EC watchdog driver - Add support for MT6795 Helio X10 watchdog and toprgu - Add support for MT8188 watchdog device - Remove #ifdef guards for PM related functions - Other fixes and improvements * tag 'linux-watchdog-6.2-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog: aspeed: Enable pre-timeout interrupt watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running watchdog: rn5t618: add support for read out bootstatus watchdog: kempld: Remove #ifdef guards for PM related functions watchdog: omap: Remove #ifdef guards for PM related functions watchdog: twl4030: Remove #ifdef guards for PM related functions watchdog: at91rm9200: Remove #ifdef guards for PM related functions watchdog: Add Advantech EC watchdog driver dt-bindings: watchdog: mediatek,mtk-wdt: Add compatible for MT8173 dt-bindings: watchdog: mediatek,mtk-wdt: Add compatible for MT6795 dt-bindings: watchdog: mediatek: Convert mtk-wdt to json-schema watchdog: mediatek: mt8188: add wdt support dt-bindings: reset: mt8188: add toprgu reset-controller header file dt-bindings: watchdog: Add compatible for MediaTek MT8188 watchdog: mtk_wdt: Add support for MT6795 Helio X10 watchdog and toprgu commit 75caf5940899a33165fb3d521492f3cd6b20c9a7 Merge: ed56954cf5a8b 7cb092a0336c5 Author: Linus Torvalds Date: Sat Dec 17 08:28:25 2022 -0600 Merge tag 'leds-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: "Lee Jones offered his help with maintaining LEDs, thanks a lot. Plus, there are some bugfixes as a bonus" * tag 'leds-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: leds: MAINTAINERS: include dt-bindings headers leds: qcom,pm8058-led: Convert to DT schema leds: use sysfs_emit() to instead of scnprintf() leds: is31fl319x: Fix setting current limit for is31fl319{0,1,3} MAINTAINERS: Add additional co-maintainer to LEDs leds: lp5523: fix out-of-bounds bug in lp5523_selftest() dt-bindings: leds: Add 'cpuX' to 'linux,default-trigger' led: qcom-lpg: Fix sleeping in atomic leds: max8997: Don't error if there is no pdata leds: lp55xx: remove variable j leds-pca955x: Remove the unused function pca95xx_num_led_regs() commit ed56954cf5a8b7abb530676a073d14f9de661d69 Merge: 6830d50325ee2 5244ca88671a1 Author: Linus Torvalds Date: Sat Dec 17 08:23:42 2022 -0600 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Fix two build warnings on 32 bit platforms It seems the linux-next CI and 0-day bot are not testing enough 32 bit configurations, as soon as you merged the rdma pull request there were two instant reports of warnings on these sytems that I would have thought should have been covered by time in linux-next Anyhow, here are the fixes so people don't hit problems with -Werror" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/siw: Fix pointer cast warning RDMA/rxe: Fix compile warnings on 32-bit commit 6830d50325ee27fbf0150f77cbec1ed304a5b8f6 Merge: 77856d911a8c8 6b46a06100dd0 Author: Linus Torvalds Date: Sat Dec 17 08:18:04 2022 -0600 Merge tag 'gfs2-v6.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updtaes from Andreas Gruenbacher: - Revert a change to delete_work_func() that has gone wrong in commit c412a97cf6c5 ("gfs2: Use TRY lock in gfs2_inode_lookup for UNLINKED inodes"). - Avoid dequeuing GL_ASYNC glock holders twice by first checking if the holder is still queued. - gfs2: Always check the inode size of inline inodes when reading in inodes to prevent corrupt filesystem images from causing weid errors. - Properly handle a race between gfs2_create_inode() and gfs2_inode_lookup() that causes insert_inode_locked4() to return -EBUSY. - Fix and clean up the interaction between gfs2_create_inode() and gfs2_evict_inode() by completely handling the inode deallocation and destruction in gfs2_evict_inode(). - Remove support for glock holder auto-demotion as we have no current plans of using this feature again. - And a few more minor cleanups and clarifications. * tag 'gfs2-v6.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Remove support for glock holder auto-demotion (2) gfs2: Remove support for glock holder auto-demotion gfs2: Minor gfs2_try_evict cleanup gfs2: Partially revert gfs2_inode_lookup change gfs2: Add gfs2_inode_lookup comment gfs2: Uninline and improve glock_{set,clear}_object gfs2: Simply dequeue iopen glock in gfs2_evict_inode gfs2: Clean up after gfs2_create_inode rework gfs2: Avoid dequeuing GL_ASYNC glock holders twice gfs2: Make gfs2_glock_hold return its glock argument gfs2: Always check inode size of inline inodes gfs2: Cosmetic gfs2_dinode_{in,out} cleanup gfs2: Handle -EBUSY result of insert_inode_locked4 gfs2: Fix and clean up create / evict interaction gfs2: Clean up initialization of "ip" in gfs2_create_inode gfs2: Get rid of ghs[] in gfs2_create_inode gfs2: Add extra error check in alloc_dinode commit 731c4eac848ff9dd42776da8ed3407b257e3abf0 Author: Veronika Kabatova Date: Wed Dec 14 14:20:02 2022 +0100 buildtar: fix tarballs with EFI_ZBOOT enabled When CONFIG_EFI_ZBOOT is enabled, the binary name is not Image.gz anymore but vmlinuz.efi. No vmlinuz gets put into the tarball as the buildtar script doesn't recognize this name. Remedy this by adding the binary name to the list of acceptable files to package. Reported-by: CKI Project Signed-off-by: Veronika Kabatova Acked-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada commit 1bc5434632593ea3bb3a1ed2499af8c31796448b Author: Helge Deller Date: Wed Nov 16 21:46:03 2022 +0100 parisc: Fix inconsistent indenting in setup_cmdline() Fix warning reported by 0-DAY CI Kernel Test Service: arch/parisc/kernel/setup.c:64 setup_cmdline() warn: inconsistent indenting Reported-by: kernel test robot Signed-off-by: Helge Deller commit 4545c6a3d6ba71747eaa984c338ddd745e56e23f Author: Marc Zyngier Date: Sat Dec 17 10:46:44 2022 +0000 powerpc/msi: Fix deassociation of MSI descriptors Since 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()"), the core MSI code relies on the msi_desc->irq field to have been cleared before the descriptor can be freed, as it indicates that there is no association with a device anymore. The irq domain code provides this guarantee, and so does s390, which is one of the two architectures not using irq domains for MSIs. Powerpc, however, is missing this particular requirements, leading in a splat and leaked MSI descriptors. Adding the now required irq reset to the handful of powerpc backends that implement MSIs fixes that particular problem. Reported-by: Guenter Roeck Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/70dab88e-6119-0c12-7c6a-61bcbe239f66@roeck-us.net commit 2d7afdcbc9d32423f177ee12b7c93783aea338fb Author: Subash Abhinov Kasiviswanathan Date: Wed Dec 14 23:11:58 2022 -0700 skbuff: Account for tail adjustment during pull operations Extending the tail can have some unexpected side effects if a program uses a helper like BPF_FUNC_skb_pull_data to read partial content beyond the head skb headlen when all the skbs in the gso frag_list are linear with no head_frag - kernel BUG at net/core/skbuff.c:4219! pc : skb_segment+0xcf4/0xd2c lr : skb_segment+0x63c/0xd2c Call trace: skb_segment+0xcf4/0xd2c __udp_gso_segment+0xa4/0x544 udp4_ufo_fragment+0x184/0x1c0 inet_gso_segment+0x16c/0x3a4 skb_mac_gso_segment+0xd4/0x1b0 __skb_gso_segment+0xcc/0x12c udp_rcv_segment+0x54/0x16c udp_queue_rcv_skb+0x78/0x144 udp_unicast_rcv_skb+0x8c/0xa4 __udp4_lib_rcv+0x490/0x68c udp_rcv+0x20/0x30 ip_protocol_deliver_rcu+0x1b0/0x33c ip_local_deliver+0xd8/0x1f0 ip_rcv+0x98/0x1a4 deliver_ptype_list_skb+0x98/0x1ec __netif_receive_skb_core+0x978/0xc60 Fix this by marking these skbs as GSO_DODGY so segmentation can handle the tail updates accordingly. Fixes: 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list") Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/1671084718-24796-1-git-send-email-quic_subashab@quicinc.com Signed-off-by: Jakub Kicinski commit 214964a13ab56a9757d146b79b468a7ca190fbfb Author: Jakub Kicinski Date: Thu Dec 15 20:41:22 2022 -0800 devlink: protect devlink dump by the instance lock Take the instance lock around devlink_nl_fill() when dumping, doit takes it already. We are only dumping basic info so in the worst case we were risking data races around the reload statistics. Until the big devlink mutex was removed all relevant code was protected by it, so the missing instance lock was not exposed. Fixes: d3efc2a6a6d8 ("net: devlink: remove devlink_mutex") Reviewed-by: Jiri Pirko Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20221216044122.1863550-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 078838f5b9c9203e94d7724f997392ea8012ea6a Author: Arnd Bergmann Date: Thu Dec 15 17:39:05 2022 +0100 net: ethernet: ti: am65-cpsw: fix CONFIG_PM #ifdef The #ifdef check is incorrect and leads to a warning: drivers/net/ethernet/ti/am65-cpsw-nuss.c:1679:13: error: 'am65_cpsw_nuss_remove_rx_chns' defined but not used [-Werror=unused-function] 1679 | static void am65_cpsw_nuss_remove_rx_chns(void *data) It's better to remove the #ifdef here and use the modern SYSTEM_SLEEP_PM_OPS() macro instead. Fixes: 24bc19b05f1f ("net: ethernet: ti: am65-cpsw: Add suspend/resume support") Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20221215163918.611609-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 3c44e2b6cde674797b76e76d3a903a63ce8a18bb Author: Dmitry Torokhov Date: Fri Dec 16 13:15:34 2022 -0800 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" This reverts commit ac5408991ea6b06e29129b4d4861097c4c3e0d59 because it causes loss of keyboard on HP 15-da1xxx. Fixes: ac5408991ea6 ("Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode") Reported-by: Jiri Slaby Link: https://lore.kernel.org/r/824effa5-8b9a-c28a-82bb-9b0ab24623e1@kernel.org Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1206358 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 7535b832c6399b5ebfc5b53af5c51dd915ee2538 Author: Kees Cook Date: Fri Dec 16 12:26:57 2022 -0800 exit: Use READ_ONCE() for all oops/warn limit reads Use a temporary variable to take full advantage of READ_ONCE() behavior. Without this, the report (and even the test) might be out of sync with the initial test. Reported-by: Peter Zijlstra Link: https://lore.kernel.org/lkml/Y5x7GXeluFmZ8E0E@hirez.programming.kicks-ass.net Fixes: 9fc9e278a5c0 ("panic: Introduce warn_limit") Fixes: d4ccd54d28d3 ("exit: Put an upper limit on how often we can oops") Cc: "Eric W. Biederman" Cc: Jann Horn Cc: Arnd Bergmann Cc: Petr Mladek Cc: Andrew Morton Cc: Luis Chamberlain Cc: Marco Elver Cc: tangmeng Cc: Sebastian Andrzej Siewior Cc: Tiezhu Yang Signed-off-by: Kees Cook commit 5244ca88671a1981ceec09c5c8809f003e6a62aa Author: Arnd Bergmann Date: Thu Dec 15 18:03:43 2022 +0100 RDMA/siw: Fix pointer cast warning The previous build fix left a remaining issue in configurations with 64-bit dma_addr_t on 32-bit architectures: drivers/infiniband/sw/siw/siw_qp_tx.c: In function 'siw_get_pblpage': drivers/infiniband/sw/siw/siw_qp_tx.c:32:37: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] 32 | return virt_to_page((void *)paddr); | ^ Use the same double cast here that the driver uses elsewhere to convert between dma_addr_t and void*. Fixes: 0d1b756acf60 ("RDMA/siw: Pass a pointer to virt_to_page()") Link: https://lore.kernel.org/r/20221215170347.2612403-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Acked-by: Bernard Metzler Reviewed-by: Linus Walleij Signed-off-by: Jason Gunthorpe commit 77856d911a8c8724ee8e2b09d55979fc1de8f1c0 Merge: aa4800e31c547 c0cd1d541704c Author: Linus Torvalds Date: Fri Dec 16 13:46:41 2022 -0600 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Fix Kconfig dependencies to re-allow the enabling of function graph tracer and shadow call stacks at the same time. - Revert the workaround for CPU erratum #2645198 since the CONFIG_ guards were incorrect and the code has therefore not seen any real exposure in -next. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: Revert "arm64: errata: Workaround possible Cortex-A715 [ESR|FAR]_ELx corruption" ftrace: Allow WITH_ARGS flavour of graph tracer with shadow call stack commit aa4800e31c547ed00681318335ca2298c4bca33a Merge: dcde56bb37a9f 4ff17c448a7b0 Author: Linus Torvalds Date: Fri Dec 16 13:21:20 2022 -0600 Merge tag 'perf-tools-for-v6.2-1-2022-12-16' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools updates from Arnaldo Carvalho de Melo: "Libraries: - Drop the old copy of libtraceevent in tools/lib/traceevent/ now that all major distros ship it from its external repository. This is now just another feature detection, emitting a warning when the libtraceevent-dev[el] package isn't installed, disabling the build of perf features and tools that strictly require parsing things from tracefs while keeping the core functionality present and working with a subset of the events, the most used ones like CPU cycles, hardware cache and also vendor events, etc. This was tested with lots of containers for Fedora, Debian, OpenSUSE, Alpine Linux, Ubuntu, with cross builds, etc. Build: - Update to C standard to gnu11, like was done for the kernel. - Install the tools/lib/ libraries locally instead of having headers searched directly from the source code directories, to help the cases where we can build either from in-kernel source libraries or from the same library shipped as a distro package, as is the case with libbpf and was the case with libtraceevent. perf stat: - Do not delay the workload with --delay, the delay is just for starting to count the events, to skip noise at workload startup. - When we have events for each cgroup, the metric should be printed for each cgroup separately. $ perf stat -a --for-each-cgroup system.slice,user.slice --metric-only sleep 1 Performance counter stats for 'system wide': GHz insn per cycle branch-misses of all branches system.slice 3.792 0.61 3.24% user.slice 3.661 2.32 0.37% - Fix printing field separator in CSV metrics output. - Fix --metric-only --json output. - Fix summary output in CSV with --metric-only. - Update event group check for support of uncore event. perf test: - Stop requiring a C toolchain in shell tests, instead add a workload option that has all the previously C snippets built as part of 'perf test -w' that then get used in the 'perf test' shell scripts. - Add event group test for events in multiple PMUs - The "kernel lock contention analysis" test should not print warnings in quiet mode. - Add attr tests for ARM64's new VG register. - Fix record test on KVM guests, as using precise flag with the br_inst_retired.near_call event causes the test fail on KVM guests, even when the guests have PMU forwarding enabled and the event itself is supported, so just remove the precise flag from the event. - Add mechanism for skipping attr tests on specific kernel versions where it is known that these checks will fail. - Skip watchpoint tests if no watchpoints available. - Add more Intel PT 'perf test' entries: hybrid CPUs, split the packet decoder into a suite of subtests. perf script: - Introduce task analyzer python script, where one first records some events: Recording can be done in two ways: $ perf script record tasks-analyzer -- sleep 10 $ perf record -e sched:sched_switch -a -- sleep 10 The script can parse any perf.data files, as long as it has sched:sched_switch events, other events will be ignored. The most simple report use case is to just call the script without arguments. Runtime is the time the task was running on the CPU, Time Out-In is the time between the process being scheduled *out* and scheduled back *in*. So the last time span between two executions: $ perf script report tasks-analyzer Switched-In Switched-Out CPU PID TID Comm Runtime Time Out-In 15576.658891407 15576.659156086 4 2412 2428 gdbus 265 1949 15576.659111320 15576.659455410 0 2412 2412 gnome-shell 344 2267 15576.659491326 15576.659506173 2 74 74 kworker/2:1 15 13145 15576.659506173 15576.659825748 2 2858 2858 gnome-terminal- 320 63263 15576.659871270 15576.659902872 6 20932 20932 kworker/u16:0 32 2314582 15576.659909951 15576.659945501 3 27264 27264 sh 36 -1 15576.659853285 15576.659971052 7 27265 27265 perf 118 5050741 [...] perf lock: - Allow concurrent record and report to support live monitoring of kernel lock contention without BPF: # perf lock record -a -o- sleep 1 | perf lock contention -i- contended total wait max wait avg wait type caller 2 10.27 us 6.17 us 5.13 us spinlock load_balance+0xc03 1 5.29 us 5.29 us 5.29 us rwlock:W ep_scan_ready_list+0x54 1 4.12 us 4.12 us 4.12 us spinlock smpboot_thread_fn+0x116 1 3.28 us 3.28 us 3.28 us mutex pipe_read+0x50 - Implement -t/--threads option when using BPF: $ sudo ./perf lock contention -abt -E 5 sleep 1 contended total wait max wait avg wait pid comm 1 740.66 ms 740.66 ms 740.66 ms 1950 nv_queue 3 305.50 ms 298.19 ms 101.83 ms 1884 nvidia-modeset/ 1 25.14 us 25.14 us 25.14 us 2725038 EventManager_De 12 23.09 us 9.30 us 1.92 us 0 swapper 1 20.18 us 20.18 us 20.18 us 2725033 EventManager_De - Add -l/--lock-addr to aggregate per-lock-instance contention: $ sudo ./perf lock contention -abl sleep 1 contended total wait max wait avg wait address symbol 1 36.28 us 36.28 us 36.28 us ffff92615d6448b8 9 10.91 us 1.84 us 1.21 us ffffffffbaed50c0 rcu_state 1 10.49 us 10.49 us 10.49 us ffff9262ac4f0c80 8 4.68 us 1.67 us 585 ns ffffffffbae07a40 jiffies_lock 3 3.03 us 1.45 us 1.01 us ffff9262277861e0 1 924 ns 924 ns 924 ns ffff926095ba9d20 1 436 ns 436 ns 436 ns ffff9260bfda4f60 perf record: - Add remaining branch filters: "no_cycles", "no_flags" & "hw_index", to be used with hardware such as Intel's LBR that allows things like stitching stacks of two samples to overcome the limits of the number of LBR registers. Symbol resolution: - Handle .debug files created with 'objcopy --only-keep-debug', where program headers are zeroed and thus can't be used for adjustments, use the info in the runtime_ss (runtime ELF) instead. perf trace: - Add BPF based augmenter for the 'perf_event_open's 'struct perf_event_attr' argument. - Add BPF based augmenter for the 'clock_gettime's 'struct timespec' argument. - In both cases the syscall tracepoint has just the pointer value, we need to hook a BPF program to collect the pointer contents, and then, in userspace, pretty print it in 'perf trace'. perf list: - Introduce JSON output of events. - Streamline how the expression specifying what events should be shown is handled, fixing several corner cases, such as the metric filter that is specified as a glob but was using strstr(). perf probe: - Fix to avoid crashing if DW_AT_decl_file is NULL, coping with clang generating DWARF5 like that. - Use dwarf_attr_integrate() as generic DWARF attr accessor as it supersedes dwarf_attr(), supporting abstact origin DIEs. perf inject: - Set PERF_RECORD_MISC_BUILD_ID_SIZE in the PERF_RECORD_HEADER_BUILD_ID so that perf.data readers can get the real build-id size and avoid trailing zeroes. perf data: - Add tracepoint fields when converting a perf.data file to JSON. arm64: - Fix mksyscalltbl, don't lose syscalls due to sort -nu. - Add Arm Neoverse V2 PMU events. riscv: - Add riscv sbi firmware std event files. - Add Sifive U74 vendor events (JSON) file. - Add some more events and metrics for Alderlake/Alderlake-N. Documentation: - Add data documentation for the PMU structs in the C source code. Miscellaneous: - Periodic sanitization of headers, adding missing includes, removing needless ones, creating new ones, etc. - Use sig_atomic_t for signal handlers to avoid undefined behaviour in all perf tools. - Fixes for libbpf 1.0+ compatibility (maps, etc) on 'perf trace' BPF examples. - Remove some old perf bpf examples, leave the best ones that demonstrate how to associate BPF functions to points in the kernel. - Make quiet mode consistent between tools. - Use dedicated non-atomic clear/set bit helpers. - Use "grep -E" instead of "egrep" as recommended by warning emitted by GNU grep since at least version 3.8. - Complete list of supported subcommands in the 'perf daemon' help message. - Update John Garry's email address for arm64 perf tooling on the MAINTAINERS file, he moved from Huawei to Oracle" * tag 'perf-tools-for-v6.2-1-2022-12-16' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (239 commits) libperf: Fix install_pkgconfig target perf tools: Use "grep -E" instead of "egrep" perf stat: Do not delay the workload with --delay perf evlist: Remove group option. perf build: Fix python/perf.so library's name perf test arm64: Add attr tests for new VG register perf test: Add mechanism for skipping attr tests on kernel versions perf test: Add mechanism for skipping attr tests on auxiliary vector values perf test: Add ability to test exit code for attr tests perf test: add new task-analyzer tests perf script: task-analyzer add csv support perf script: Introduce task analyzer python script perf cs-etm: Print auxtrace info even if OpenCSD isn't linked perf cs-etm: Cleanup cs_etm__process_auxtrace_info() perf cs-etm: Tidy up auxtrace info header printing perf cs-etm: Remove unused stub methods perf cs-etm: Print unknown header version as an error perf test: Update perf lock contention test perf lock contention: Add -l/--lock-addr option perf lock contention: Implement -t/--threads option for BPF ... commit 86fe0fa8747fb1bc4cc44fc1966e0959fe752f38 Author: Paulo Alcantara Date: Fri Dec 16 14:00:19 2022 -0300 cifs: set correct ipc status after initial tree connect cifs_tcon::status wasn't correctly updated to TID_GOOD after establishing initial IPC connection thus staying at TID_NEW as long as it wasn't reconnected. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit dcde56bb37a9f900c11eec56b0ecaca5653cc829 Author: Linus Torvalds Date: Fri Dec 16 13:04:15 2022 -0600 Fix mismerge due to devnode now taking a 'const *' device This was a mismerge of a semantic conflict in my merge of the driver core updates, where commit ff62b8e6588f ("driver core: make struct class.devnode() take a const *") changed the devnode function pointer type. In the meantime, the drm tree I merged earlier had introduced a new use of that in commit 8bf4889762a8 ("drivers/accel: define kconfig and register a new major"). And of course this happens when I'm traveling with my laptop, and thus didn't do a full allmodconfig build between every pull and before pushing my work out. So I only noticed later as I was doing my full build. Brown-paper-bag-by: Linus Torvalds Fixes: 71a7507afbc3 Merge tag 'driver-core-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Signed-off-by: Linus Torvalds commit 3367934dd3035afa72ac79ae649f142a530df157 Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:15 2022 +0100 dt-bindings: drop redundant part of title (manual) The Devicetree bindings document does not have to say in the title that it is a "Devicetree binding" or a "schema", but instead just describe the hardware. Manual updates to various binding titles, including capitalizing them. Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Reviewed-by: Jonathan Cameron Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Dmitry Torokhov # input Acked-by: Mark Brown Acked-by: Viresh Kumar # opp Link: https://lore.kernel.org/r/20221216163815.522628-10-krzysztof.kozlowski@linaro.org [robh: add trivial-devices.yaml and net/can/microchip,mcp251xfd.yaml] Signed-off-by: Rob Herring commit 13e3c7793e2fa2707455aaf66f2498ed4a00d6e2 Merge: 68bb10101e6b0 f506439ec3dee Author: Jakub Kicinski Date: Fri Dec 16 10:41:55 2022 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2022-12-16 We've added 7 non-merge commits during the last 2 day(s) which contain a total of 9 files changed, 119 insertions(+), 36 deletions(-). 1) Fix for recent syzkaller XDP dispatcher update splat, from Jiri Olsa. 2) Fix BPF program refcount leak in LSM attachment failure path, from Milan Landaverde. 3) Fix BPF program type in map compatibility check for fext, from Toke Høiland-Jørgensen. 4) Fix a BPF selftest compilation error under !CONFIG_SMP config, from Yonghong Song. 5) Fix CI to enable CONFIG_FUNCTION_ERROR_INJECTION after it got changed to a prompt, from Song Liu. 6) Various BPF documentation fixes for socket local storage, from Donald Hunter. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add a test for using a cpumap from an freplace-to-XDP program bpf: Resolve fext program type when checking map compatibility bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func bpf: prevent leak of lsm program after failed attach selftests/bpf: Select CONFIG_FUNCTION_ERROR_INJECTION selftests/bpf: Fix a selftest compilation error with CONFIG_SMP=n docs/bpf: Reword docs for BPF_MAP_TYPE_SK_STORAGE ==================== Link: https://lore.kernel.org/r/20221216174540.16598-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 33cd7c6fffa3c546b3fce3b000d4b83f88c01e0d Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:14 2022 +0100 dt-bindings: clock: drop redundant part of title The Devicetree bindings document does not have to say in the title that it is a "Devicetree binding", but instead just describe the hardware. Drop "Devicetree bindings" in various forms: find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -exec sed -i -e 's/^title: [dD]evice[ -]\?[tT]ree [cC]lock [bB]indings\? for \([tT]he \)\?\(.*\)$/title: \u\2 Clock Controller/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -exec sed -i -e 's/^title: [cC]lock [bB]indings\? for \([tT]he \)\?\(.*\)$/title: \u\2 Clock Controller/' {} \; Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Reviewed-by: Jonathan Cameron Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Link: https://lore.kernel.org/r/20221216163815.522628-9-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 9d69d47fd399137d41b744065aab2f9677ccc377 Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:13 2022 +0100 dt-bindings: drop redundant part of title (beginning) The Devicetree bindings document does not have to say in the title that it is a "Devicetree binding", but instead just describe the hardware. Drop beginning "Devicetree bindings" in various forms: find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -exec sed -i -e 's/^title: [dD]evice[ -]\?[tT]ree [bB]indings\? for \([tT]he \)\?\(.*\)$/title: \u\2/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -exec sed -i -e 's/^title: [bB]indings\? for \([tT]he \)\?\(.*\)$/title: \u\2/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -exec sed -i -e 's/^title: [dD][tT] [bB]indings\? for \([tT]he \)\?\(.*\)$/title: \u\2/' {} \; Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Reviewed-by: Jonathan Cameron Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Dmitry Torokhov # input Acked-by: Mark Brown Acked-by: Sebastian Reichel # power Link: https://lore.kernel.org/r/20221216163815.522628-8-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 84e85359f4999a439aa12e04bf0ae9e13e00fc66 Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:12 2022 +0100 dt-bindings: drop redundant part of title (end, part three) The Devicetree bindings document does not have to say in the title that it is a "binding", but instead just describe the hardware. Drop trailing "bindings" in various forms (also with trailing full stop): find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [bB]indings\?\.\?$/title: \1/' {} \; Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Matti Vaittinen # ROHM Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Dmitry Torokhov # input Acked-by: Mark Brown Acked-by: Hans Verkuil # media Acked-by: Sebastian Reichel # power Acked-by: Viresh Kumar # cpufreq Link: https://lore.kernel.org/r/20221216163815.522628-7-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 9fa3ad1a1ab31da4887b48e68ad529af78f119b6 Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:11 2022 +0100 dt-bindings: drop redundant part of title (end, part two) The Devicetree bindings document does not have to say in the title that it is a "binding", but instead just describe the hardware. Drop trailing "Node|Tree|Generic bindings" in various forms (also with trailing full stop): find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [nN]ode [bB]indings\?\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [tT]ree [bB]indings\?\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [gG]eneric [bB]indings\?\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [bB]indings\? description\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [bB]indings\? document\.\?$/title: \1/' {} \; Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Reviewed-by: Jonathan Cameron Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Vinod Koul # phy Acked-by: Mark Brown Link: https://lore.kernel.org/r/20221216163815.522628-6-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit a612130ca1a650b0ba3599fc3199143eb9e7060d Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:10 2022 +0100 dt-bindings: drop redundant part of title (end) The Devicetree bindings document does not have to say in the title that it is a "Devicetree binding", but instead just describe the hardware. Drop trailing "Devicetree bindings" in various forms (also with trailing full stop): find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [dD]evice[ -]\?[tT]ree [bB]indings\?\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [dD]evice[ -]\?[nN]ode [bB]indings\?\.\?$/title: \1/' {} \; find Documentation/devicetree/bindings/ -type f -name '*.yaml' \ -not -name 'trivial-devices.yaml' \ -exec sed -i -e 's/^title: \(.*\) [dD][tT] [bB]indings\?\.\?$/title: \1/' {} \; Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Jonathan Cameron # IIO Reviewed-by: Jonathan Cameron Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Dmitry Torokhov # input Acked-by: Mark Brown Acked-by: Hans Verkuil # media Acked-by: Sebastian Reichel # power Link: https://lore.kernel.org/r/20221216163815.522628-5-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit a0c2153dcfa0a7f58f189622c6c045ff5aafe08e Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:09 2022 +0100 dt-bindings: clock: st,stm32mp1-rcc: add proper title Add device name in the title, because "Reset Clock Controller" sounds too generic. Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20221216163815.522628-4-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 9d94e28505f8033adf98434573074b400c081902 Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:08 2022 +0100 dt-bindings: memory-controllers: ti,gpmc-child: drop redundant part of title The Devicetree bindings document does not have to say in the title that it is a "Devicetree binding", but instead just describe the hardware. Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Ulf Hansson # MMC Link: https://lore.kernel.org/r/20221216163815.522628-3-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit ab040c42237f47dffbb1b83bd4e29f739b3a917e Author: Krzysztof Kozlowski Date: Fri Dec 16 17:38:07 2022 +0100 dt-bindings: drop redundant part of title of shared bindings The Devicetree bindings document does not have to say in the title that it is a "binding", but instead just describe the hardware. For shared (re-usable) schemas, name them all as "common properties". Signed-off-by: Krzysztof Kozlowski Acked-by: Guenter Roeck # watchdog Acked-by: Alexandre Belloni Acked-by: Jonathan Cameron # IIO Acked-by: Miquel Raynal Acked-by: Ulf Hansson # MMC Acked-by: Stephen Boyd # clk Acked-by: Vinod Koul # dma Acked-by: Mark Brown Acked-by: Hans Verkuil # media Acked-by: Sebastian Reichel # power Acked-by: Viresh Kumar # opp Link: https://lore.kernel.org/r/20221216163815.522628-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit e21a77d8dabe3c6384cdd485cb129c7d2a426708 Author: Marek Vasut Date: Mon Nov 7 17:03:38 2022 +0100 dt-bindings: watchdog: gpio: Convert bindings to YAML Convert the gpio-wdt bindings from text to YAML ones, to permit DT validation. Reviewed-by: Rob Herring Signed-off-by: Marek Vasut Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221107160338.27910-1-marex@denx.de [robh: add missing 'always-running'] Signed-off-by: Rob Herring commit 1a2cead15bcfac872c15457ef50ffbbe5ff641bc Author: Marek Vasut Date: Sun Dec 11 03:48:59 2022 +0100 dt-bindings: imx6q-pcie: Handle more resets on legacy platforms The i.MX6 and i.MX7D does not use block controller to toggle PCIe reset, hence the PCIe DT description contains three reset entries on these older SoCs. Add this exception into the binding document. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20221211024859.672076-3-marex@denx.de Signed-off-by: Rob Herring commit 8b8161edf14acab716c01d03bafc8a3e8113a43a Author: Marek Vasut Date: Sun Dec 11 03:48:58 2022 +0100 dt-bindings: imx6q-pcie: Handle various PD configurations The i.MX SoCs have various power domain configurations routed into the PCIe IP. MX6SX is the only one which contains 2 domains and also uses power-domain-names. MX6QDL do not use any domains. All the rest uses one domain and does not use power-domain-names anymore. Document all those configurations in the DT binding document. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20221211024859.672076-2-marex@denx.de Signed-off-by: Rob Herring commit 22c9f19002c7536b30bc15b6fb6276d62be2f758 Author: Marek Vasut Date: Sun Dec 11 03:48:57 2022 +0100 dt-bindings: imx6q-pcie: Handle various clock configurations The i.MX SoCs have various clock configurations routed into the PCIe IP, the list of clock is below. Document all those configurations in the DT binding document. All SoCs: pcie, pcie_bus 6QDL, 7D: + pcie_phy 6SX: + pcie_phy pcie_inbound_axi 8MQ: + pcie_phy pcie_aux 8MM, 8MP: + pcie_aux Reviewed-by: Rob Herring Acked-by: Alexander Stein Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20221211024859.672076-1-marex@denx.de Signed-off-by: Rob Herring commit 435beb4110da372c313398891ca9eee87f83d3db Author: Krzysztof Kozlowski Date: Tue Dec 13 11:06:26 2022 +0100 dt-bindings: hwmon: ntc-thermistor: drop Naveen Krishna Chatradhi from maintainers Emails to Naveen Krishna Chatradhi bounce ("550 5.1.1 Recipient address rejected: User unknown"). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221213100626.36150-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit f62678a77d585cf3f6302a5a4e2265b1a97b004b Author: Marek Vasut Date: Tue Dec 13 14:20:06 2022 +0100 dt-bindings: mxsfb: Document i.MX8M/i.MX6SX/i.MX6SL power-domains property The power-domains property is mandatory on i.MX8M Mini, Nano, Plus and i.MX6SX, i.MX6SL. Document the property and mark it as required on the aforementioned variants of the IP, present in those SoCs. Signed-off-by: Marek Vasut Reviewed-by: Krzysztof Kozlowski Reviewed-by: Liu Ying Link: https://lore.kernel.org/r/20221213132006.6446-1-marex@denx.de Signed-off-by: Rob Herring commit 5fa9f7292b17bcd66da93226fc28fe1f755af154 Author: Krzysztof Kozlowski Date: Fri Dec 2 12:05:36 2022 +0100 dt-bindings: vendor-prefixes: sort entries alphabetically Sort entries alphabetically. This was a semi manual job with help of: cat Documentation/devicetree/bindings/vendor-prefixes.yaml | grep '":' > old cat old | sort > new diff -ubB old new Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221202110536.22230-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit d8a76e46d7d3d6db5458d7f46205153ca9a53afd Author: Thierry Reding Date: Wed Nov 30 16:41:11 2022 +0100 dt-bindings: usb: tegra-xusb: Remove path references Unresolved path references are now flagged as errors when checking the device tree binding examples, so convert them into label references. Reported-by: Conor Dooley Suggested-by: Rob Herring Signed-off-by: Thierry Reding Acked-by: Rob Herring Tested-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221130154111.1655603-1-thierry.reding@gmail.com Signed-off-by: Rob Herring commit a7d550f82b445cf218b47a2c1a9c56e97ecb8c7a Author: Alexander Sverdlin Date: Mon Dec 12 00:58:17 2022 +0100 of: fdt: Honor CONFIG_CMDLINE* even without /chosen node I do not read a strict requirement on /chosen node in either ePAPR or in Documentation/devicetree. Help text for CONFIG_CMDLINE and CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on the presence of /chosen or the presense of /chosen/bootargs. However the early check for /chosen and bailing out in early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not really related to /chosen node or the particular method of passing cmdline from bootloader. This leads to counterintuitive combinations (assuming CONFIG_CMDLINE_EXTEND=y): a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar" b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline=="" c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar" Move CONFIG_CMDLINE handling outside of early_init_dt_scan_chosen() so that cases b and c above result in the same cmdline. Signed-off-by: Alexander Sverdlin Reviewed-by: Linus Walleij Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/11af73e05bad75e4ef49067515e3214f6d944b3d.camel@gmail.com Signed-off-by: Rob Herring commit 53eab8e76667b124615a943a033cdf97c80c242a Author: Jens Axboe Date: Fri Dec 16 08:20:31 2022 -0700 block: don't clear REQ_ALLOC_CACHE for non-polled requests Since commit: b99182c501c3 ("bio: add pcpu caching for non-polling bio_put") we support bio caching for IRQ based IO as well, hence there's no need to manually clear REQ_ALLOC_CACHE if we disable polling on a request. Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit e982ad82bd8f7931f5788a15dfa3709f7a7ee79f Author: Thomas Gleixner Date: Fri Dec 16 11:08:52 2022 +0000 genirq/msi: Return MSI_XA_DOMAIN_SIZE as the maximum MSI index when no domain is present On architectures such as s390 that do not use irq domains for MSI, returning 0 as the maximum MSI index is a bit counter-productive, as it indicates that no MSI can be allocated. Bad idea. Instead, return the maximum we're willing to support in the MSI backing store (MSI_XA_DOMAIN_SIZE), and let the arch code do its usual thing. Thanks to Matthew Rosato for fixing the fix. Reported-by: Guenter Roeck Signed-off-by: Thomas Gleixner [maz: commit message] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/87fsdgzpqs.ffs@tglx commit db3568fd80a3999413c04ea0cf52596b7b0ad9aa Author: Marc Zyngier Date: Fri Dec 16 11:03:02 2022 +0000 genirq/msi: Check for the presence of an irq domain when validating msi_ctrl For architectures such as s390 and powerpc that do not use irq domains for MSIs, dev->msi.domain is always NULL, so the per-device, per-bus MSI domain is also guaranteed to be NULL. So checking one without checking the other is bound to result in a splat, followed by a memory leak as we don't free the MSI descriptors. Add the missing check. Reported-by: Matthew Rosato Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/e570e70d-19bc-101b-0481-ff9a3cab3504@linux.ibm.com commit 4ff17c448a7b0f437a17622d67f1c5c609c3a0e9 Author: Alexander Gordeev Date: Fri Dec 16 10:50:41 2022 +0100 libperf: Fix install_pkgconfig target Commit 47e02b94a4c98dcc ("tools lib perf: Add dependency test to install_headers") misses the notion of $(DESTDIR_SQ) for install_pkgconfig target, which leads to error: install: cannot create regular file '/usr/lib64/pkgconfig/libperf.pc': Permission denied make: *** [Makefile:210: install_pkgconfig] Error 1 Signed-off-by: Alexander Gordeev Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: http://lore.kernel.org/lkml/Y5w/cWKyb8vpNMfA@li-4a3a4a4c-28e5-11b2-a85c-a8d192c6f089.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 980411a4d1bb925d28cd9e8d8301dc982ece788d Author: Michael Ellerman Date: Fri Dec 16 12:43:12 2022 +1100 powerpc/code-patching: Fix oops with DEBUG_VM enabled Nathan reported that the new per-cpu mm patching oopses if DEBUG_VM is enabled: ------------[ cut here ]------------ kernel BUG at arch/powerpc/mm/pgtable.c:333! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc2+ #1 Hardware name: IBM PowerNV (emulated by qemu) POWER9 0x4e1200 opal:v7.0 PowerNV ... NIP assert_pte_locked+0x180/0x1a0 LR assert_pte_locked+0x170/0x1a0 Call Trace: 0x60000000 (unreliable) patch_instruction+0x618/0x6d0 arch_prepare_kprobe+0xfc/0x2d0 register_kprobe+0x520/0x7c0 arch_init_kprobes+0x28/0x3c init_kprobes+0x108/0x184 do_one_initcall+0x60/0x2e0 kernel_init_freeable+0x1f0/0x3e0 kernel_init+0x34/0x1d0 ret_from_kernel_thread+0x5c/0x64 It's caused by the assert_spin_locked() failing in assert_pte_locked(). The assert fails because the PTE was unlocked in text_area_cpu_up_mm(), and never relocked. The PTE page shouldn't be freed, the patching_mm is only used for patching on this CPU, only that single PTE is ever mapped, and it's only unmapped at CPU offline. In fact assert_pte_locked() has a special case to ignore init_mm entirely, and the patching_mm is more-or-less like init_mm, so possibly the check could be skipped for patching_mm too. But for now be conservative, and use the proper PTE accessors at patching time, so that the PTE lock is held while the PTE is used. That also avoids the warning in assert_pte_locked(). With that it's no longer necessary to save the PTE in cpu_patching_context for the mm_patch_enabled() case. Fixes: c28c15b6d28a ("powerpc/code-patching: Use temporary mm for Radix MMU") Reported-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221216125913.990972-1-mpe@ellerman.id.au commit 1a931707ad4a46e79d4ecfee56d8f6e8cc8d4f28 Merge: 818448e9cf92e 84e57d292203a Author: Arnaldo Carvalho de Melo Date: Fri Dec 16 09:53:53 2022 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To resolve a trivial merge conflict with c302378bc157f6a7 ("libbpf: Hashmap interface update to allow both long and void* keys/values"), where a function present upstream was removed in the perf tools development tree. Signed-off-by: Arnaldo Carvalho de Melo commit 71a7507afbc3f27c346898f13ab9bfd918613c34 Merge: ba54ff1fb6622 f18caf261398a Author: Linus Torvalds Date: Fri Dec 16 03:54:54 2022 -0800 Merge tag 'driver-core-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the set of driver core and kernfs changes for 6.2-rc1. The "big" change in here is the addition of a new macro, container_of_const() that will preserve the "const-ness" of a pointer passed into it. The "problem" of the current container_of() macro is that if you pass in a "const *", out of it can comes a non-const pointer unless you specifically ask for it. For many usages, we want to preserve the "const" attribute by using the same call. For a specific example, this series changes the kobj_to_dev() macro to use it, allowing it to be used no matter what the const value is. This prevents every subsystem from having to declare 2 different individual macros (i.e. kobj_const_to_dev() and kobj_to_dev()) and having the compiler enforce the const value at build time, which having 2 macros would not do either. The driver for all of this have been discussions with the Rust kernel developers as to how to properly mark driver core, and kobject, objects as being "non-mutable". The changes to the kobject and driver core in this pull request are the result of that, as there are lots of paths where kobjects and device pointers are not modified at all, so marking them as "const" allows the compiler to enforce this. So, a nice side affect of the Rust development effort has been already to clean up the driver core code to be more obvious about object rules. All of this has been bike-shedded in quite a lot of detail on lkml with different names and implementations resulting in the tiny version we have in here, much better than my original proposal. Lots of subsystem maintainers have acked the changes as well. Other than this change, included in here are smaller stuff like: - kernfs fixes and updates to handle lock contention better - vmlinux.lds.h fixes and updates - sysfs and debugfs documentation updates - device property updates All of these have been in the linux-next tree for quite a while with no problems" * tag 'driver-core-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (58 commits) device property: Fix documentation for fwnode_get_next_parent() firmware_loader: fix up to_fw_sysfs() to preserve const usb.h: take advantage of container_of_const() device.h: move kobj_to_dev() to use container_of_const() container_of: add container_of_const() that preserves const-ness of the pointer driver core: fix up missed drivers/s390/char/hmcdrv_dev.c class.devnode() conversion. driver core: fix up missed scsi/cxlflash class.devnode() conversion. driver core: fix up some missing class.devnode() conversions. driver core: make struct class.devnode() take a const * driver core: make struct class.dev_uevent() take a const * cacheinfo: Remove of_node_put() for fw_token device property: Add a blank line in Kconfig of tests device property: Rename goto label to be more precise device property: Move PROPERTY_ENTRY_BOOL() a bit down device property: Get rid of __PROPERTY_ENTRY_ARRAY_EL*SIZE*() kernfs: fix all kernel-doc warnings and multiple typos driver core: pass a const * into of_device_uevent() kobject: kset_uevent_ops: make name() callback take a const * kobject: kset_uevent_ops: make filter() callback take a const * kobject: make kobject_namespace take a const * ... commit ba54ff1fb662215de683777f815b9e96276d55cf Merge: dd6f9b17cd7af f361c96c75184 Author: Linus Torvalds Date: Fri Dec 16 03:49:24 2022 -0800 Merge tag 'char-misc-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the large set of char/misc and other driver subsystem changes for 6.2-rc1. Nothing earth-shattering in here at all, just a lot of new driver development and minor fixes. Highlights include: - fastrpc driver updates - iio new drivers and updates - habanalabs driver updates for new hardware and features - slimbus driver updates - speakup module parameters added to aid in boot time configuration - i2c probe_new conversions for lots of different drivers - other small driver fixes and additions One semi-interesting change in here is the increase of the number of misc dynamic minors available to 1048448 to handle new huge-cpu systems. All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (521 commits) extcon: usbc-tusb320: Convert to i2c's .probe_new() extcon: rt8973: Convert to i2c's .probe_new() extcon: fsa9480: Convert to i2c's .probe_new() extcon: max77843: Replace irqchip mask_invert with unmask_base chardev: fix error handling in cdev_device_add() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() drivers: mcb: fix resource leak in mcb_probe() coresight: etm4x: fix repeated words in comments coresight: cti: Fix null pointer error on CTI init before ETM coresight: trbe: remove cpuhp instance node before remove cpuhp state counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update misc: fastrpc: Add dma_mask to fastrpc_channel_ctx misc: fastrpc: Add mmap request assigning for static PD pool misc: fastrpc: Safekeep mmaps on interrupted invoke misc: fastrpc: Add support for audiopd misc: fastrpc: Rework fastrpc_req_munmap misc: fastrpc: Use fastrpc_map_put in fastrpc_map_create on fail misc: fastrpc: Add fastrpc_remote_heap_alloc misc: fastrpc: Add reserved mem support misc: fastrpc: Rename audio protection domain to root ... commit dd6f9b17cd7af68b6a5090deedf1f5e84f66f4e6 Merge: b83a7080d3003 6373ab4dfee73 Author: Linus Torvalds Date: Fri Dec 16 03:31:56 2022 -0800 Merge tag 'tty-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver updates from Greg KH: "Here is the "big" set of tty/serial driver changes for 6.2-rc1. As in previous kernel releases, nothing big here at all, just some small incremental serial/tty layer cleanups and some individual driver additions and fixes. Highlights are: - serial helper macros from Jiri Slaby to reduce the amount of duplicated code in serial drivers - api cleanups and consolidations from Ilpo Järvinen in lots of serial drivers - the usual set of n_gsm fixes from Daniel Starke as that code gets exercised more - TIOCSTI is finally able to be disabled if requested (security hardening feature from Kees Cook) - fsl_lpuart driver fixes and features added - other small serial driver additions and fixes All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits) serial: atmel: don't stop the transmitter when doing PIO serial: atmel: cleanup atmel_start+stop_tx() tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API serial: sunsab: Fix error handling in sunsab_init() serial: altera_uart: fix locking in polling mode serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: fsl_lpuart: Use pm_ptr() to avoid need to make pm __maybe_unused tty: serial: fsl_lpuart: Add runtime pm support tty: serial: fsl_lpuart: enable wakeup source for lpuart serdev: Replace poll loop by readx_poll_timeout() macro tty: synclink_gt: unwind actions in error path of net device open serial: stm32: move dma_request_chan() before clk_prepare_enable() dt-bindings: serial: xlnx,opb-uartlite: Drop 'contains' from 'xlnx,use-parity' serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: amba-pl011: avoid SBSA UART accessing DMACR register tty: serial: altera_jtaguart: remove struct altera_jtaguart tty: serial: altera_jtaguart: use uart_port::read_status_mask tty: serial: altera_jtaguart: remove unused altera_jtaguart::sigs tty: serial: altera_jtaguart: remove flag from altera_jtaguart_rx_chars() n_tty: Rename tail to old_tail in n_tty_read() ... commit b83a7080d30032cf70832bc2bb04cc342e203b88 Merge: 58bcac11fd94f 37aa6b9823708 Author: Linus Torvalds Date: Fri Dec 16 03:27:03 2022 -0800 Merge tag 'staging-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the large set of staging driver changes for 6.2-rc1. Another round of cleanups for staging drivers with no big additions. Overall more lines were removed than added, always a nice sign, with nothing happening in here other than general coding style cleanups and minor fixes in the drivers. Full, boring, details are in the shortlog. All of these have been in linux-next for a while with no reported problems" * tag 'staging-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (253 commits) vme: Use root_device_register() not underlined version staging: rtl8192e: Fix spelling mistake "ContryIE" -> "CountryIE" vme: Fix error not catched in fake_init() staging: vme_user: remove multiple blank lines staging: r8188eu: use subtype helper in rtw_check_bcn_info staging: r8188eu: use subtype helpers in collect_bss_info staging: r8188eu: remove unused da parameter staging: r8188eu: merge two probereq_p2p functions staging: r8188eu: simplify err handling for unknown station staging: r8188eu: handle the non-ap case first staging: r8188eu: move bBusyTraffic update staging: r8188eu: read reason code from ieee80211_mgmt staging: r8188eu: use ieee80211_mgmt to parse addresses staging: r8188eu: remove a variable staging: r8188eu: simplify error handling for missing station staging: r8188eu: stop beacon processing if kmalloc fails staging: r8188eu: exit if beacon is not from our bss staging: r8188eu: simplify update_sta_support_rate params staging: r8188eu: use ie buffer in update_beacon_info staging: r8188eu: pass only ies to process_p2p_ps_ie ... commit 58bcac11fd94f950abc7b8466c5ceac7be07a00e Merge: 84e57d292203a 81c25247a2a03 Author: Linus Torvalds Date: Fri Dec 16 03:22:53 2022 -0800 Merge tag 'usb-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB and Thunderbolt driver updates from Greg KH: "Here is the large set of USB and Thunderbolt driver changes for 6.2-rc1. Overall, thanks to the removal of a driver, more lines were removed than added, a nice change. Highlights include: - removal of the sisusbvga driver that was not used by anyone anymore - minor thunderbolt driver changes and tweaks - chipidea driver updates - usual set of typec driver features and hardware support added - musb minor driver fixes - fotg210 driver fixes, bringing that hardware back from the "dead" - minor dwc3 driver updates - addition, and then removal, of a list.h helper function for many USB and other subsystem drivers, that ended up breaking the build. That will come back for 6.3-rc1, it missed this merge window. - usual xhci updates and enhancements - usb-serial driver updates and support for new devices - other minor USB driver updates All of these have been in linux-next for a while with no reported problems" * tag 'usb-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (153 commits) usb: gadget: uvc: Rename bmInterfaceFlags -> bmInterlaceFlags usb: dwc2: power on/off phy for peripheral mode in dual-role mode usb: dwc2: disable lpm feature on Rockchip SoCs dt-bindings: usb: mtk-xhci: add support for mt7986 usb: dwc3: core: defer probe on ulpi_read_id timeout usb: ulpi: defer ulpi_register on ulpi_read_id timeout usb: misc: onboard_usb_hub: add Genesys Logic GL850G hub support dt-bindings: usb: Add binding for Genesys Logic GL850G hub controller dt-bindings: vendor-prefixes: add Genesys Logic usb: fotg210-udc: fix potential memory leak in fotg210_udc_probe() usb: typec: tipd: Set mode of operation for USB Type-C connector usb: gadget: udc: drop obsolete dependencies on COMPILE_TEST usb: musb: remove extra check in musb_gadget_vbus_draw usb: gadget: uvc: Prevent buffer overflow in setup handler usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() usb: storage: Add check for kcalloc USB: sisusbvga: use module_usb_driver() USB: sisusbvga: rename sisusb.c to sisusbvga.c USB: sisusbvga: remove console support ... commit ad2631b5645a1d0ca9bf6fecf71f77e3b0071ee5 Author: Chen-Yu Tsai Date: Tue Sep 27 12:11:19 2022 +0200 arm64: dts: mt8183: Fix Mali GPU clock The actual clock feeding into the Mali GPU on the MT8183 is from the clock gate in the MFGCFG block, not CLK_TOP_MFGPLL_CK from the TOPCKGEN block, which itself is simply a pass-through placeholder for the MFGPLL in the APMIXEDSYS block. Fix the hardware description with the correct clock reference. Fixes: a8168cebf1bc ("arm64: dts: mt8183: Add node for the Mali GPU") Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno Tested-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/r/20220927101128.44758-2-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit e4a4175201014c0222f6bab1895a17b3d1b92f08 Author: Macpaul Lin Date: Fri Nov 11 17:55:40 2022 +0800 arm64: dts: mediatek: mt8195-demo: fix the memory size of node secmon The size of device tree node secmon (bl31_secmon_reserved) was incorrect. It should be increased to 2MiB (0x200000). The origin setting will cause some abnormal behavior due to trusted-firmware-a and related firmware didn't load correctly. The incorrect behavior may vary because of different software stacks. For example, it will cause build error in some Yocto project because it will check if there was enough memory to load trusted-firmware-a to the reserved memory. When mt8195-demo.dts sent to the upstream, at that time the size of BL31 was small. Because supported functions and modules in BL31 are basic sets when the board was under early development stage. Now BL31 includes more firmwares of coprocessors and maturer functions so the size has grown bigger in real applications. According to the value reported by customers, we think reserved 2MiB for BL31 might be enough for maybe the following 2 or 3 years. Cc: stable@vger.kernel.org # v5.19 Fixes: 6147314aeedc ("arm64: dts: mediatek: Add device-tree for MT8195 Demo board") Signed-off-by: Macpaul Lin Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221111095540.28881-1-macpaul.lin@mediatek.com Signed-off-by: Matthias Brugger commit dba8eb83af9dd757ef645b52200775e86883d858 Author: Chun-Jie Chen Date: Fri Oct 14 18:20:29 2022 +0800 soc: mediatek: pm-domains: Fix the power glitch issue Power reset maybe generate unexpected signal. In order to avoid the glitch issue, we need to enable isolation first to guarantee the stable signal when power reset is triggered. Fixes: 59b644b01cf4 ("soc: mediatek: Add MediaTek SCPSYS power domains") Signed-off-by: Chun-Jie Chen Signed-off-by: Allen-KH Cheng Reviewed-by: Chen-Yu Tsai Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221014102029.1162-1-allen-kh.cheng@mediatek.com Signed-off-by: Matthias Brugger commit 68bb10101e6b0a6bb44e9c908ef795fc4af99eae Author: Eelco Chaudron Date: Thu Dec 15 15:46:33 2022 +0100 openvswitch: Fix flow lookup to use unmasked key The commit mentioned below causes the ovs_flow_tbl_lookup() function to be called with the masked key. However, it's supposed to be called with the unmasked key. This due to the fact that the datapath supports installing wider flows, and OVS relies on this behavior. For example if ipv4(src=1.1.1.1/192.0.0.0, dst=1.1.1.2/192.0.0.0) exists, a wider flow (smaller mask) of ipv4(src=192.1.1.1/128.0.0.0,dst=192.1.1.2/ 128.0.0.0) is allowed to be added. However, if we try to add a wildcard rule, the installation fails: $ ovs-appctl dpctl/add-flow system@myDP "in_port(1),eth_type(0x0800), \ ipv4(src=1.1.1.1/192.0.0.0,dst=1.1.1.2/192.0.0.0,frag=no)" 2 $ ovs-appctl dpctl/add-flow system@myDP "in_port(1),eth_type(0x0800), \ ipv4(src=192.1.1.1/0.0.0.0,dst=49.1.1.2/0.0.0.0,frag=no)" 2 ovs-vswitchd: updating flow table (File exists) The reason is that the key used to determine if the flow is already present in the system uses the original key ANDed with the mask. This results in the IP address not being part of the (miniflow) key, i.e., being substituted with an all-zero value. When doing the actual lookup, this results in the key wrongfully matching the first flow, and therefore the flow does not get installed. This change reverses the commit below, but rather than having the key on the stack, it's allocated. Fixes: 190aa3e77880 ("openvswitch: Fix Frame-size larger than 1024 bytes warning.") Signed-off-by: Eelco Chaudron Signed-off-by: David S. Miller commit 3e31d209ed5fceb4a50118accd461b3b9b13e589 Merge: 32f1002ed4851 d1c4a3469e737 Author: David S. Miller Date: Fri Dec 16 10:21:37 2022 +0000 Merge branch 'devlink-fixes' Jakub Kicinski says: ==================== devlink: region snapshot locking fix and selftest adjustments Minor fix for region snapshot locking and adjustments to selftests. ==================== Signed-off-by: David S. Miller commit d1c4a3469e73730f7cbbcec661c2a9081af1aa45 Author: Jakub Kicinski Date: Wed Dec 14 18:01:02 2022 -0800 selftests: devlink: add a warning for interfaces coming up NetworkManager (and other daemons) may bring the interface up and cause failures in quiescence checks. Print a helpful warning, and take the interface down again. I seem to forget about this every time I run these tests on a new VM. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 2fc60e2ff972d3dca836bff0b08cbe503c4ca1ce Author: Jakub Kicinski Date: Wed Dec 14 18:01:01 2022 -0800 selftests: devlink: fix the fd redirect in dummy_reporter_test $number + > bash means redirect FD $number, e.g. commonly used 2> redirects stderr (fd 2). The test uses 8192> to write the number 8192 to a file, this results in: ./devlink.sh: line 499: 8192: Bad file descriptor Oddly the test also papers over this issue by checking for failure (expecting an error rather than success) so it passes, anyway. Fixes: ff18176ad806 ("selftests: Add a test of large binary to devlink health test") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit b4cafb3d2c740f8d1b1234b43ac4a60e5291c960 Author: Jakub Kicinski Date: Wed Dec 14 18:01:00 2022 -0800 devlink: hold region lock when flushing snapshots Netdevsim triggers a splat on reload, when it destroys regions with snapshots pending: WARNING: CPU: 1 PID: 787 at net/core/devlink.c:6291 devlink_region_snapshot_del+0x12e/0x140 CPU: 1 PID: 787 Comm: devlink Not tainted 6.1.0-07460-g7ae9888d6e1c #580 RIP: 0010:devlink_region_snapshot_del+0x12e/0x140 Call Trace: devl_region_destroy+0x70/0x140 nsim_dev_reload_down+0x2f/0x60 [netdevsim] devlink_reload+0x1f7/0x360 devlink_nl_cmd_reload+0x6ce/0x860 genl_family_rcv_msg_doit.isra.0+0x145/0x1c0 This is the locking assert in devlink_region_snapshot_del(), we're supposed to be holding the region->snapshot_lock here. Fixes: 2dec18ad826f ("net: devlink: remove region snapshots list dependency on devlink->lock") Signed-off-by: Jakub Kicinski Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 4e699e34f923188175986ad8a74ab99f7034075e Author: Ma Jun Date: Fri Dec 16 11:05:26 2022 +0800 drm/plane-helper: Add the missing declaration of drm_atomic_state Add the missing declaration of struct drm_atomic_state to fix the compile error below: error: 'struct drm_atomic_state' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] Signed-off-by: Ma Jun Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Fixes: 8401bd361f59 ("drm/plane-helper: Add a drm_plane_helper_atomic_check() helper") Cc: Javier Martinez Canillas Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v6.1+ Link: https://patchwork.freedesktop.org/patch/msgid/20221216030526.1335609-1-majun@amd.com commit 32f1002ed4851d9eb28ea1aba58757bd4b66e63b Author: Daniel Golle Date: Thu Dec 15 03:47:59 2022 +0000 net: dsa: mt7530: remove redundant assignment Russell King correctly pointed out that the MAC_2500FD capability is already added for port 5 (if not in RGMII mode) and port 6 (which only supports SGMII) by mt7531_mac_port_get_caps. Remove the reduntant setting of this capability flag which was added by a previous commit. Fixes: e19de30d2080 ("net: dsa: mt7530: add support for in-band link status") Reported-by: Russell King (Oracle) Reviewed-by: Russell King (Oracle) Signed-off-by: Daniel Golle Link: https://lore.kernel.org/r/Y5qY7x6la5TxZxzX@makrotopia.org Signed-off-by: Jakub Kicinski commit 84e57d292203a45c96dbcb2e6be9dd80961d981a Merge: 23dc9c755a19d 36955d368dc10 Author: Linus Torvalds Date: Thu Dec 15 18:14:21 2022 -0800 Merge tag 'exfat-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat update from Namjae Jeon: - simplify and remove some redundant directory entry code - optimize the size of exfat_entry_set_cache and its allocation policy - improve the performance for creating files and directories * tag 'exfat-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: reuse exfat_find_location() to simplify exfat_get_dentry_set() exfat: fix overflow in sector and cluster conversion exfat: remove i_size_write() from __exfat_truncate() exfat: remove argument 'size' from exfat_truncate() exfat: remove unnecessary arguments from exfat_find_dir_entry() exfat: remove unneeded codes from __exfat_rename() exfat: remove call ilog2() from exfat_readdir() exfat: replace magic numbers with Macros exfat: rename exfat_free_dentry_set() to exfat_put_dentry_set() exfat: move exfat_entry_set_cache from heap to stack exfat: support dynamic allocate bh for exfat_entry_set_cache exfat: reduce the size of exfat_entry_set_cache exfat: hint the empty entry which at the end of cluster chain exfat: simplify empty entry hint commit 23dc9c755a19dea099df6ccb6dd129e24b4d5ad8 Merge: fe36bb8736ee9 23e188a16423a Author: Linus Torvalds Date: Thu Dec 15 18:09:48 2022 -0800 Merge tag 'for-6.2/writeback-2022-12-12' of git://git.kernel.dk/linux Pull writeback updates from Jens Axboe: - Sanity check adding freed inodes to lists (Jan) - Removal of an old unused define (Miaohe) * tag 'for-6.2/writeback-2022-12-12' of git://git.kernel.dk/linux: writeback: remove obsolete macro EXPIRE_DIRTY_ATIME writeback: Add asserts for adding freed inode to lists commit fe36bb8736ee9e38fa6173e1271ed8c5cf7bc907 Merge: 851f657a86421 eb9d58947d406 Author: Linus Torvalds Date: Thu Dec 15 18:01:16 2022 -0800 Merge tag 'trace-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Add options to the osnoise tracer: - 'panic_on_stop' option that panics the kernel if osnoise is greater than some user defined threshold. - 'preempt' option, to test noise while preemption is disabled - 'irq' option, to test noise when interrupts are disabled - Add .percent and .graph suffix to histograms to give different outputs - Add nohitcount to disable showing hitcount in histogram output - Add new __cpumask() to trace event fields to annotate that a unsigned long array is a cpumask to user space and should be treated as one. - Add trace_trigger kernel command line parameter to enable trace event triggers at boot up. Useful to trace stack traces, disable tracing and take snapshots. - Fix x86/kmmio mmio tracer to work with the updates to lockdep - Unify the panic and die notifiers - Add back ftrace_expect reference that is used to extract more information in the ftrace_bug() code. - Have trigger filter parsing errors show up in the tracing error log. - Updated MAINTAINERS file to add kernel tracing mailing list and patchwork info - Use IDA to keep track of event type numbers. - And minor fixes and clean ups * tag 'trace-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (44 commits) tracing: Fix cpumask() example typo tracing: Improve panic/die notifiers ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels tracing: Do not synchronize freeing of trigger filter on boot up tracing: Remove pointer (asterisk) and brackets from cpumask_t field tracing: Have trigger filter parsing errors show up in error_log x86/mm/kmmio: Remove redundant preempt_disable() tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line Documentation/osnoise: Add osnoise/options documentation tracing/osnoise: Add preempt and/or irq disabled options tracing/osnoise: Add PANIC_ON_STOP option Documentation/osnoise: Escape underscore of NO_ prefix tracing: Fix some checker warnings tracing/osnoise: Make osnoise_options static tracing: remove unnecessary trace_trigger ifdef ring-buffer: Handle resize in early boot up tracing/hist: Fix issue of losting command info in error_log tracing: Fix issue of missing one synthetic field tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' tracing/hist: Fix wrong return value in parse_action_params() ... commit f9eeef5918bbe1f2545d36280330dced25d6cf97 Author: Wei Yongjun Date: Wed Aug 17 08:03:32 2022 +0000 fault-injection: make stacktrace filter works as expected stacktrace filter is checked after others, such as fail-nth, interval and probability. This make it doesn't work well as expected. Fix to running stacktrace filter before other filters. It will speed up fault inject testing for driver modules. Link: https://lkml.kernel.org/r/20220817080332.1052710-5-weiyongjun1@huawei.com Signed-off-by: Wei Yongjun Cc: Akinobu Mita Cc: Dan Williams Cc: Isabella Basso Cc: Josh Poimboeuf Cc: Kees Cook Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0199907474d402809319ada802b50643625914f9 Author: Wei Yongjun Date: Wed Aug 17 08:03:31 2022 +0000 fault-injection: make some stack filter attrs more readable Attributes of stack filter are show as unsigned decimal, such as 'require-start', 'require-end'. This patch change to show them as unsigned hexadecimal for more readable. Before: $ echo 0xffffffffc0257000 > /sys/kernel/debug/failslab/require-start $ cat /sys/kernel/debug/failslab/require-start 18446744072638263296 After: $ echo 0xffffffffc0257000 > /sys/kernel/debug/failslab/require-start $ cat /sys/kernel/debug/failslab/require-start 0xffffffffc0257000 [wangyufen@huawei.com: use debugfs_create_xul() instead of debugfs_create_xl()] Link: https://lkml.kernel.org/r/1664331299-4976-1-git-send-email-wangyufen@huawei.com Link: https://lkml.kernel.org/r/20220817080332.1052710-4-weiyongjun1@huawei.com Signed-off-by: Wei Yongjun Signed-off-by: Wang Yufen Reviewed-by: Akinobu Mita Cc: Dan Williams Cc: Isabella Basso Cc: Josh Poimboeuf Cc: Kees Cook Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4acb9e5139f20c79eb08a95dc5a28186ae7a5088 Author: Wei Yongjun Date: Wed Aug 17 08:03:30 2022 +0000 fault-injection: skip stacktrace filtering by default If FAULT_INJECTION_STACKTRACE_FILTER is enabled, the depth is default to 32. This means fail_stacktrace() will iter each entry's stacktrace, even if filter is not configured. This patch changes to quick return from fail_stacktrace() if stacktrace filter is not set. Link: https://lkml.kernel.org/r/20220817080332.1052710-3-weiyongjun1@huawei.com Signed-off-by: Wei Yongjun Cc: Akinobu Mita Cc: Dan Williams Cc: Isabella Basso Cc: Josh Poimboeuf Cc: Kees Cook Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a7ebbbb159c181c696770feeb89bf0334aaff6d8 Author: Wei Yongjun Date: Wed Aug 17 08:03:29 2022 +0000 fault-injection: allow stacktrace filter for x86-64 This patchset allow fault injection to run on x86_64 and makes stacktrace filter work as expected. With this, we can test a device driver module with fault injection more easily. This patch (of 4): FAULT_INJECTION_STACKTRACE_FILTER option was apparently disallowed on x86_64 because of problems with the stack unwinder: commit 6d690dcac92a84f98fd774862628ff871b713660 Author: Akinobu Mita Date: Sat May 12 10:36:53 2007 -0700 fault injection: disable stacktrace filter for x86-64 However, there is no problems whatsoever with this today. Let's allow it again. Link: https://lkml.kernel.org/r/20220817080332.1052710-1-weiyongjun1@huawei.com Link: https://lkml.kernel.org/r/20220817080332.1052710-2-weiyongjun1@huawei.com Signed-off-by: Wei Yongjun Cc: Akinobu Mita Cc: Nathan Chancellor Cc: Peter Zijlstra Cc: Kees Cook Cc: Nick Desaulniers Cc: Josh Poimboeuf Cc: Dan Williams Cc: Miguel Ojeda Cc: Isabella Basso Cc: Vlastimil Babka Cc: Rasmus Villemoes Signed-off-by: Andrew Morton commit 8b777594d2341a82f00b57c020f8af05bded1178 Author: Minchan Kim Date: Tue Dec 13 09:07:31 2022 -0800 MAINTAINERS: zram: zsmalloc: Add an additional co-maintainer Move Sergey to co-maintainer for zram/zsmalloc since he has helped to contribute/review those areas actively for eight years, which is quite helpful. Since Nitin has been inactive for several years, it's time to move his name into CREDITS. Link: https://lkml.kernel.org/r/20221213170731.796121-1-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Nitin Gupta Signed-off-by: Andrew Morton commit 3a6f33d86baa8103c80f62edd9393e9f7bf25d72 Author: Clément Léger Date: Tue Nov 8 10:43:22 2022 +0100 mm/kmemleak: use %pK to display kernel pointers in backtrace Currently, %p is used to display kernel pointers in backtrace which result in a hashed value that is not usable to correlate the address for debug. Use %pK which will respect the kptr_restrict configuration value and thus allow to extract meaningful information from the backtrace. Link: https://lkml.kernel.org/r/20221108094322.73492-1-clement.leger@bootlin.com Signed-off-by: Clément Léger Cc: Alexandre Belloni Cc: Catalin Marinas Cc: Thomas Petazzoni Signed-off-by: Andrew Morton commit 56a61617dd2276cbc56a6c868599716386d70041 Author: Zhaoyang Huang Date: Thu Oct 27 17:50:24 2022 +0800 mm: use stack_depot for recording kmemleak's backtrace Using stack_depot to record kmemleak's backtrace which has been implemented on slub for reducing redundant information. [akpm@linux-foundation.org: fix build - remove now-unused __save_stack_trace()] [zhaoyang.huang@unisoc.com: v3] Link: https://lkml.kernel.org/r/1667101354-4669-1-git-send-email-zhaoyang.huang@unisoc.com [akpm@linux-foundation.org: fix v3 layout oddities] [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/1666864224-27541-1-git-send-email-zhaoyang.huang@unisoc.com Signed-off-by: Zhaoyang Huang Acked-by: Catalin Marinas Cc: ke.wang Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Cc: Zhaoyang Huang Signed-off-by: Andrew Morton commit 9102b78b6f6ae6af3557114c265c266b312c1319 Author: Liam Howlett Date: Tue Oct 25 17:37:23 2022 +0000 maple_tree: update copyright dates for test code Add the span to the year of the development. Link: https://lkml.kernel.org/r/20221025173709.2718725-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Matthew Wilcox Cc: Joe Perches Signed-off-by: Andrew Morton commit d98c86b9f7a4e1f5a7ead8ba5743952267f9e320 Author: Liam Howlett Date: Tue Oct 25 17:38:14 2022 +0000 maple_tree: fix mas_find_rev() comment mas_find_rev() uses mas_prev_entry(), not mas_next_entry(), correct comment. Link: https://lkml.kernel.org/r/20221025173756.2719616-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 61b963b52f59524e27692bc1c14bfb2459e32eb3 Author: David Hildenbrand Date: Mon Dec 12 19:20:18 2022 +0100 mm/gup_test: free memory allocated via kvcalloc() using kvfree() We have to free via kvfree(), not via kfree(). Link: https://lkml.kernel.org/r/20221212182018.264900-1-david@redhat.com Fixes: c77369b437f9 ("mm/gup_test: start/stop/read functionality for PIN LONGTERM test") Signed-off-by: David Hildenbrand Reported-by: kernel test robot Reported-by: Julia Lawall Signed-off-by: Andrew Morton commit b248586a49a7729f73c504b1e7b958caea45e927 Author: Paulo Alcantara Date: Tue Dec 13 09:15:23 2022 -0300 cifs: set correct tcon status after initial tree connect cifs_tcon::status wasn't correctly updated to TID_GOOD after initial tree connect thus staying at TID_NEW as long as it was connected. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit b18cba09e374637a0a3759d856a6bca94c133952 Author: minoura makoto Date: Tue Dec 13 13:14:31 2022 +0900 SUNRPC: ensure the matching upcall is in-flight upon downcall Commit 9130b8dbc6ac ("SUNRPC: allow for upcalls for the same uid but different gss service") introduced `auth` argument to __gss_find_upcall(), but in gss_pipe_downcall() it was left as NULL since it (and auth->service) was not (yet) determined. When multiple upcalls with the same uid and different service are ongoing, it could happen that __gss_find_upcall(), which returns the first match found in the pipe->in_downcall list, could not find the correct gss_msg corresponding to the downcall we are looking for. Moreover, it might return a msg which is not sent to rpc.gssd yet. We could see mount.nfs process hung in D state with multiple mount.nfs are executed in parallel. The call trace below is of CentOS 7.9 kernel-3.10.0-1160.24.1.el7.x86_64 but we observed the same hang w/ elrepo kernel-ml-6.0.7-1.el7. PID: 71258 TASK: ffff91ebd4be0000 CPU: 36 COMMAND: "mount.nfs" #0 [ffff9203ca3234f8] __schedule at ffffffffa3b8899f #1 [ffff9203ca323580] schedule at ffffffffa3b88eb9 #2 [ffff9203ca323590] gss_cred_init at ffffffffc0355818 [auth_rpcgss] #3 [ffff9203ca323658] rpcauth_lookup_credcache at ffffffffc0421ebc [sunrpc] #4 [ffff9203ca3236d8] gss_lookup_cred at ffffffffc0353633 [auth_rpcgss] #5 [ffff9203ca3236e8] rpcauth_lookupcred at ffffffffc0421581 [sunrpc] #6 [ffff9203ca323740] rpcauth_refreshcred at ffffffffc04223d3 [sunrpc] #7 [ffff9203ca3237a0] call_refresh at ffffffffc04103dc [sunrpc] #8 [ffff9203ca3237b8] __rpc_execute at ffffffffc041e1c9 [sunrpc] #9 [ffff9203ca323820] rpc_execute at ffffffffc0420a48 [sunrpc] The scenario is like this. Let's say there are two upcalls for services A and B, A -> B in pipe->in_downcall, B -> A in pipe->pipe. When rpc.gssd reads pipe to get the upcall msg corresponding to service B from pipe->pipe and then writes the response, in gss_pipe_downcall the msg corresponding to service A will be picked because only uid is used to find the msg and it is before the one for B in pipe->in_downcall. And the process waiting for the msg corresponding to service A will be woken up. Actual scheduing of that process might be after rpc.gssd processes the next msg. In rpc_pipe_generic_upcall it clears msg->errno (for A). The process is scheduled to see gss_msg->ctx == NULL and gss_msg->msg.errno == 0, therefore it cannot break the loop in gss_create_upcall and is never woken up after that. This patch adds a simple check to ensure that a msg which is not sent to rpc.gssd yet is not chosen as the matching upcall upon receiving a downcall. Signed-off-by: minoura makoto Signed-off-by: Hiroshi Shimamoto Tested-by: Hiroshi Shimamoto Cc: Trond Myklebust Fixes: 9130b8dbc6ac ("SUNRPC: allow for upcalls for same uid but different gss service") Signed-off-by: Trond Myklebust commit 851f657a86421dded42b6175c6ea0f4f5e86af97 Merge: ec9187ecea142 d74f4a3f6d88a Author: Linus Torvalds Date: Thu Dec 15 14:53:14 2022 -0800 Merge tag '6.2-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client updates from Steve French: - SMB3.1.1 POSIX Extensions fixes - remove use of generic_writepages() and ->cifs_writepage(), in favor of ->cifs_writepages() and ->migrate_folio() - memory management fixes - mount parm parsing fixes - minor cleanup fixes * tag '6.2-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: Remove duplicated include in cifsglob.h cifs: fix oops during encryption cifs: print warning when conflicting soft vs. hard mount options specified cifs: fix missing display of three mount options cifs: fix various whitespace errors in headers cifs: minor cleanup of some headers cifs: skip alloc when request has no pages cifs: remove ->writepage cifs: stop using generic_writepages cifs: wire up >migrate_folio cifs: Parse owner/group for stat in smb311 posix extensions cifs: Add "extbuf" and "extbuflen" args to smb2_compound_op() Fix path in cifs/usage.rst commit ec9187ecea142593c54cf7a73ef2e1a3d517495a Merge: 785d21ba2f447 39244cc754829 Author: Linus Torvalds Date: Thu Dec 15 14:47:10 2022 -0800 Merge tag 'i2c-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Core got a new helper 'i2c_client_get_device_id()', designware got some bigger updates, the rest is driver updates all over the place" * tag 'i2c-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (41 commits) i2c: ismt: Fix an out-of-bounds bug in ismt_access() i2c: mux: reg: check return value after calling platform_get_resource() i2c: xiic: Make sure to disable clock on .remove() i2c: hisi: Add support to get clock frequency from clock i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe i2c: slave-eeprom: Convert to i2c's .probe_new() i2c: mux: pca954x: Convert to i2c's .probe_new() drivers/i2c: use simple i2c probe i2c: mux: pca9541: switch to using .probe_new i2c: gpio: Fix potential unused warning for 'i2c_gpio_dt_ids' i2c: qcom-geni: add support for I2C Master Hub variant i2c: qcom-geni: add desc struct to prepare support for I2C Master Hub variant soc: qcom: geni-se: add support for I2C Master Hub wrapper variant soc: qcom: geni-se: add desc struct to specify clocks from device match data dt-bindings: i2c: qcom-geni: document I2C Master Hub serial I2C engine dt-bindings: qcom: geni-se: document I2C Master Hub wrapper variant dt-bindings: i2c: renesas,riic: Document RZ/Five SoC i2c: tegra: Set ACPI node as primary fwnode i2c: smbus: add DDR support for SPD i2c: /pasemi: PASemi I2C controller IRQ enablement ... commit e88f319a2546fd7772c726bf3a82a23b0859ddeb Author: Minghao Chi Date: Tue Nov 22 09:47:19 2022 +0800 rtc: ds1742: use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Minghao Chi Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202211220947194856561@zte.com.cn Signed-off-by: Alexandre Belloni commit 55d5a86618d3b1a768bce01882b74cbbd2651975 Author: GUO Zihua Date: Tue Nov 22 16:50:46 2022 +0800 rtc: mxc_v2: Add missing clk_disable_unprepare() The call to clk_disable_unprepare() is left out in the error handling of devm_rtc_allocate_device. Add it back. Fixes: 5490a1e018a4 ("rtc: mxc_v2: fix possible race condition") Signed-off-by: GUO Zihua Link: https://lore.kernel.org/r/20221122085046.21689-1-guozihua@huawei.com Signed-off-by: Alexandre Belloni commit 3bb23f1f9d5a66e23f643b2318a64d88f2585c8e Author: Zhang Jiaming Date: Wed Jun 22 16:53:44 2022 +0800 rtc: rs5c313: correct some spelling mistakes Change 'modifed' to 'modified'. Change 'Updata' to 'Update'. Change 'Initiatlize' to 'Initialize'. Signed-off-by: Zhang Jiaming Link: https://lore.kernel.org/r/20220622085344.23519-1-jiaming@nfschina.com Signed-off-by: Alexandre Belloni commit 2dc5e3fb6e974bc299cdd43cb9e253c8958d0d11 Author: Xiang wangx Date: Sun Jun 5 16:35:15 2022 +0800 rtc: at91rm9200: Fix syntax errors in comments Delete the redundant word 'is'. Signed-off-by: Xiang wangx Link: https://lore.kernel.org/r/20220605083515.9514-1-wangxiang@cdjrlc.com Signed-off-by: Alexandre Belloni commit b9354487fb795c144a387e51a9d4d33b710c74f7 Author: shaomin Deng Date: Mon Aug 8 11:23:54 2022 -0400 rtc: remove duplicated words in comments Signed-off-by: shaomin Deng Link: https://lore.kernel.org/r/20220808152354.3641-1-dengshaomin@cdjrlc.com Link: https://lore.kernel.org/r/20220808153454.6844-1-dengshaomin@cdjrlc.com Link: https://lore.kernel.org/r/20220808152822.5012-1-dengshaomin@cdjrlc.com Signed-off-by: Alexandre Belloni commit 16b26f6027588be4414fb69d665bd07c9cb828e9 Author: Wadim Egorov Date: Thu Dec 8 14:36:05 2022 +0100 rtc: rv3028: Use IRQ flags obtained from device tree if available Make the interrupt pin of the RV3028 usable with GPIO controllers without level type IRQs support, such as the TI Davinci GPIO controller. Therefore, allow the IRQ type to be passed from the device tree if available. Based on commit d4785b46345c ("rtc: pcf2127: use IRQ flags obtained from device tree if available") Signed-off-by: Wadim Egorov Link: https://lore.kernel.org/r/20221208133605.4193907-1-w.egorov@phytec.de Signed-off-by: Alexandre Belloni commit 0feebdeb3acc0375cd817385d637d27a8a6dca97 Author: ye xingchen Date: Mon Dec 5 11:34:45 2022 +0800 rtc: ds1307: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212051134455911470@zte.com.cn Signed-off-by: Alexandre Belloni commit bb0a1799bbc498053011729dcac0d9430e7d750a Author: Jean Delvare Date: Thu Nov 24 15:43:59 2022 +0100 rtc: isl12026: drop obsolete dependency on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. It is actually better to always build such drivers with OF enabled, so that the test builds are closer to how each driver will actually be built on its intended target. Building them without OF may not test much as the compiler will optimize out potentially large parts of the code. In the worst case, this could even pop false positive warnings. Dropping COMPILE_TEST here improves the quality of our testing and avoids wasting time on non-existent issues. Signed-off-by: Jean Delvare Cc: Alessandro Zummo Cc: Alexandre Belloni Link: https://lore.kernel.org/r/20221124154359.039be06c@endymion.delvare Signed-off-by: Alexandre Belloni commit 72abeedd83982c1bc6023f631e412db78374d9b4 Author: Tan Tee Min Date: Fri Dec 9 12:15:22 2022 +0800 igc: Set Qbv start_time and end_time to end_time if not being configured in GCL The default setting of end_time minus start_time is whole 1 second. Thus, if it's not being configured in any GCL entry then it will be staying at original 1 second. This patch is changing the start_time and end_time to be end_time as if setting zero will be having weird HW behavior where the gate will not be fully closed. Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading") Signed-off-by: Tan Tee Min Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 6d05251d537a4d3835959a8cdd8cbbbdcdc0c904 Author: Tan Tee Min Date: Fri Dec 9 12:15:21 2022 +0800 igc: recalculate Qbv end_time by considering cycle time Qbv users can specify a cycle time that is not equal to the total GCL intervals. Hence, recalculation is necessary here to exclude the time interval that exceeds the cycle time. As those GCL which exceeds the cycle time will be truncated. According to IEEE Std. 802.1Q-2018 section 8.6.9.2, once the end of the list is reached, it will switch to the END_OF_CYCLE state and leave the gates in the same state until the next cycle is started. Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading") Signed-off-by: Tan Tee Min Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit e17090eb24944fbbe1f24d9f336d7bad4fbe47e8 Author: Tan Tee Min Date: Fri Dec 9 12:15:20 2022 +0800 igc: allow BaseTime 0 enrollment for Qbv Introduce qbv_enable flag in igc_adapter struct to store the Qbv on/off. So this allow the BaseTime to enroll with zero value. Fixes: 61572d5f8f91 ("igc: Simplify TSN flags handling") Signed-off-by: Muhammad Husaini Zulkifli Signed-off-by: Tan Tee Min Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 3b61764fb49a6e147ac90d71dccdddc9d5508ba1 Author: Muhammad Husaini Zulkifli Date: Fri Dec 9 12:15:19 2022 +0800 igc: Add checking for basetime less than zero Using the tc qdisc command, the user can set basetime to any value. Checking should be done on the driver's side to prevent registering basetime values that are less than zero. Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading") Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit d8f45be01dd9381065a3778a579385249ed011dc Author: Vinicius Costa Gomes Date: Fri Dec 9 12:15:18 2022 +0800 igc: Use strict cycles for Qbv scheduling Configuring strict cycle mode in the controller forces more well behaved transmissions when taprio is offloaded. When set this strict_cycle and strict_end, transmission is not enabled if the whole packet cannot be completed before end of the Qbv cycle. Fixes: 82faa9b79950 ("igc: Add support for ETF offloading") Signed-off-by: Vinicius Costa Gomes Signed-off-by: Aravindhan Gunasekaran Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit db0b124f02ba68de6517ac303d431af220ccfe9f Author: Vinicius Costa Gomes Date: Fri Dec 9 12:15:17 2022 +0800 igc: Enhance Qbv scheduling by using first flag bit The I225 hardware has a limitation that packets can only be scheduled in the [0, cycle-time] interval. So, scheduling a packet to the start of the next cycle doesn't usually work. To overcome this, we use the Transmit Descriptor first flag to indicates that a packet should be the first packet (from a queue) in a cycle according to the section 7.5.2.9.3.4 The First Packet on Each QBV Cycle in Intel Discrete I225/6 User Manual. But this only works if there was any packet from that queue during the current cycle, to avoid this issue, we issue an empty packet if that's not the case. Also require one more descriptor to be available, to take into account the empty packet that might be issued. Test Setup: Talker: Use l2_tai to generate the launchtime into packet load. Listener: Use timedump.c to compute the delta between packet arrival and LaunchTime packet payload. Test Result: Before: 1666000610127300000,1666000610127300096,96,621273 1666000610127400000,1666000610127400192,192,621274 1666000610127500000,1666000610127500032,32,621275 1666000610127600000,1666000610127600128,128,621276 1666000610127700000,1666000610127700224,224,621277 1666000610127800000,1666000610127800064,64,621278 1666000610127900000,1666000610127900160,160,621279 1666000610128000000,1666000610128000000,0,621280 1666000610128100000,1666000610128100096,96,621281 1666000610128200000,1666000610128200192,192,621282 1666000610128300000,1666000610128300032,32,621283 1666000610128400000,1666000610128301056,-98944,621284 1666000610128500000,1666000610128302080,-197920,621285 1666000610128600000,1666000610128302848,-297152,621286 1666000610128700000,1666000610128303872,-396128,621287 1666000610128800000,1666000610128304896,-495104,621288 1666000610128900000,1666000610128305664,-594336,621289 1666000610129000000,1666000610128306688,-693312,621290 1666000610129100000,1666000610128307712,-792288,621291 1666000610129200000,1666000610128308480,-891520,621292 1666000610129300000,1666000610128309504,-990496,621293 1666000610129400000,1666000610128310528,-1089472,621294 1666000610129500000,1666000610128311296,-1188704,621295 1666000610129600000,1666000610128312320,-1287680,621296 1666000610129700000,1666000610128313344,-1386656,621297 1666000610129800000,1666000610128314112,-1485888,621298 1666000610129900000,1666000610128315136,-1584864,621299 1666000610130000000,1666000610128316160,-1683840,621300 1666000610130100000,1666000610128316928,-1783072,621301 1666000610130200000,1666000610128317952,-1882048,621302 1666000610130300000,1666000610128318976,-1981024,621303 1666000610130400000,1666000610128319744,-2080256,621304 1666000610130500000,1666000610128320768,-2179232,621305 1666000610130600000,1666000610128321792,-2278208,621306 1666000610130700000,1666000610128322816,-2377184,621307 1666000610130800000,1666000610128323584,-2476416,621308 1666000610130900000,1666000610128324608,-2575392,621309 1666000610131000000,1666000610128325632,-2674368,621310 1666000610131100000,1666000610128326400,-2773600,621311 1666000610131200000,1666000610128327424,-2872576,621312 1666000610131300000,1666000610128328448,-2971552,621313 1666000610131400000,1666000610128329216,-3070784,621314 1666000610131500000,1666000610131500032,32,621315 1666000610131600000,1666000610131600128,128,621316 1666000610131700000,1666000610131700224,224,621317 After: 1666073510646200000,1666073510646200064,64,2676462 1666073510646300000,1666073510646300160,160,2676463 1666073510646400000,1666073510646400256,256,2676464 1666073510646500000,1666073510646500096,96,2676465 1666073510646600000,1666073510646600192,192,2676466 1666073510646700000,1666073510646700032,32,2676467 1666073510646800000,1666073510646800128,128,2676468 1666073510646900000,1666073510646900224,224,2676469 1666073510647000000,1666073510647000064,64,2676470 1666073510647100000,1666073510647100160,160,2676471 1666073510647200000,1666073510647200256,256,2676472 1666073510647300000,1666073510647300096,96,2676473 1666073510647400000,1666073510647400192,192,2676474 1666073510647500000,1666073510647500032,32,2676475 1666073510647600000,1666073510647600128,128,2676476 1666073510647700000,1666073510647700224,224,2676477 1666073510647800000,1666073510647800064,64,2676478 1666073510647900000,1666073510647900160,160,2676479 1666073510648000000,1666073510648000000,0,2676480 1666073510648100000,1666073510648100096,96,2676481 1666073510648200000,1666073510648200192,192,2676482 1666073510648300000,1666073510648300032,32,2676483 1666073510648400000,1666073510648400128,128,2676484 1666073510648500000,1666073510648500224,224,2676485 1666073510648600000,1666073510648600064,64,2676486 1666073510648700000,1666073510648700160,160,2676487 1666073510648800000,1666073510648800000,0,2676488 1666073510648900000,1666073510648900096,96,2676489 1666073510649000000,1666073510649000192,192,2676490 1666073510649100000,1666073510649100032,32,2676491 1666073510649200000,1666073510649200128,128,2676492 1666073510649300000,1666073510649300224,224,2676493 1666073510649400000,1666073510649400064,64,2676494 1666073510649500000,1666073510649500160,160,2676495 1666073510649600000,1666073510649600000,0,2676496 1666073510649700000,1666073510649700096,96,2676497 1666073510649800000,1666073510649800192,192,2676498 1666073510649900000,1666073510649900032,32,2676499 1666073510650000000,1666073510650000128,128,2676500 Fixes: 82faa9b79950 ("igc: Add support for ETF offloading") Signed-off-by: Vinicius Costa Gomes Co-developed-by: Aravindhan Gunasekaran Signed-off-by: Aravindhan Gunasekaran Co-developed-by: Muhammad Husaini Zulkifli Signed-off-by: Muhammad Husaini Zulkifli Signed-off-by: Malli C Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 785d21ba2f447fb26df4b22f45653763beb767ea Merge: 8fa590bf34481 70be6f322860d Author: Linus Torvalds Date: Thu Dec 15 13:12:15 2022 -0800 Merge tag 'vfio-v6.2-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Replace deprecated git://github.com link in MAINTAINERS (Palmer Dabbelt) - Simplify vfio/mlx5 with module_pci_driver() helper (Shang XiaoJing) - Drop unnecessary buffer from ACPI call (Rafael Mendonca) - Correct latent missing include issue in iova-bitmap and fix support for unaligned bitmaps. Follow-up with better fix through refactor (Joao Martins) - Rework ccw mdev driver to split private data from parent structure, better aligning with the mdev lifecycle and allowing us to remove a temporary workaround (Eric Farman) - Add an interface to get an estimated migration data size for a device, allowing userspace to make informed decisions, ex. more accurately predicting VM downtime (Yishai Hadas) - Fix minor typo in vfio/mlx5 array declaration (Yishai Hadas) - Simplify module and Kconfig through consolidating SPAPR/EEH code and config options and folding virqfd module into main vfio module (Jason Gunthorpe) - Fix error path from device_register() across all vfio mdev and sample drivers (Alex Williamson) - Define migration pre-copy interface and implement for vfio/mlx5 devices, allowing portions of the device state to be saved while the device continues operation, towards reducing the stop-copy state size (Jason Gunthorpe, Yishai Hadas, Shay Drory) - Implement pre-copy for hisi_acc devices (Shameer Kolothum) - Fixes to mdpy mdev driver remove path and error path on probe (Shang XiaoJing) - vfio/mlx5 fixes for incorrect return after copy_to_user() fault and incorrect buffer freeing (Dan Carpenter) * tag 'vfio-v6.2-rc1' of https://github.com/awilliam/linux-vfio: (42 commits) vfio/mlx5: error pointer dereference in error handling vfio/mlx5: fix error code in mlx5vf_precopy_ioctl() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() hisi_acc_vfio_pci: Enable PRE_COPY flag hisi_acc_vfio_pci: Move the dev compatibility tests for early check hisi_acc_vfio_pci: Introduce support for PRE_COPY state transitions hisi_acc_vfio_pci: Add support for precopy IOCTL vfio/mlx5: Enable MIGRATION_PRE_COPY flag vfio/mlx5: Fallback to STOP_COPY upon specific PRE_COPY error vfio/mlx5: Introduce multiple loads vfio/mlx5: Consider temporary end of stream as part of PRE_COPY vfio/mlx5: Introduce vfio precopy ioctl implementation vfio/mlx5: Introduce SW headers for migration states vfio/mlx5: Introduce device transitions of PRE_COPY vfio/mlx5: Refactor to use queue based data chunks vfio/mlx5: Refactor migration file state vfio/mlx5: Refactor MKEY usage vfio/mlx5: Refactor PD usage vfio/mlx5: Enforce a single SAVE command at a time vfio: Extend the device migration protocol with PRE_COPY ... commit 8fa590bf344816c925810331eea8387627bbeb40 Merge: 057b40f43ce42 549a715b98a13 Author: Linus Torvalds Date: Thu Dec 15 11:12:21 2022 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM64: - Enable the per-vcpu dirty-ring tracking mechanism, together with an option to keep the good old dirty log around for pages that are dirtied by something other than a vcpu. - Switch to the relaxed parallel fault handling, using RCU to delay page table reclaim and giving better performance under load. - Relax the MTE ABI, allowing a VMM to use the MAP_SHARED mapping option, which multi-process VMMs such as crosvm rely on (see merge commit 382b5b87a97d: "Fix a number of issues with MTE, such as races on the tags being initialised vs the PG_mte_tagged flag as well as the lack of support for VM_SHARED when KVM is involved. Patches from Catalin Marinas and Peter Collingbourne"). - Merge the pKVM shadow vcpu state tracking that allows the hypervisor to have its own view of a vcpu, keeping that state private. - Add support for the PMUv3p5 architecture revision, bringing support for 64bit counters on systems that support it, and fix the no-quite-compliant CHAIN-ed counter support for the machines that actually exist out there. - Fix a handful of minor issues around 52bit VA/PA support (64kB pages only) as a prefix of the oncoming support for 4kB and 16kB pages. - Pick a small set of documentation and spelling fixes, because no good merge window would be complete without those. s390: - Second batch of the lazy destroy patches - First batch of KVM changes for kernel virtual != physical address support - Removal of a unused function x86: - Allow compiling out SMM support - Cleanup and documentation of SMM state save area format - Preserve interrupt shadow in SMM state save area - Respond to generic signals during slow page faults - Fixes and optimizations for the non-executable huge page errata fix. - Reprogram all performance counters on PMU filter change - Cleanups to Hyper-V emulation and tests - Process Hyper-V TLB flushes from a nested guest (i.e. from a L2 guest running on top of a L1 Hyper-V hypervisor) - Advertise several new Intel features - x86 Xen-for-KVM: - Allow the Xen runstate information to cross a page boundary - Allow XEN_RUNSTATE_UPDATE flag behaviour to be configured - Add support for 32-bit guests in SCHEDOP_poll - Notable x86 fixes and cleanups: - One-off fixes for various emulation flows (SGX, VMXON, NRIPS=0). - Reinstate IBPB on emulated VM-Exit that was incorrectly dropped a few years back when eliminating unnecessary barriers when switching between vmcs01 and vmcs02. - Clean up vmread_error_trampoline() to make it more obvious that params must be passed on the stack, even for x86-64. - Let userspace set all supported bits in MSR_IA32_FEAT_CTL irrespective of the current guest CPUID. - Fudge around a race with TSC refinement that results in KVM incorrectly thinking a guest needs TSC scaling when running on a CPU with a constant TSC, but no hardware-enumerated TSC frequency. - Advertise (on AMD) that the SMM_CTL MSR is not supported - Remove unnecessary exports Generic: - Support for responding to signals during page faults; introduces new FOLL_INTERRUPTIBLE flag that was reviewed by mm folks Selftests: - Fix an inverted check in the access tracking perf test, and restore support for asserting that there aren't too many idle pages when running on bare metal. - Fix build errors that occur in certain setups (unsure exactly what is unique about the problematic setup) due to glibc overriding static_assert() to a variant that requires a custom message. - Introduce actual atomics for clear/set_bit() in selftests - Add support for pinning vCPUs in dirty_log_perf_test. - Rename the so called "perf_util" framework to "memstress". - Add a lightweight psuedo RNG for guest use, and use it to randomize the access pattern and write vs. read percentage in the memstress tests. - Add a common ucall implementation; code dedup and pre-work for running SEV (and beyond) guests in selftests. - Provide a common constructor and arch hook, which will eventually be used by x86 to automatically select the right hypercall (AMD vs. Intel). - A bunch of added/enabled/fixed selftests for ARM64, covering memslots, breakpoints, stage-2 faults and access tracking. - x86-specific selftest changes: - Clean up x86's page table management. - Clean up and enhance the "smaller maxphyaddr" test, and add a related test to cover generic emulation failure. - Clean up the nEPT support checks. - Add X86_PROPERTY_* framework to retrieve multi-bit CPUID values. - Fix an ordering issue in the AMX test introduced by recent conversions to use kvm_cpu_has(), and harden the code to guard against similar bugs in the future. Anything that tiggers caching of KVM's supported CPUID, kvm_cpu_has() in this case, effectively hides opt-in XSAVE features if the caching occurs before the test opts in via prctl(). Documentation: - Remove deleted ioctls from documentation - Clean up the docs for the x86 MSR filter. - Various fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (361 commits) KVM: x86: Add proper ReST tables for userspace MSR exits/flags KVM: selftests: Allocate ucall pool from MEM_REGION_DATA KVM: arm64: selftests: Align VA space allocator with TTBR0 KVM: arm64: Fix benign bug with incorrect use of VA_BITS KVM: arm64: PMU: Fix period computation for 64bit counters with 32bit overflow KVM: x86: Advertise that the SMM_CTL MSR is not supported KVM: x86: remove unnecessary exports KVM: selftests: Fix spelling mistake "probabalistic" -> "probabilistic" tools: KVM: selftests: Convert clear/set_bit() to actual atomics tools: Drop "atomic_" prefix from atomic test_and_set_bit() tools: Drop conflicting non-atomic test_and_{clear,set}_bit() helpers KVM: selftests: Use non-atomic clear/set bit helpers in KVM tests perf tools: Use dedicated non-atomic clear/set bit helpers tools: Take @bit as an "unsigned long" in {clear,set}_bit() helpers KVM: arm64: selftests: Enable single-step without a "full" ucall() KVM: x86: fix APICv/x2AVIC disabled when vm reboot by itself KVM: Remove stale comment about KVM_REQ_UNHALT KVM: Add missing arch for KVM_CREATE_DEVICE and KVM_{SET,GET}_DEVICE_ATTR KVM: Reference to kvm_userspace_memory_region in doc and comments KVM: Delete all references to removed KVM_SET_MEMORY_ALIAS ioctl ... commit 44a84da45272b3f4beb90025a64cfbde18f1aef0 Author: Dylan Yudaken Date: Thu Dec 15 10:41:38 2022 -0800 io_uring: use call_rcu_hurry if signaling an eventfd io_uring uses call_rcu in the case it needs to signal an eventfd as a result of an eventfd signal, since recursing eventfd signals are not allowed. This should be calling the new call_rcu_hurry API to not delay the signal. Signed-off-by: Dylan Yudaken Cc: Joel Fernandes (Google) Cc: Paul E. McKenney Acked-by: Paul E. McKenney Reviewed-by: Joel Fernandes (Google) Link: https://lore.kernel.org/r/20221215184138.795576-1-dylany@meta.com Signed-off-by: Jens Axboe commit 3e844d842d49cdbe61a4b338bdd512654179488a Author: Dave Hansen Date: Fri Nov 18 07:16:16 2022 -0800 x86/mm: Ensure forced page table splitting There are a few kernel users like kfence that require 4k pages to work correctly and do not support large mappings. They use set_memory_4k() to break down those large mappings. That, in turn relies on cpa_data->force_split option to indicate to set_memory code that it should split page tables regardless of whether the need to be. But, a recent change added an optimization which would return early if a set_memory request came in that did not change permissions. It did not consult ->force_split and would mistakenly optimize away the splitting that set_memory_4k() needs. This broke kfence. Skip the same-permission optimization when ->force_split is set. Fixes: 127960a05548 ("x86/mm: Inhibit _PAGE_NX changes from cpa_process_alias()") Signed-off-by: Dave Hansen Tested-by: Marco Elver Cc: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/CA+G9fYuFxZTxkeS35VTZMXwQvohu73W3xbZ5NtjebsVvH6hCuA@mail.gmail.com/ commit 1cfaac2400c73378e78182a706be0f3ac8b93cd7 Author: Sean Christopherson Date: Thu Nov 10 20:35:04 2022 +0000 x86/kasan: Populate shadow for shared chunk of the CPU entry area Popuplate the shadow for the shared portion of the CPU entry area, i.e. the read-only IDT mapping, during KASAN initialization. A recent change modified KASAN to map the per-CPU areas on-demand, but forgot to keep a shadow for the common area that is shared amongst all CPUs. Map the common area in KASAN init instead of letting idt_map_in_cea() do the dirty work so that it Just Works in the unlikely event more shared data is shoved into the CPU entry area. The bug manifests as a not-present #PF when software attempts to lookup an IDT entry, e.g. when KVM is handling IRQs on Intel CPUs (KVM performs direct CALL to the IRQ handler to avoid the overhead of INTn): BUG: unable to handle page fault for address: fffffbc0000001d8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 16c03a067 P4D 16c03a067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 5 PID: 901 Comm: repro Tainted: G W 6.1.0-rc3+ #410 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kasan_check_range+0xdf/0x190 vmx_handle_exit_irqoff+0x152/0x290 [kvm_intel] vcpu_run+0x1d89/0x2bd0 [kvm] kvm_arch_vcpu_ioctl_run+0x3ce/0xa70 [kvm] kvm_vcpu_ioctl+0x349/0x900 [kvm] __x64_sys_ioctl+0xb8/0xf0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") Reported-by: syzbot+8cdd16fd5a6c0565e227@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221110203504.1985010-6-seanjc@google.com commit bde258d97409f2a45243cb393a55ea9ecfc7aba5 Author: Sean Christopherson Date: Thu Nov 10 20:35:03 2022 +0000 x86/kasan: Add helpers to align shadow addresses up and down Add helpers to dedup code for aligning shadow address up/down to page boundaries when translating an address to its shadow. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Ryabinin Link: https://lkml.kernel.org/r/20221110203504.1985010-5-seanjc@google.com commit 7077d2ccb94dafd00b29cc2d601c9f6891648f5b Author: Sean Christopherson Date: Thu Nov 10 20:35:02 2022 +0000 x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names Rename the CPU entry area variables in kasan_init() to shorten their names, a future fix will reference the beginning of the per-CPU portion of the CPU entry area, and shadow_cpu_entry_per_cpu_begin is a bit much. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Ryabinin Link: https://lkml.kernel.org/r/20221110203504.1985010-4-seanjc@google.com commit 97650148a15e0b30099d6175ffe278b9f55ec66a Author: Sean Christopherson Date: Thu Nov 10 20:35:01 2022 +0000 x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area Populate a KASAN shadow for the entire possible per-CPU range of the CPU entry area instead of requiring that each individual chunk map a shadow. Mapping shadows individually is error prone, e.g. the per-CPU GDT mapping was left behind, which can lead to not-present page faults during KASAN validation if the kernel performs a software lookup into the GDT. The DS buffer is also likely affected. The motivation for mapping the per-CPU areas on-demand was to avoid mapping the entire 512GiB range that's reserved for the CPU entry area, shaving a few bytes by not creating shadows for potentially unused memory was not a goal. The bug is most easily reproduced by doing a sigreturn with a garbage CS in the sigcontext, e.g. int main(void) { struct sigcontext regs; syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); memset(®s, 0, sizeof(regs)); regs.cs = 0x1d0; syscall(__NR_rt_sigreturn); return 0; } to coerce the kernel into doing a GDT lookup to compute CS.base when reading the instruction bytes on the subsequent #GP to determine whether or not the #GP is something the kernel should handle, e.g. to fixup UMIP violations or to emulate CLI/STI for IOPL=3 applications. BUG: unable to handle page fault for address: fffffbc8379ace00 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 16c03a067 P4D 16c03a067 PUD 15b990067 PMD 15b98f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 3 PID: 851 Comm: r2 Not tainted 6.1.0-rc3-next-20221103+ #432 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kasan_check_range+0xdf/0x190 Call Trace: get_desc+0xb0/0x1d0 insn_get_seg_base+0x104/0x270 insn_fetch_from_user+0x66/0x80 fixup_umip_exception+0xb1/0x530 exc_general_protection+0x181/0x210 asm_exc_general_protection+0x22/0x30 RIP: 0003:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0003:0000000000000000 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000001d0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") Reported-by: syzbot+ffb4f000dc2872c93f62@syzkaller.appspotmail.com Suggested-by: Andrey Ryabinin Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Ryabinin Link: https://lkml.kernel.org/r/20221110203504.1985010-3-seanjc@google.com commit 80d72a8f76e8f3f0b5a70b8c7022578e17bde8e7 Author: Sean Christopherson Date: Thu Nov 10 20:35:00 2022 +0000 x86/mm: Recompute physical address for every page of per-CPU CEA mapping Recompute the physical address for each per-CPU page in the CPU entry area, a recent commit inadvertantly modified cea_map_percpu_pages() such that every PTE is mapped to the physical address of the first page. Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Ryabinin Link: https://lkml.kernel.org/r/20221110203504.1985010-2-seanjc@google.com commit e996365ee7475805d2a01312532855004e89df84 Author: Peter Zijlstra Date: Thu Nov 10 13:34:00 2022 +0100 x86/mm: Rename __change_page_attr_set_clr(.checkalias) Now that the checkalias functionality is taken by CPA_NO_CHECK_ALIAS rename the argument to better match is remaining purpose: primary, matching __change_page_attr(). Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221110125544.661001508%40infradead.org commit d597416683d587e940faa35945fba162329b5a71 Author: Peter Zijlstra Date: Thu Nov 10 13:33:57 2022 +0100 x86/mm: Inhibit _PAGE_NX changes from cpa_process_alias() There is a cludge in change_page_attr_set_clr() that inhibits propagating NX changes to the aliases (directmap and highmap) -- this is a cludge twofold: - it also inhibits the primary checks in __change_page_attr(); - it hard depends on single bit changes. The introduction of set_memory_rox() triggered this last issue for clearing both _PAGE_RW and _PAGE_NX. Explicitly ignore _PAGE_NX in cpa_process_alias() instead. Fixes: b38994948567 ("x86/mm: Implement native set_memory_rox()") Reported-by: kernel test robot Debugged-by: Dave Hansen Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221110125544.594991716%40infradead.org commit ef9ab81af6e1f7b7ff589aa1504434aa5915c1df Author: Peter Zijlstra Date: Thu Nov 10 13:33:54 2022 +0100 x86/mm: Untangle __change_page_attr_set_clr(.checkalias) The .checkalias argument to __change_page_attr_set_clr() is overloaded and serves two different purposes: - it inhibits the call to cpa_process_alias() -- as suggested by the name; however, - it also serves as 'primary' indicator for __change_page_attr() ( which in turn also serves as a recursion terminator for cpa_process_alias() ). Untangle these by extending the use of CPA_NO_CHECK_ALIAS to all callsites that currently use .checkalias=0 for this purpose. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221110125544.527267183%40infradead.org commit 5ceeee7571b7628f439ae0444ec41d132558f47e Author: Peter Zijlstra Date: Thu Nov 10 13:33:50 2022 +0100 x86/mm: Add a few comments It's a shame to hide useful comments in Changelogs, add some to the code. Shamelessly stolen from commit: c40a56a7818c ("x86/mm/init: Remove freed kernel image areas from alias mapping") Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221110125544.460677011%40infradead.org commit 80d0969aa7832bfeb287cb22563a1ad08fea937d Author: Kirill A. Shutemov Date: Wed Nov 9 19:51:25 2022 +0300 x86/mm: Fix CR3_ADDR_MASK The mask must not include bits above physical address mask. These bits are reserved and can be used for other things. Bits 61 and 62 are used for Linear Address Masking. Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Alexander Potapenko Acked-by: Peter Zijlstra (Intel) Tested-by: Alexander Potapenko Link: https://lore.kernel.org/all/20221109165140.9137-2-kirill.shutemov%40linux.intel.com commit 82328227db8f0b9b5f77bb5afcd47e59d0e4d08f Author: Pasha Tatashin Date: Mon May 16 18:52:02 2022 +0000 x86/mm: Remove P*D_PAGE_MASK and P*D_PAGE_SIZE macros Other architectures and the common mm/ use P*D_MASK, and P*D_SIZE. Remove the duplicated P*D_PAGE_MASK and P*D_PAGE_SIZE which are only used in x86/*. Signed-off-by: Pasha Tatashin Signed-off-by: Borislav Petkov Reviewed-by: Anshuman Khandual Acked-by: Mike Rapoport Link: https://lore.kernel.org/r/20220516185202.604654-1-tatashin@google.com commit 2dff2c359e829245bc3d80e42e296876d1f0cf8e Author: Peter Zijlstra Date: Tue Nov 1 12:53:18 2022 +0100 mm: Convert __HAVE_ARCH_P..P_GET to the new style Since __HAVE_ARCH_* style guards have been depricated in favour of defining the function name onto itself, convert pxxp_get(). Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/Y2EUEBlQXNgaJgoI@hirez.programming.kicks-ass.net commit eb780dcae02d5a71e6979aa7b8c708dea8597adf Author: Peter Zijlstra Date: Fri Oct 21 13:47:29 2022 +0200 mm: Remove pointless barrier() after pmdp_get_lockless() pmdp_get_lockless() should itself imply any ordering required. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114425.298833095%40infradead.org commit d4a72e7fe61a1ea9ad4accf3532411ca685eaead Author: Peter Zijlstra Date: Fri Oct 21 13:36:24 2022 +0200 x86/mm/pae: Get rid of set_64bit() Recognise that set_64bit() is a special case of our previously introduced pxx_xchg64(), so use that and get rid of set_64bit(). Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114425.233481884%40infradead.org commit 9ee850acd25dc290d3cad2707e99380e372ad490 Author: Peter Zijlstra Date: Fri Oct 21 14:11:38 2022 +0200 x86_64: Remove pointless set_64bit() usage The use of set_64bit() in X86_64 only code is pretty pointless, seeing how it's a direct assignment. Remove all this nonsense. [nathanchance: unbreak irte] Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114425.168036718%40infradead.org commit b7301f20105a27112f7ca8040cfb0b0505a32fbd Author: Peter Zijlstra Date: Mon Nov 30 12:21:25 2020 +0100 x86/mm/pae: Be consistent with pXXp_get_and_clear() Given that ptep_get_and_clear() uses cmpxchg8b, and that should be by far the most common case, there's no point in having an optimized variant for pmd/pud. Introduce the pxx_xchg64() helper to implement the common logic once. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114425.103392961%40infradead.org commit f7bcd4617de67a4700a7bd7dc56808b57f1c8748 Author: Peter Zijlstra Date: Thu Nov 26 17:40:12 2020 +0100 x86/mm/pae: Use WRITE_ONCE() Disallow write-tearing, that would be really unfortunate. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114425.038102604%40infradead.org commit 7a9b8bdb6af3e19fb8e3dc7a3caf6a9ea1bed8cd Author: Peter Zijlstra Date: Thu Nov 26 17:38:42 2020 +0100 x86/mm/pae: Don't (ab)use atomic64 PAE implies CX8, write readable code. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.971450128%40infradead.org commit 1180e732c985ed3c8866d2fd9e02b619848404a0 Author: Peter Zijlstra Date: Thu Nov 26 17:21:30 2020 +0100 mm/gup: Fix the lockless PMD access On architectures where the PTE/PMD is larger than the native word size (i386-PAE for example), READ_ONCE() can do the wrong thing. Use pmdp_get_lockless() just like we use ptep_get_lockless(). Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.906110403%40infradead.org commit dab6e717429e5ec795d558a0e9a5337a1ed33a3d Author: Peter Zijlstra Date: Thu Nov 26 17:20:28 2020 +0100 mm: Rename pmd_read_atomic() There's no point in having the identical routines for PTE/PMD have different names. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.841277397%40infradead.org commit 6ca297d4784625de7b041e8451780643cf5751a4 Author: Peter Zijlstra Date: Fri Oct 21 14:51:44 2022 +0200 mm: Rename GUP_GET_PTE_LOW_HIGH Since it no longer applies to only PTEs, rename it to PXX. Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.776404066%40infradead.org commit 024d232ae4fcd7a7ce8ea239607d6c1246d7adc8 Author: Peter Zijlstra Date: Thu Nov 26 17:16:22 2020 +0100 mm: Fix pmd_read_atomic() AFAICT there's no reason to do anything different than what we do for PTEs. Make it so (also affects SH). Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.711181252%40infradead.org commit 0862ff059c9e29f023e617b134f9ea332cae50b8 Author: Peter Zijlstra Date: Thu Nov 26 17:05:55 2020 +0100 sh/mm: Make pmd_t similar to pte_t Just like 64bit pte_t, have a low/high split in pmd_t. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.645657294%40infradead.org commit fbfdec9989e69e0b17aa3bf32fcb22d04cc33301 Author: Peter Zijlstra Date: Thu Nov 26 17:02:29 2020 +0100 x86/mm/pae: Make pmd_t similar to pte_t Instead of mucking about with at least 2 different ways of fudging it, do the same thing we do for pte_t. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.580310787%40infradead.org commit 93b3037a1482758349f3b0431406bcc457ca1cbc Author: Peter Zijlstra Date: Thu Nov 26 14:04:46 2020 +0100 mm: Update ptep_get_lockless()'s comment Improve the comment. Suggested-by: Matthew Wilcox Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221022114424.515572025%40infradead.org commit 60463628c9e0a8060ac6bef0457b0505c7532c7c Author: Peter Zijlstra Date: Sat Oct 29 13:19:31 2022 +0200 x86/mm: Implement native set_memory_rox() Provide a native implementation of set_memory_rox(), avoiding the double set_memory_ro();set_memory_x(); calls. Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) commit d48567c9a0d1e605639f8a8705a61bbb55fb4e84 Author: Peter Zijlstra Date: Wed Oct 26 12:13:03 2022 +0200 mm: Introduce set_memory_rox() Because endlessly repeating: set_memory_ro() set_memory_x() is getting tedious. Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/Y1jek64pXOsougmz@hirez.programming.kicks-ass.net commit 414ebf148cb5c5fa727ec51fdb69c4ab82dccf3b Author: Peter Zijlstra Date: Tue Oct 25 21:39:43 2022 +0200 x86/mm: Do verify W^X at boot up Straight up revert of commit: a970174d7a10 ("x86/mm: Do not verify W^X at boot up") now that the root cause has been fixed. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221025201058.011279208@infradead.org commit eb7d389d5b2b3c453332abc41c3eea73290cc006 Author: Peter Zijlstra Date: Tue Oct 25 21:39:47 2022 +0200 x86/ftrace: Remove SYSTEM_BOOTING exceptions Now that text_poke is available before ftrace, remove the SYSTEM_BOOTING exceptions. Specifically, this cures a W+X case during boot. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221025201057.945960823@infradead.org commit 5b93a83649c7cba3a15eb7e8959b250841acb1b1 Author: Peter Zijlstra Date: Tue Oct 25 21:38:25 2022 +0200 x86/mm: Initialize text poking earlier Move poking_init() up a bunch; specifically move it right after mm_init() which is right before ftrace_init(). This will allow simplifying ftrace text poking which currently has a bunch of exceptions for early boot. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221025201057.881703081@infradead.org commit 3f4c8211d982099be693be9aa7d6fc4607dff290 Author: Peter Zijlstra Date: Tue Oct 25 21:38:21 2022 +0200 x86/mm: Use mm_alloc() in poking_init() Instead of duplicating init_mm, allocate a fresh mm. The advantage is that mm_alloc() has much simpler dependencies. Additionally it makes more conceptual sense, init_mm has no (and must not have) user state to duplicate. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221025201057.816175235@infradead.org commit af80602799681c78f14fbe20b6185a56020dedee Author: Peter Zijlstra Date: Tue Oct 25 21:38:18 2022 +0200 mm: Move mm_cachep initialization to mm_init() In order to allow using mm_alloc() much earlier, move initializing mm_cachep into mm_init(). Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221025201057.751153381@infradead.org commit 97e3d26b5e5f371b3ee223d94dd123e6c442ba80 Author: Peter Zijlstra Date: Thu Oct 27 14:54:41 2022 -0700 x86/mm: Randomize per-cpu entry area Seth found that the CPU-entry-area; the piece of per-cpu data that is mapped into the userspace page-tables for kPTI is not subject to any randomization -- irrespective of kASLR settings. On x86_64 a whole P4D (512 GB) of virtual address space is reserved for this structure, which is plenty large enough to randomize things a little. As such, use a straight forward randomization scheme that avoids duplicates to spread the existing CPUs over the available space. [ bp: Fix le build. ] Reported-by: Seth Jenkins Reviewed-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Dave Hansen Signed-off-by: Borislav Petkov commit 3f148f3318140035e87decc1214795ff0755757b Author: Andrey Ryabinin Date: Fri Oct 28 00:31:04 2022 +0300 x86/kasan: Map shadow for percpu pages on demand KASAN maps shadow for the entire CPU-entry-area: [CPU_ENTRY_AREA_BASE, CPU_ENTRY_AREA_BASE + CPU_ENTRY_AREA_MAP_SIZE] This will explode once the per-cpu entry areas are randomized since it will increase CPU_ENTRY_AREA_MAP_SIZE to 512 GB and KASAN fails to allocate shadow for such big area. Fix this by allocating KASAN shadow only for really used cpu entry area addresses mapped by cea_map_percpu_pages() Thanks to the 0day folks for finding and reporting this to be an issue. [ dhansen: tweak changelog since this will get committed before peterz's actual cpu-entry-area randomization ] Signed-off-by: Andrey Ryabinin Signed-off-by: Dave Hansen Tested-by: Yujie Liu Cc: kernel test robot Link: https://lore.kernel.org/r/202210241508.2e203c3d-yujie.liu@intel.com commit 057b40f43ce429a02e793adf3cfbf2446a19a38e Merge: 601c1aa855a68 3d03140c4844b Author: Linus Torvalds Date: Thu Dec 15 10:21:10 2022 -0800 Merge tag 'acpi-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These fix an AML byte code execution issue in ACPICA and two issues in the ACPI EC driver which requires rearranging ACPICA code. Specifics: - Avoid trying to resolve operands in AML when there are none (Amadeusz Sławiński) - Fix indentation in include/acpi/acpixf.h to help applying patches from the upstream ACPICA git (Hans de Goede) - Make it possible to install an address space handler without evaluating _REG for Operation Regions in the given address space (Hans de Goede) - Defer the evaluation of _REG for ECDT described ECs till the matching EC device in the DSDT gets parsed and acpi_ec_add() gets called for it (Hans de Goede) - Fix EC address space handler unregistration (Hans de Goede)" * tag 'acpi-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: Fix ECDT probe ordering issues ACPI: EC: Fix EC address space handler unregistration ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps ACPICA: include/acpi/acpixf.h: Fix indentation ACPICA: Fix operand resolution commit 0a3212de8ab3e2ce5808c6265855e528d4a6767b Author: Naohiro Aota Date: Wed Dec 14 11:06:07 2022 +0900 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS Fix a typo of printing FLUSH_DELAYED_REFS event in flush_space() as FLUSH_ELAYED_REFS. Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit f1f0460c0ca97a4a6570f211c81579294a6cc7be Author: Josef Bacik Date: Tue Dec 13 16:57:44 2022 -0500 btrfs: restore BTRFS_SEQ_LAST when looking up qgroup backref lookup In the patch a2c8d27e5ee8 ("btrfs: use a structure to pass arguments to backref walking functions") Filipe converted everybody to using a new context struct to use for backref lookups, but accidentally dropped the BTRFS_SEQ_LAST usage that exists for qgroups. Add this back so we have the previous behavior. Fixes: a2c8d27e5ee8 ("btrfs: use a structure to pass arguments to backref walking functions") Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit c68f72900a12a56c5e9890e6f2ca5119234c9a75 Author: Filipe Manana Date: Tue Dec 13 10:42:26 2022 +0000 btrfs: fix leak of fs devices after removing btrfs module When removing the btrfs module we are not calling btrfs_cleanup_fs_uuids() which results in leaking btrfs_fs_devices structures and other resources. This is a regression recently introduced by a refactoring of the module initialization and exit sequence, which simply removed the call to btrfs_cleanup_fs_uuids() in the exit path, resulting in the leaks. So fix this by calling btrfs_cleanup_fs_uuids() at exit_btrfs_fs(). Fixes: 5565b8e0adcd ("btrfs: make module init/exit match their sequence") Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit db0a4a7b8e95f9312a59a67cbd5bc589f090e13d Author: Christophe JAILLET Date: Mon Dec 12 21:01:43 2022 +0100 btrfs: fix an error handling path in btrfs_defrag_leaves() All error handling paths end to 'out', except this memory allocation failure. This is spurious. So branch to the error handling path also in this case. It will add a call to: memset(&root->defrag_progress, 0, sizeof(root->defrag_progress)); Fixes: 6702ed490ca0 ("Btrfs: Add run time btree defrag, and an ioctl to force btree defrag") Signed-off-by: Christophe JAILLET Reviewed-by: David Sterba Signed-off-by: David Sterba commit abe3bf7425fb695a9b37394af18b9ea58a800802 Author: Christophe JAILLET Date: Mon Dec 12 21:14:17 2022 +0100 btrfs: fix an error handling path in btrfs_rename() If new_whiteout_inode() fails, some resources need to be freed. Add the missing goto to the error handling path. Fixes: ab3c5c18e8fa ("btrfs: setup qstr from dentrys using fscrypt helper") Reviewed-by: Sweet Tea Dorminy Signed-off-by: Christophe JAILLET Reviewed-by: David Sterba Signed-off-by: David Sterba commit 601c1aa855a686643259c4a34e96ee692cdaf01f Merge: c0f234ff90a21 bd7bcc4f963c8 Author: Linus Torvalds Date: Thu Dec 15 10:16:04 2022 -0800 Merge tag 'thermal-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "These are updates of assorted thermal drivers, mostly for ARM platforms, generally isolated and fairly straightforward, and the recent Intel HFI driver fix for systems without HFI support. Specifics: - Avoid clearing the HFI status bit on systems without HFI support which triggers unchecked MSR access errors (Srinivas Pandruvada) - Add sm8450 and sm8550 QCom compatible string to DT bindings (Luca Weiss, Neil Armstrong) - Use devm_platform_get_and_ioremap_resource on the ST platform to group two calls into a single one (Minghao Chi) - Use GENMASK instead of bitmaps and validate the temperature after reading it in the imx8mm_thermal driver (Marcus Folkesson) - Convert generic-adc-thermal to DT schema (Rob Herring) - Fix debug print message with inverted logic in the k3_j72xx_bandgap driver (Keerthy) - Fix memory leak on thermal_of_zone_register() failure (Ido Schimmel) - Add support for IPQ8074 in the tsens thermal driver along with the DT bindings (Robert Marko) - Fix and rework the debugfs code in the tsens driver (Christian Marangi) - Add calibration and DT documentation for the imx8mm driver (Marek Vasut) - Add DT bindings and compatible for the Mediatek SoCs mt7981 and mt7983 (Daniel Golle) - Don't show an error message if it happens at probe time while it will be deferred on the QCom SPMI ADC driver (Johan Hovold) - Add HWMon support for the imx8mm board (Alexander Stein) - Remove pointless include from the power allocator governor (Christophe JAILLET) - Add interrupt DT bindings for QCom SoCs SC8280XP, SM6350 and SM8450 (Krzysztof Kozlowski) - Fix inaccurate warning message for the QCom tsens gen2 (Luca Weiss) - Demote error log of thermal zone register to debug in the tsens QCom driver (Manivannan Sadhasivam) - Consolidate the the efuse values and the errata handling in the TI Bandgap driver (Bryan Brattlof) - Document Renesas RZ/Five as compatible with RZ/G2UL in the DT bindings (Lad Prabhakar) - Fix the irq handler return value in the LMh driver (Bjorn Andersson) - Delete empty platform remove callback from imx_sc_thermal (Uwe Kleine-König)" * tag 'thermal-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (35 commits) thermal/drivers/imx_sc_thermal: Drop empty platform remove function thermal/drivers/qcom/lmh: Fix irq handler return value dt-bindings: thermal: qcom-tsens: Add compatible for sm8550 thermal/drivers/st: Use devm_platform_get_and_ioremap_resource() dt-bindings: thermal: rzg2l-thermal: Document RZ/Five SoC dt-bindings: thermal: k3-j72xx: conditionally require efuse reg range dt-bindings: thermal: k3-j72xx: elaborate on binding description thermal/drivers/k3_j72xx_bandgap: Map fuse_base only for erratum workaround thermal/drivers/k3_j72xx_bandgap: Remove fuse_base from structure thermal/drivers/k3_j72xx_bandgap: Use bool for i2128 erratum flag thermal/drivers/k3_j72xx_bandgap: Simplify k3_thermal_get_temp() function thermal/drivers/qcom: Demote error log of thermal zone register to debug thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 dt-bindings: thermal: qcom-tsens: narrow interrupts for SC8280XP, SM6350 and SM8450 thermal/core/power allocator: Remove a useless include thermal/drivers/imx8mm: Add hwmon support thermal: qcom-spmi-adc-tm5: suppress probe-deferral error message dt-bindings: thermal: mediatek: add compatible string for MT7986 and MT7981 SoC thermal: ti-soc-thermal: Drop comma after SoC match table sentinel thermal/drivers/imx: Add support for loading calibration data from OCOTP ... commit c0cd1d541704c45030cbb2031612fdd68e8e15d5 Author: Will Deacon Date: Thu Dec 15 17:59:12 2022 +0000 Revert "arm64: errata: Workaround possible Cortex-A715 [ESR|FAR]_ELx corruption" This reverts commit 44ecda71fd8a70185c270f5914ac563827fe1d4c. All versions of this patch on the mailing list, including the version that ended up getting merged, have portions of code guarded by the non-existent CONFIG_ARM64_WORKAROUND_2645198 option. Although Anshuman says he tested the code with some additional debug changes [1], I'm hesitant to fix the CONFIG option and light up a bunch of code right before I (and others) disappear for the end of year holidays, during which time we won't be around to deal with any fallout. So revert the change for now. We can bring back a fixed, tested version for a later -rc when folks are thinking about things other than trees and turkeys. [1] https://lore.kernel.org/r/b6f61241-e436-5db1-1053-3b441080b8d6@arm.com Reported-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20221215094811.23188-1-lukas.bulwahn@gmail.com Signed-off-by: Will Deacon commit c0f234ff90a211272138be1611ba53f3155ebd78 Merge: 9fa4abc9ad2a1 11e47bbd700f3 Author: Linus Torvalds Date: Thu Dec 15 09:45:51 2022 -0800 Merge tag 'gpio-updates-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We have a new GPIO multiplexer driver, bunch of driver updates and refactoring in the core GPIO library. GPIO core: - teach gpiolib to work with software nodes for HW description - remove ARCH_NR_GPIOS treewide as we no longer impose any limit on the number of GPIOS since the allocation became entirely dynamic - add support for HW quirks for Cirrus CS42L56 codec, Marvell NFC controller, Freescale PCIe and Ethernet controller, Himax LCDs and Mediatek mt2701 - refactor OF quirk code - some general refactoring of the OF and ACPI code, adding new helpers, minor tweaks and fixes, making fwnode usage consistent etc. GPIO uAPI: - fix an issue where the user-space can trigger a NULL-pointer dereference in the kernel by opening a device file, forcing a driver unbind and then calling one of the syscalls on the associated file descriptor New drivers: - add gpio-latch: a new GPIO multiplexer based on latches connected to other GPIOs Driver updates: - convert i2c GPIO expanders to using .probe_new() - drop the gpio-sta2x11 driver - factor out common code for the ACCES IDIO-16 family of controllers and use this new library wherever applicable in drivers - add DT support to gpio-hisi - allow building gpio-davinci as a module and increase its maxItems property - add support for a new model to gpio-pca9570 - other minor changes to various drivers" * tag 'gpio-updates-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (66 commits) gpio: sim: set a limit on the number of GPIOs gpiolib: protect the GPIO device against being dropped while in use by user-space gpiolib: cdev: fix NULL-pointer dereferences gpiolib: Provide to_gpio_device() helper gpiolib: Unify access to the device properties gpio: Do not include when not really needed. gpio: pcf857x: Convert to i2c's .probe_new() gpio: pca953x: Convert to i2c's .probe_new() gpio: max732x: Convert to i2c's .probe_new() dt-bindings: gpio: gpio-davinci: Increase maxItems in gpio-line-names gpiolib: ensure that fwnode is properly set gpio: sl28cpld: Replace irqchip mask_invert with unmask_base gpiolib: of: Use correct fwnode for DT-probed chips gpiolib: of: Drop redundant check in of_mm_gpiochip_remove() gpiolib: of: Prepare of_mm_gpiochip_add_data() for fwnode gpiolib: add support for software nodes gpiolib: consolidate GPIO lookups gpiolib: acpi: avoid leaking ACPI details into upper gpiolib layers gpiolib: acpi: teach acpi_find_gpio() to handle data-only nodes gpiolib: acpi: change acpi_find_gpio() to accept firmware node ... commit 3d03140c4844bbd128728e8a367bb467d95f888e Merge: f7eae09b50431 ab4620f58d382 Author: Rafael J. Wysocki Date: Thu Dec 15 18:38:22 2022 +0100 Merge branch 'acpi-ec' Merge additional ACPI EC driver fixes for 6.2-rc1: - Fix EC address space handler unregistration (Hans de Goede). - Defer the evaluation of _REG for ECDT described ECs till the matching EC device in the DSDT gets parsed and acpi_ec_add() gets called for it (Hans de Goede). * acpi-ec: ACPI: EC: Fix ECDT probe ordering issues ACPI: EC: Fix EC address space handler unregistration commit 9fa4abc9ad2a18410a7087e6cea15ad1ffb172c6 Merge: 504a73d46bad8 3c3bfb8586f84 Author: Linus Torvalds Date: Thu Dec 15 09:37:00 2022 -0800 Merge tag 'fbdev-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "The most relevant change are the patches from Dmitry Torokhov to switch omapfb to the gpiod API. The other patches are small and fix e.g. UML build issues, improve the error paths and cleanup code" * tag 'fbdev-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (32 commits) fbdev: fbcon: release buffer when fbcon_do_set_font() failed fbdev: sh_mobile_lcdcfb: use sysfs_emit() to instead of scnprintf() fbdev: uvesafb: use sysfs_emit() to instead of scnprintf() fbdev: uvesafb: Simplify uvesafb_remove() fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() fbdev: uvesafb: don't build on UML fbdev: geode: don't build on UML fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: matroxfb: Convert to i2c's .probe_new() fbdev: da8xx-fb: add missing regulator_disable() in fb_probe fbdev: controlfb: fix spelling mistake "paramaters"->"parameters" fbdev: vermilion: decrease reference count in error path fbdev: smscufx: fix error handling code in ufx_usb_probe fbdev: via: Fix error in via_core_init() fbdev: pm2fb: fix missing pci_disable_device() fbdev: pxafb: Remove unnecessary print function dev_err() fbdev: omapfb: panel-sharp-ls037v7dw01: fix included headers fbdev: omapfb: panel-tpo-td028ttec1: stop including gpio.h fbdev: omapfb: panel-lgphilips-lb035q02: remove backlight GPIO handling fbdev: omapfb: encoder-opa362: fix included headers ... commit f7eae09b50431e36fd61c8cb6fb184bf0e068905 Merge: bee74dcbd3908 54c516aeb8b39 Author: Rafael J. Wysocki Date: Thu Dec 15 18:32:48 2022 +0100 Merge branch 'acpica' Merge additional ACPICA changes for 6.2-rc1: - Avoid trying to resolve operands in AML when there are none (Amadeusz Sławiński). - Fix indentation in include/acpi/acpixf.h to help applying patches from the upstream ACPICA git (Hans de Goede). - Make it possible to install an address space handler without evaluating _REG for Operation Regions in the given address space (Hans de Goede). * acpica: ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps ACPICA: include/acpi/acpixf.h: Fix indentation ACPICA: Fix operand resolution commit 504a73d46bad8964be2cdaa63a2bedaef198ea3b Merge: 041fae9c105ae 72ee45fd46d0d Author: Linus Torvalds Date: Thu Dec 15 09:29:19 2022 -0800 Merge tag '6.2-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd updates from Steve French: "Six ksmbd server fixes" * tag '6.2-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs ksmbd: Fix resource leak in smb2_lock() ksmbd: Fix resource leak in ksmbd_session_rpc_open() ksmbd: replace one-element arrays with flexible-array members ksmbd: use F_SETLK when unlocking a file ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for this share commit 7a18e089eff02f17eaee49fc18641f5d16a8284b Author: Evan Quan Date: Mon Dec 5 15:33:31 2022 +0800 drm/amd/pm: update SMU13.0.0 reported maximum shader clock Update the reported maximum shader clock to the value which can be guarded to be achieved on all cards. This is to align with Window setting. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit 32a7819ff8e25375c7515aaae5cfcb8c44a461b7 Author: Evan Quan Date: Mon Dec 5 14:53:34 2022 +0800 drm/amd/pm: correct SMU13.0.0 pstate profiling clock settings Correct the pstate standard/peak profiling mode clock settings for SMU13.0.0. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit 62b9f835a6c60171845642afec4ce4b44865f10f Author: Evan Quan Date: Fri Dec 2 14:03:45 2022 +0800 drm/amd/pm: enable GPO dynamic control support for SMU13.0.7 To better support UMD pstate profilings, the GPO feature needs to be switched on/off accordingly. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit 1794f6a9535bb5234c2b747d1bc6dad03249245a Author: Evan Quan Date: Fri Dec 2 13:56:35 2022 +0800 drm/amd/pm: enable GPO dynamic control support for SMU13.0.0 To better support UMD pstate profilings, the GPO feature needs to be switched on/off accordingly. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit 5fc24e6022d47c19d92fb8b84c1616754ef6fdb2 Author: Jason Gunthorpe Date: Thu Dec 15 11:29:25 2022 -0400 RDMA/rxe: Fix compile warnings on 32-bit Move the conditional code into a function, with two varients so it is harder to make these kinds of mistakes. drivers/infiniband/sw/rxe/rxe_resp.c: In function 'atomic_write_reply': drivers/infiniband/sw/rxe/rxe_resp.c:794:13: error: unused variable 'payload' [-Werror=unused-variable] 794 | int payload = payload_size(pkt); | ^~~~~~~ drivers/infiniband/sw/rxe/rxe_resp.c:793:24: error: unused variable 'mr' [-Werror=unused-variable] 793 | struct rxe_mr *mr = qp->resp.mr; | ^~ drivers/infiniband/sw/rxe/rxe_resp.c:791:19: error: unused variable 'dst' [-Werror=unused-variable] 791 | u64 src, *dst; | ^~~ drivers/infiniband/sw/rxe/rxe_resp.c:791:13: error: unused variable 'src' [-Werror=unused-variable] 791 | u64 src, *dst; Fixes: 034e285f8b99 ("RDMA/rxe: Make responder support atomic write on RC service") Link: https://lore.kernel.org/linux-rdma/Y5s+EVE7eLWQqOwv@nvidia.com/ Reported-by: Guenter Roeck Signed-off-by: Jason Gunthorpe commit a8cf95f93610eb8282f8b6d0117ba78b74588d6b Author: Pavel Begunkov Date: Fri Dec 2 17:47:25 2022 +0000 io_uring: fix overflow handling regression Because the single task locking series got reordered ahead of the timeout and completion lock changes, two hunks inadvertently ended up using __io_fill_cqe_req() rather than io_fill_cqe_req(). This meant that we dropped overflow handling in those two spots. Reinstate the correct CQE filling helper. Fixes: f66f73421f0a ("io_uring: skip spinlocking for ->task_complete") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 7cffcade57a429667447c4f41d8414bbcf1b3aaa Author: Dawei Li Date: Tue Dec 13 23:46:52 2022 +0800 xen: make remove callback of xen driver void returned Since commit fc7a6209d571 ("bus: Make remove callback return void") forces bus_type::remove be void-returned, it doesn't make much sense for any bus based driver implementing remove callbalk to return non-void to its caller. This change is for xen bus based drivers. Acked-by: Juergen Gross Signed-off-by: Dawei Li Link: https://lore.kernel.org/r/TYCP286MB23238119AB4DF190997075C9CAE39@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM Signed-off-by: Juergen Gross commit a7d82367daa6baa5e8399e6327e7f2f463534505 Author: Vladimir Oltean Date: Wed Dec 14 13:01:20 2022 +0200 net: dsa: mv88e6xxx: avoid reg_lock deadlock in mv88e6xxx_setup_port() In the blamed commit, it was not noticed that one implementation of chip->info->ops->phylink_get_caps(), called by mv88e6xxx_get_caps(), may access hardware registers, and in doing so, it takes the mv88e6xxx_reg_lock(). Namely, this is mv88e6352_phylink_get_caps(). This is a problem because mv88e6xxx_get_caps(), apart from being a top-level function (method invoked by dsa_switch_ops), is now also directly called from mv88e6xxx_setup_port(), which runs under the mv88e6xxx_reg_lock() taken by mv88e6xxx_setup(). Therefore, when running on mv88e6352, the reg_lock would be acquired a second time and the system would deadlock on driver probe. The things that mv88e6xxx_setup() can compete with in terms of register access with are the IRQ handlers and MDIO bus operations registered by mv88e6xxx_probe(). So there is a real need to acquire the register lock. The register lock can, in principle, be dropped and re-acquired pretty much at will within the driver, as long as no operations that involve waiting for indirect access to complete (essentially, callers of mv88e6xxx_smi_direct_wait() and mv88e6xxx_wait_mask()) are interrupted with the lock released. However, I would guess that in mv88e6xxx_setup(), the critical section is kept open for such a long time just in order to optimize away multiple lock/unlock operations on the registers. We could, in principle, drop the reg_lock right before the mv88e6xxx_setup_port() -> mv88e6xxx_get_caps() call, and re-acquire it immediately afterwards. But this would look ugly, because mv88e6xxx_setup_port() would release a lock which it didn't acquire, but the caller did. A cleaner solution to this issue comes from the observation that struct mv88e6xxxx_ops methods generally assume they are called with the reg_lock already acquired. Whereas mv88e6352_phylink_get_caps() is more the exception rather than the norm, in that it acquires the lock itself. Let's enforce the same locking pattern/convention for chip->info->ops->phylink_get_caps() as well, and make mv88e6xxx_get_caps(), the top-level function, acquire the register lock explicitly, for this one implementation that will access registers for port 4 to work properly. This means that mv88e6xxx_setup_port() will no longer call the top-level function, but the low-level mv88e6xxx_ops method which expects the correct calling context (register lock held). Compared to chip->info->ops->phylink_get_caps(), mv88e6xxx_get_caps() also fixes up the supported_interfaces bitmap for internal ports, since that can be done generically and does not require per-switch knowledge. That's code which will no longer execute, however mv88e6xxx_setup_port() doesn't need that. It just needs to look at the mac_capabilities bitmap. Fixes: cc1049ccee20 ("net: dsa: mv88e6xxx: fix speed setting for CPU/DSA ports") Reported-by: Maksim Kiselev Signed-off-by: Vladimir Oltean Tested-by: Maksim Kiselev Link: https://lore.kernel.org/r/20221214110120.3368472-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit c72a7e42592b2e18d862cf120876070947000d7a Author: Biju Das Date: Wed Dec 14 10:51:18 2022 +0000 ravb: Fix "failed to switch device to config mode" message during unbind This patch fixes the error "ravb 11c20000.ethernet eth0: failed to switch device to config mode" during unbind. We are doing register access after pm_runtime_put_sync(). We usually do cleanup in reverse order of init. Currently in remove(), the "pm_runtime_put_sync" is not in reverse order. Probe reset_control_deassert(rstc); pm_runtime_enable(&pdev->dev); pm_runtime_get_sync(&pdev->dev); remove pm_runtime_put_sync(&pdev->dev); unregister_netdev(ndev); .. ravb_mdio_release(priv); pm_runtime_disable(&pdev->dev); Consider the call to unregister_netdev() unregister_netdev->unregister_netdevice_queue->rollback_registered_many that calls the below functions which access the registers after pm_runtime_put_sync() 1) ravb_get_stats 2) ravb_close Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Cc: stable@vger.kernel.org Signed-off-by: Biju Das Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20221214105118.2495313-1-biju.das.jz@bp.renesas.com Signed-off-by: Paolo Abeni commit a12a383e59ce486abd719b6bda33c353a3b385e7 Author: Krzysztof Kozlowski Date: Thu Dec 15 14:43:37 2022 +0100 ASoC: lochnagar: Fix unused lochnagar_of_match warning lochnagar_of_match is used unconditionally, so COMPILE_TEST builds without OF warn: sound/soc/codecs/lochnagar-sc.c:247:34: error: ‘lochnagar_of_match’ defined but not used [-Werror=unused-const-variable=] Reported-by: kernel test robot Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221215134337.77944-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 2cb815cfc78b137ee38bcd65e7c955d6cc2cc250 Author: Gaosheng Cui Date: Wed Dec 14 16:01:17 2022 +0800 net: stmmac: fix errno when create_singlethread_workqueue() fails We should set the return value to -ENOMEM explicitly when create_singlethread_workqueue() fails in stmmac_dvr_probe(), otherwise we'll lose the error value. Fixes: a137f3f27f92 ("net: stmmac: fix possible memory leak in stmmac_dvr_probe()") Signed-off-by: Gaosheng Cui Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20221214080117.3514615-1-cuigaosheng1@huawei.com Signed-off-by: Paolo Abeni commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b Author: Ming Lei Date: Thu Dec 15 10:16:29 2022 +0800 block: fix use-after-free of q->q_usage_counter For blk-mq, queue release handler is usually called after blk_mq_freeze_queue_wait() returns. However, the q_usage_counter->release() handler may not be run yet at that time, so this can cause a use-after-free. Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu(). Since ->release() is called with rcu read lock held, it is agreed that the race should be covered in caller per discussion from the two links. Reported-by: Zhang Wensheng Reported-by: Zhong Jinghua Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/ Cc: Hillf Danton Cc: Yu Kuai Cc: Dennis Zhou Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 1eb206208b0f3f707c67134ef6ba394410effb67 Author: Yuwei Guan Date: Thu Nov 10 19:26:22 2022 +0800 block, bfq: only do counting of pending-request for BFQ_GROUP_IOSCHED The 'bfqd->num_groups_with_pending_reqs' is used when CONFIG_BFQ_GROUP_IOSCHED is enabled, so let the variables and processes take effect when CONFIG_BFQ_GROUP_IOSCHED is enabled. Cc: Yu Kuai Signed-off-by: Yuwei Guan Reviewed-by: Jan Kara Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20221110112622.389332-1-Yuwei.Guan@zeekrlife.com Signed-off-by: Jens Axboe commit cb3543cff90a4448ed560ac86c98033ad5fecda9 Author: Johan Hovold Date: Thu Dec 15 11:46:46 2022 +0100 regulator: core: fix deadlock on regulator enable When updating the operating mode as part of regulator enable, the caller has already locked the regulator tree and drms_uA_update() must not try to do the same in order not to trigger a deadlock. The lock inversion is reported by lockdep as: ====================================================== WARNING: possible circular locking dependency detected 6.1.0-next-20221215 #142 Not tainted ------------------------------------------------------ udevd/154 is trying to acquire lock: ffffc11f123d7e50 (regulator_list_mutex){+.+.}-{3:3}, at: regulator_lock_dependent+0x54/0x280 but task is already holding lock: ffff80000e4c36e8 (regulator_ww_class_acquire){+.+.}-{0:0}, at: regulator_enable+0x34/0x80 which lock already depends on the new lock. ... Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(regulator_ww_class_acquire); lock(regulator_list_mutex); lock(regulator_ww_class_acquire); lock(regulator_list_mutex); *** DEADLOCK *** just before probe of a Qualcomm UFS controller (occasionally) deadlocks when enabling one of its regulators. Fixes: 9243a195be7a ("regulator: core: Change voltage setting path") Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") Cc: stable@vger.kernel.org # 5.0 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20221215104646.19818-1-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 7e43039a49c2da45edc1d9d7c9ede4003ab45a5f Author: Li Zetao Date: Tue Dec 13 20:56:14 2022 +0800 r6040: Fix kmemleak in probe and remove There is a memory leaks reported by kmemleak: unreferenced object 0xffff888116111000 (size 2048): comm "modprobe", pid 817, jiffies 4294759745 (age 76.502s) hex dump (first 32 bytes): 00 c4 0a 04 81 88 ff ff 08 10 11 16 81 88 ff ff ................ 08 10 11 16 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc_trace+0x22/0x60 [] phy_device_create+0x4e/0x90 [] get_phy_device+0xd2/0x220 [] mdiobus_scan+0xa4/0x2e0 [] __mdiobus_register+0x482/0x8b0 [] r6040_init_one+0x714/0xd2c [r6040] ... The problem occurs in probe process as follows: r6040_init_one: mdiobus_register mdiobus_scan <- alloc and register phy_device, the reference count of phy_device is 3 r6040_mii_probe phy_connect <- connect to the first phy_device, so the reference count of the first phy_device is 4, others are 3 register_netdev <- fault inject succeeded, goto error handling path // error handling path err_out_mdio_unregister: mdiobus_unregister(lp->mii_bus); err_out_mdio: mdiobus_free(lp->mii_bus); <- the reference count of the first phy_device is 1, it is not released and other phy_devices are released // similarly, the remove process also has the same problem The root cause is traced to the phy_device is not disconnected when removes one r6040 device in r6040_remove_one() or on error handling path after r6040_mii probed successfully. In r6040_mii_probe(), a net ethernet device is connected to the first PHY device of mii_bus, in order to notify the connected driver when the link status changes, which is the default behavior of the PHY infrastructure to handle everything. Therefore the phy_device should be disconnected when removes one r6040 device or on error handling path. Fix it by adding phy_disconnect() when removes one r6040 device or on error handling path after r6040_mii probed successfully. Fixes: 3831861b4ad8 ("r6040: implement phylib") Signed-off-by: Li Zetao Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20221213125614.927754-1-lizetao1@huawei.com Signed-off-by: Paolo Abeni commit 6b46a06100dd0e0ebe400573e94ccd09163bfd5b Author: Andreas Gruenbacher Date: Fri Dec 9 23:03:59 2022 +0100 gfs2: Remove support for glock holder auto-demotion (2) As a follow-up to the previous commit, move the recovery related code in __gfs2_glock_dq() to gfs2_glock_dq() where it better fits. No functional change. Signed-off-by: Andreas Gruenbacher commit ba3e77a4a22af018d2fe4d745902b2531ca82aba Author: Andreas Gruenbacher Date: Fri Dec 9 22:14:01 2022 +0100 gfs2: Remove support for glock holder auto-demotion Remove the support for glock holder auto-demotion (commit dc732906c245 and folow-ups) as we are not planning to use this feature, and the additional code therefore only adds unnecessary complexity. Signed-off-by: Andreas Gruenbacher commit 3ff8bff704f4de125dca2262e5b5b963a3da1d87 Author: Kirill Tkhai Date: Tue Dec 13 00:05:53 2022 +0300 unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() There is a race resulting in alive SOCK_SEQPACKET socket may change its state from TCP_ESTABLISHED to TCP_CLOSE: unix_release_sock(peer) unix_dgram_sendmsg(sk) sock_orphan(peer) sock_set_flag(peer, SOCK_DEAD) sock_alloc_send_pskb() if !(sk->sk_shutdown & SEND_SHUTDOWN) OK if sock_flag(peer, SOCK_DEAD) sk->sk_state = TCP_CLOSE sk->sk_shutdown = SHUTDOWN_MASK After that socket sk remains almost normal: it is able to connect, listen, accept and recvmsg, while it can't sendmsg. Since this is the only possibility for alive SOCK_SEQPACKET to change the state in such way, we should better fix this strange and potentially danger corner case. Note, that we will return EPIPE here like this is normally done in sock_alloc_send_pskb(). Originally used ECONNREFUSED looks strange, since it's strange to return a specific retval in dependence of race in kernel, when user can't affect on this. Also, move TCP_CLOSE assignment for SOCK_DGRAM sockets under state lock to fix race with unix_dgram_connect(): unix_dgram_connect(other) unix_dgram_sendmsg(sk) unix_peer(sk) = NULL unix_state_unlock(sk) unix_state_double_lock(sk, other) sk->sk_state = TCP_ESTABLISHED unix_peer(sk) = other unix_state_double_unlock(sk, other) sk->sk_state = TCP_CLOSED This patch fixes both of these races. Fixes: 83301b5367a9 ("af_unix: Set TCP_ESTABLISHED for datagram sockets too") Signed-off-by: Kirill Tkhai Link: https://lore.kernel.org/r/135fda25-22d5-837a-782b-ceee50e19844@ya.ru Signed-off-by: Paolo Abeni commit f506439ec3dee11e0e77b0a1f3fb3eec22c97873 Author: Toke Høiland-Jørgensen Date: Thu Dec 15 00:02:54 2022 +0100 selftests/bpf: Add a test for using a cpumap from an freplace-to-XDP program This adds a simple test for inserting an XDP program into a cpumap that is "owned" by an XDP program that was loaded as PROG_TYPE_EXT (as libxdp does). Prior to the kernel fix this would fail because the map type ownership would be set to PROG_TYPE_EXT instead of being resolved to PROG_TYPE_XDP. v5: - Fix a few nits from Andrii, add his ACK v4: - Use skeletons for selftest v3: - Update comment to better explain the cause - Add Yonghong's ACK Acked-by: Yonghong Song Acked-by: Andrii Nakryiko Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221214230254.790066-2-toke@redhat.com Signed-off-by: Martin KaFai Lau commit 1c123c567fb138ebd187480b7fc0610fcb0851f5 Author: Toke Høiland-Jørgensen Date: Thu Dec 15 00:02:53 2022 +0100 bpf: Resolve fext program type when checking map compatibility The bpf_prog_map_compatible() check makes sure that BPF program types are not mixed inside BPF map types that can contain programs (tail call maps, cpumaps and devmaps). It does this by setting the fields of the map->owner struct to the values of the first program being checked against, and rejecting any subsequent programs if the values don't match. One of the values being set in the map owner struct is the program type, and since the code did not resolve the prog type for fext programs, the map owner type would be set to PROG_TYPE_EXT and subsequent loading of programs of the target type into the map would fail. This bug is seen in particular for XDP programs that are loaded as PROG_TYPE_EXT using libxdp; these cannot insert programs into devmaps and cpumaps because the check fails as described above. Fix the bug by resolving the fext program type to its target program type as elsewhere in the verifier. v3: - Add Yonghong's ACK Fixes: f45d5b6ce2e8 ("bpf: generalise tail call map compatibility check") Acked-by: Yonghong Song Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20221214230254.790066-1-toke@redhat.com Signed-off-by: Martin KaFai Lau commit 9f28157778ede0d4f183f7ab3b46995bb400abbe Author: Minsuk Kang Date: Wed Dec 14 10:51:39 2022 +0900 nfc: pn533: Clear nfc_target before being used Fix a slab-out-of-bounds read that occurs in nla_put() called from nfc_genl_send_target() when target->sensb_res_len, which is duplicated from an nfc_target in pn533, is too large as the nfc_target is not properly initialized and retains garbage values. Clear nfc_targets with memset() before they are used. Found by a modified version of syzkaller. BUG: KASAN: slab-out-of-bounds in nla_put Call Trace: memcpy nla_put nfc_genl_dump_targets genl_lock_dumpit netlink_dump __netlink_dump_start genl_family_rcv_msg_dumpit genl_rcv_msg netlink_rcv_skb genl_rcv netlink_unicast netlink_sendmsg sock_sendmsg ____sys_sendmsg ___sys_sendmsg __sys_sendmsg do_syscall_64 Fixes: 673088fb42d0 ("NFC: pn533: Send ATR_REQ directly for active device detection") Fixes: 361f3cb7f9cf ("NFC: DEP link hook implementation for pn533") Signed-off-by: Minsuk Kang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221214015139.119673-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Jakub Kicinski commit 628050ec952d2e2e46ec9fb6aa07e41139e030c8 Author: Vladimir Oltean Date: Tue Dec 13 02:19:08 2022 +0200 net: enetc: avoid buffer leaks on xdp_do_redirect() failure Before enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software BD in the RX ring between index orig_i and i can have one of 2 refcount values on its page. We are the owner of the current buffer that is being processed, so the refcount will be at least 1. If the current owner of the buffer at the diametrically opposed index in the RX ring (i.o.w, the other half of this page) has not yet called kfree(), this page's refcount could even be 2. enetc_page_reusable() in enetc_flip_rx_buff() tests for the page refcount against 1, and [ if it's 2 ] does not attempt to reuse it. But if enetc_flip_rx_buff() is put after the xdp_do_redirect() call, the page refcount can have one of 3 values. It can also be 0, if there is no owner of the other page half, and xdp_do_redirect() for this buffer ran so far that it triggered a flush of the devmap/cpumap bulk queue, and the consumers of those bulk queues also freed the buffer, all by the time xdp_do_redirect() returns the execution back to enetc. This is the reason why enetc_flip_rx_buff() is called before xdp_do_redirect(), but there is a big flaw with that reasoning: enetc_flip_rx_buff() will set rx_swbd->page = NULL on both sides of the enetc_page_reusable() branch, and if xdp_do_redirect() returns an error, we call enetc_xdp_free(), which does not deal gracefully with that. In fact, what happens is quite special. The page refcounts start as 1. enetc_flip_rx_buff() figures they're reusable, transfers these rx_swbd->page pointers to a different rx_swbd in enetc_reuse_page(), and bumps the refcount to 2. When xdp_do_redirect() later returns an error, we call the no-op enetc_xdp_free(), but we still haven't lost the reference to that page. A copy of it is still at rx_ring->next_to_alloc, but that has refcount 2 (and there are no concurrent owners of it in flight, to drop the refcount). What really kills the system is when we'll flip the rx_swbd->page the second time around. With an updated refcount of 2, the page will not be reusable and we'll really leak it. Then enetc_new_page() will have to allocate more pages, which will then eventually leak again on further errors from xdp_do_redirect(). The problem, summarized, is that we zeroize rx_swbd->page before we're completely done with it, and this makes it impossible for the error path to do something with it. Since the packet is potentially multi-buffer and therefore the rx_swbd->page is potentially an array, manual passing of the old pointers between enetc_flip_rx_buff() and enetc_xdp_free() is a bit difficult. For the sake of going with a simple solution, we accept the possibility of racing with xdp_do_redirect(), and we move the flip procedure to execute only on the redirect success path. By racing, I mean that the page may be deemed as not reusable by enetc (having a refcount of 0), but there will be no leak in that case, either. Once we accept that, we have something better to do with buffers on XDP_REDIRECT failure. Since we haven't performed half-page flipping yet, we won't, either (and this way, we can avoid enetc_xdp_free() completely, which gives the entire page to the slab allocator). Instead, we'll call enetc_xdp_drop(), which will recycle this half of the buffer back to the RX ring. Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") Suggested-by: Lorenzo Bianconi Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20221213001908.2347046-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721 Author: John Stultz Date: Wed Dec 14 23:18:34 2022 +0000 pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion Wei Wang reported seeing priority inversion caused latencies caused by contention on pmsg_lock, and suggested it be switched to a rt_mutex. I was initially hesitant this would help, as the tasks in that trace all seemed to be SCHED_NORMAL, so the benefit would be limited to only nice boosting. However, another similar issue was raised where the priority inversion was seen did involve a blocked RT task so it is clear this would be helpful in that case. Cc: Wei Wang Cc: Midas Chien Cc: Connor O'Brien Cc: Kees Cook Cc: Anton Vorontsov Cc: Colin Cross Cc: Tony Luck Cc: kernel-team@android.com Fixes: 9d5438f462ab ("pstore: Add pmsg - user-space accessible pstore object") Reported-by: Wei Wang Signed-off-by: John Stultz Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221214231834.3711880-1-jstultz@google.com commit d6a9fb87e9d18f3394a9845546bbe868efdccfd2 Author: Nathan Chancellor Date: Wed Dec 14 16:26:03 2022 -0700 security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 A bad bug in clang's implementation of -fzero-call-used-regs can result in NULL pointer dereferences (see the links above the check for more information). Restrict CONFIG_CC_HAS_ZERO_CALL_USED_REGS to either a supported GCC version or a clang newer than 15.0.6, which will catch both a theoretical 15.0.7 and the upcoming 16.0.0, which will both have the bug fixed. Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Nathan Chancellor Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221214232602.4118147-1-nathan@kernel.org commit f68022ae0aeb0803450e05abc0e984027c33ef1b Author: Kristina Martsenko Date: Fri Dec 9 17:34:41 2022 +0000 lkdtm: cfi: Make PAC test work with GCC 7 and 8 The CFI test uses the branch-protection=none compiler attribute to disable PAC return address protection on a function. While newer GCC versions support this attribute, older versions (GCC 7 and 8) instead supported the sign-return-address=none attribute, leading to a build failure when the test is built with older compilers. Fix it by checking which attribute is supported and using the correct one. Fixes: 2e53b877dc12 ("lkdtm: Add CFI_BACKWARD to test ROP mitigations") Reported-by: Daniel Díaz Signed-off-by: Kristina Martsenko Signed-off-by: Kees Cook Link: https://lore.kernel.org/all/CAEUSe78kDPxQmQqCWW-_9LCgJDFhAeMoVBFnX9QLx18Z4uT4VQ@mail.gmail.com/ commit d4505aa6afae17a20c2f3ccfbfb7a07881b7ae02 Author: Masami Hiramatsu (Google) Date: Mon Nov 14 13:47:56 2022 +0900 tracing/probes: Reject symbol/symstr type for uprobe Since uprobe's argument must contain the user-space data, that should not be converted to kernel symbols. Reject if user specifies these types on uprobe events. e.g. /sys/kernel/debug/tracing # echo 'p /bin/sh:10 %ax:symbol' >> uprobe_events sh: write error: Invalid argument /sys/kernel/debug/tracing # echo 'p /bin/sh:10 %ax:symstr' >> uprobe_events sh: write error: Invalid argument /sys/kernel/debug/tracing # cat error_log [ 1783.134883] trace_uprobe: error: Unknown type is specified Command: p /bin/sh:10 %ax:symbol ^ [ 1792.201120] trace_uprobe: error: Unknown type is specified Command: p /bin/sh:10 %ax:symstr ^ Link: https://lore.kernel.org/all/166679931679.1528100.15540755370726009882.stgit@devnote3/ Signed-off-by: Masami Hiramatsu (Google) commit b26a124cbfa80f42bfc4e63e1d5643ca98159d66 Author: Masami Hiramatsu (Google) Date: Mon Nov 14 13:47:56 2022 +0900 tracing/probes: Add symstr type for dynamic events Add 'symstr' type for storing the kernel symbol as a string data instead of the symbol address. This allows us to filter the events by wildcard symbol name. e.g. # echo 'e:wqfunc workqueue.workqueue_execute_start symname=$function:symstr' >> dynamic_events # cat events/eprobes/wqfunc/format name: wqfunc ID: 2110 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:__data_loc char[] symname; offset:8; size:4; signed:1; print fmt: " symname=\"%s\"", __get_str(symname) Note that there is already 'symbol' type which just change the print format (so it still stores the symbol address in the tracing ring buffer.) On the other hand, 'symstr' type stores the actual "symbol+offset/size" data as a string. Link: https://lore.kernel.org/all/166679930847.1528100.4124308529180235965.stgit@devnote3/ Signed-off-by: Masami Hiramatsu (Google) commit 3b7ddab8a19aefc768f345fd3782af35b4a68d9b Author: wuqiang Date: Thu Nov 10 16:15:02 2022 +0800 kprobes: kretprobe events missing on 2-core KVM guest Default value of maxactive is set as num_possible_cpus() for nonpreemptable systems. For a 2-core system, only 2 kretprobe instances would be allocated in default, then these 2 instances for execve kretprobe are very likely to be used up with a pipelined command. Here's the testcase: a shell script was added to crontab, and the content of the script is: #!/bin/sh do_something_magic `tr -dc a-z < /dev/urandom | head -c 10` cron will trigger a series of program executions (4 times every hour). Then events loss would be noticed normally after 3-4 hours of testings. The issue is caused by a burst of series of execve requests. The best number of kretprobe instances could be different case by case, and should be user's duty to determine, but num_possible_cpus() as the default value is inadequate especially for systems with small number of cpus. This patch enables the logic for preemption as default, thus increases the minimum of maxactive to 10 for nonpreemptable systems. Link: https://lore.kernel.org/all/20221110081502.492289-1-wuqiang.matt@bytedance.com/ Signed-off-by: wuqiang Reviewed-by: Solar Designer Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 041fae9c105ae342a4245cf1e0dc56a23fbb9d3c Merge: eb67d239f3aa1 26a8057a1ada9 Author: Linus Torvalds Date: Wed Dec 14 15:27:57 2022 -0800 Merge tag 'f2fs-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've added two features: F2FS_IOC_START_ATOMIC_REPLACE and a per-block age-based extent cache. F2FS_IOC_START_ATOMIC_REPLACE is a variant of the previous atomic write feature which guarantees a per-file atomicity. It would be more efficient than AtomicFile implementation in Android framework. The per-block age-based extent cache implements another type of extent cache in memory which keeps the per-block age in a file, so that block allocator could split the hot and cold data blocks more accurately. Enhancements: - introduce F2FS_IOC_START_ATOMIC_REPLACE - refactor extent_cache to add a new per-block-age-based extent cache support - introduce discard_urgent_util, gc_mode, max_ordered_discard sysfs knobs - add proc entry to show discard_plist info - optimize iteration over sparse directories - add barrier mount option Bug fixes: - avoid victim selection from previous victim section - fix to enable compress for newly created file if extension matches - set zstd compress level correctly - initialize locks early in f2fs_fill_super() to fix bugs reported by syzbot - correct i_size change for atomic writes - allow to read node block after shutdown - allow to set compression for inlined file - fix gc mode when gc_urgent_high_remaining is 1 - should put a page when checking the summary info Minor fixes and various clean-ups in GC, discard, debugfs, sysfs, and doc" * tag 'f2fs-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (63 commits) f2fs: reset wait_ms to default if any of the victims have been selected f2fs: fix some format WARNING in debug.c and sysfs.c f2fs: don't call f2fs_issue_discard_timeout() when discard_cmd_cnt is 0 in f2fs_put_super() f2fs: fix iostat parameter for discard f2fs: Fix spelling mistake in label: free_bio_enrty_cache -> free_bio_entry_cache f2fs: add block_age-based extent cache f2fs: allocate the extent_cache by default f2fs: refactor extent_cache to support for read and more f2fs: remove unnecessary __init_extent_tree f2fs: move internal functions into extent_cache.c f2fs: specify extent cache for read explicitly f2fs: introduce f2fs_is_readonly() for readability f2fs: remove F2FS_SET_FEATURE() and F2FS_CLEAR_FEATURE() macro f2fs: do some cleanup for f2fs module init MAINTAINERS: Add f2fs bug tracker link f2fs: remove the unused flush argument to change_curseg f2fs: open code allocate_segment_by_default f2fs: remove struct segment_allocation default_salloc_ops f2fs: introduce discard_urgent_util sysfs node f2fs: define MIN_DISCARD_GRANULARITY macro ... commit eb67d239f3aa1711afb0a42eab50459d9f3d672e Merge: 94a855111ed91 6e66e96e31b81 Author: Linus Torvalds Date: Wed Dec 14 15:23:49 2022 -0800 Merge tag 'riscv-for-linus-6.2-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for the T-Head PMU via the perf subsystem - ftrace support for rv32 - Support for non-volatile memory devices - Various fixes and cleanups * tag 'riscv-for-linus-6.2-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (52 commits) Documentation: RISC-V: patch-acceptance: s/implementor/implementer Documentation: RISC-V: Mention the UEFI Standards Documentation: RISC-V: Allow patches for non-standard behavior Documentation: RISC-V: Fix a typo in patch-acceptance riscv: Fixup compile error with !MMU riscv: Fix P4D_SHIFT definition for 3-level page table mode riscv: Apply a static assert to riscv_isa_ext_id RISC-V: Add some comments about the shadow and overflow stacks RISC-V: Align the shadow stack RISC-V: Ensure Zicbom has a valid block size RISC-V: Introduce riscv_isa_extension_check RISC-V: Improve use of isa2hwcap[] riscv: Don't duplicate _ALTERNATIVE_CFG* macros riscv: alternatives: Drop the underscores from the assembly macro names riscv: alternatives: Don't name unused macro parameters riscv: Don't duplicate __ALTERNATIVE_CFG in __ALTERNATIVE_CFG_2 riscv: mm: call best_map_size many times during linear-mapping riscv: Move cast inside kernel_mapping_[pv]a_to_[vp]a riscv: Fix crash during early errata patching riscv: boot: add zstd support ... commit 94a855111ed9106971ca2617c5d075269e6aefde Merge: 93761c93e9da2 f1a033cc6b9eb Author: Linus Torvalds Date: Wed Dec 14 15:03:00 2022 -0800 Merge tag 'x86_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 core updates from Borislav Petkov: - Add the call depth tracking mitigation for Retbleed which has been long in the making. It is a lighterweight software-only fix for Skylake-based cores where enabling IBRS is a big hammer and causes a significant performance impact. What it basically does is, it aligns all kernel functions to 16 bytes boundary and adds a 16-byte padding before the function, objtool collects all functions' locations and when the mitigation gets applied, it patches a call accounting thunk which is used to track the call depth of the stack at any time. When that call depth reaches a magical, microarchitecture-specific value for the Return Stack Buffer, the code stuffs that RSB and avoids its underflow which could otherwise lead to the Intel variant of Retbleed. This software-only solution brings a lot of the lost performance back, as benchmarks suggest: https://lore.kernel.org/all/20220915111039.092790446@infradead.org/ That page above also contains a lot more detailed explanation of the whole mechanism - Implement a new control flow integrity scheme called FineIBT which is based on the software kCFI implementation and uses hardware IBT support where present to annotate and track indirect branches using a hash to validate them - Other misc fixes and cleanups * tag 'x86_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (80 commits) x86/paravirt: Use common macro for creating simple asm paravirt functions x86/paravirt: Remove clobber bitmask from .parainstructions x86/debug: Include percpu.h in debugreg.h to get DECLARE_PER_CPU() et al x86/cpufeatures: Move X86_FEATURE_CALL_DEPTH from bit 18 to bit 19 of word 11, to leave space for WIP X86_FEATURE_SGX_EDECCSSA bit x86/Kconfig: Enable kernel IBT by default x86,pm: Force out-of-line memcpy() objtool: Fix weak hole vs prefix symbol objtool: Optimize elf_dirty_reloc_sym() x86/cfi: Add boot time hash randomization x86/cfi: Boot time selection of CFI scheme x86/ibt: Implement FineIBT objtool: Add --cfi to generate the .cfi_sites section x86: Add prefix symbols for function padding objtool: Add option to generate prefix symbols objtool: Avoid O(bloody terrible) behaviour -- an ode to libelf objtool: Slice up elf_create_section_symbol() kallsyms: Revert "Take callthunks into account" x86: Unconfuse CONFIG_ and X86_FEATURE_ namespaces x86/retpoline: Fix crash printing warning x86/paravirt: Fix a !PARAVIRT build warning ... commit 00dd027f721e0458418f7750d8a5a664ed3e5994 Author: Kees Cook Date: Wed Dec 14 14:35:47 2022 -0800 docs: Fix path paste-o for /sys/kernel/warn_count Running "make htmldocs" shows that "/sys/kernel/oops_count" was duplicated. This should have been "warn_count": Warning: /sys/kernel/oops_count is defined 2 times: ./Documentation/ABI/testing/sysfs-kernel-warn_count:0 ./Documentation/ABI/testing/sysfs-kernel-oops_count:0 Fix the typo. Reported-by: kernel test robot Link: https://lore.kernel.org/linux-doc/202212110529.A3Qav8aR-lkp@intel.com Fixes: 8b05aa263361 ("panic: Expose "warn_count" to sysfs") Cc: linux-hardening@vger.kernel.org Signed-off-by: Kees Cook commit 1a17e5b513ceebf21100027745b8731b4728edf7 Author: Kees Cook Date: Fri Dec 9 11:54:57 2022 -0800 LoadPin: Ignore the "contents" argument of the LSM hooks LoadPin only enforces the read-only origin of kernel file reads. Whether or not it was a partial read isn't important. Remove the overly conservative checks so that things like partial firmware reads will succeed (i.e. reading a firmware header). Fixes: 2039bda1fa8d ("LSM: Add "contents" flag to kernel_read_file hook") Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.org Signed-off-by: Kees Cook Acked-by: Serge Hallyn Tested-by: Ping-Ke Shih Link: https://lore.kernel.org/r/20221209195453.never.494-kees@kernel.org commit 47722220660cfb935e27e62d385959ecc296cddb Author: Christian König Date: Mon Dec 12 17:31:57 2022 +0100 drm/amdgpu: revert "generally allow over-commit during BO allocation" This reverts commit f9d00a4a8dc8fff951c97b3213f90d6bc7a72175. This causes problem for KFD because when we overcommit we accidentially bind the BO to GTT for moving it into VRAM. We also need to make sure that this is done only as fallback after trying to evict first. Signed-off-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 3273f11675ef11959d25a56df3279f712bcd41b7 Author: Luben Tuikov Date: Wed Dec 14 03:56:03 2022 -0500 drm/amdgpu: Remove unnecessary domain argument Remove the "domain" argument to amdgpu_bo_create_kernel_at() since this function takes an "offset" argument which is the offset off of VRAM, and as such allocation always takes place in VRAM. Thus, the "domain" argument is unnecessary. Cc: Alex Deucher Cc: Christian König Cc: AMD Graphics Signed-off-by: Luben Tuikov Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 7554886daa31eacc8e7fac9e15bbce67d10b8f1f Author: Luben Tuikov Date: Sat Dec 10 02:51:19 2022 -0500 drm/amdgpu: Fix size validation for non-exclusive domains (v4) Fix amdgpu_bo_validate_size() to check whether the TTM domain manager for the requested memory exists, else we get a kernel oops when dereferencing "man". v2: Make the patch standalone, i.e. not dependent on local patches. v3: Preserve old behaviour and just check that the manager pointer is not NULL. v4: Complain if GTT domain requested and it is uninitialized--most likely a bug. Cc: Alex Deucher Cc: Christian König Cc: AMD Graphics Signed-off-by: Luben Tuikov Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 28afcb0ad54c858d0f426b340e88e0277a375597 Author: Luben Tuikov Date: Mon Dec 12 12:04:42 2022 -0500 drm/amdgpu: Check if fru_addr is not NULL (v2) Always check if fru_addr is not NULL. This commit also fixes a "smatch" warning. v2: Add a Fixes tag. Cc: Alex Deucher Cc: Dan Carpenter Cc: kernel test robot Cc: AMD Graphics Fixes: afbe5d1e4bd7c7 ("drm/amdgpu: Bug-fix: Reading I2C FRU data on newer ASICs") Signed-off-by: Luben Tuikov Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 93761c93e9da28d8a020777cee2a84133082b477 Merge: 64e7003c6b856 4295c60bbe9e6 Author: Linus Torvalds Date: Wed Dec 14 13:42:09 2022 -0800 Merge tag 'apparmor-pr-2022-12-14' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "Features: - switch to zstd compression for profile raw data Cleanups: - simplify obtaining the newest label on a cred - remove useless static inline functions - compute permission conversion on policy unpack - refactor code to share common permissins - refactor unpack to group policy backwards compatiblity code - add __init annotation to aa_{setup/teardown}_dfa_engine() Bug Fixes: - fix a memleak in - multi_transaction_new() - free_ruleset() - unpack_profile() - alloc_ns() - fix lockdep warning when removing a namespace - fix regression in stacking due to label flags - fix loading of child before parent - fix kernel-doc comments that differ from fns - fix spelling errors in comments - store return value of unpack_perms_table() to signed variable" * tag 'apparmor-pr-2022-12-14' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (64 commits) apparmor: Fix uninitialized symbol 'array_size' in policy_unpack_test.c apparmor: Add __init annotation to aa_{setup/teardown}_dfa_engine() apparmor: Fix memleak in alloc_ns() apparmor: Fix memleak issue in unpack_profile() apparmor: fix a memleak in free_ruleset() apparmor: Fix spelling of function name in comment block apparmor: Use pointer to struct aa_label for lbs_cred AppArmor: Fix kernel-doc LSM: Fix kernel-doc AppArmor: Fix kernel-doc apparmor: Fix loading of child before parent apparmor: refactor code that alloc null profiles apparmor: fix obsoleted comments for aa_getprocattr() and audit_resource() apparmor: remove useless static inline functions apparmor: Fix unpack_profile() warn: passing zero to 'ERR_PTR' apparmor: fix uninitialize table variable in error in unpack_trans_table apparmor: store return value of unpack_perms_table() to signed variable apparmor: Fix kunit test for out of bounds array apparmor: Fix decompression of rawdata for read back to userspace apparmor: Fix undefined references to zstd_ symbols ... commit 64e7003c6b85626a533a67c1ba938b75a3db24e6 Merge: 48ea09cddae0b 453de3eb08c4b Author: Linus Torvalds Date: Wed Dec 14 12:31:09 2022 -0800 Merge tag 'v6.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Optimise away self-test overhead when they are disabled - Support symmetric encryption via keyring keys in af_alg - Flip hwrng default_quality, the default is now maximum entropy Algorithms: - Add library version of aesgcm - CFI fixes for assembly code - Add arm/arm64 accelerated versions of sm3/sm4 Drivers: - Remove assumption on arm64 that kmalloc is DMA-aligned - Fix selftest failures in rockchip - Add support for RK3328/RK3399 in rockchip - Add deflate support in qat - Merge ux500 into stm32 - Add support for TEE for PCI ID 0x14CA in ccp - Add mt7986 support in mtk - Add MaxLinear platform support in inside-secure - Add NPCM8XX support in npcm" * tag 'v6.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (184 commits) crypto: ux500/cryp - delete driver crypto: stm32/cryp - enable for use with Ux500 crypto: stm32 - enable drivers to be used on Ux500 dt-bindings: crypto: Let STM32 define Ux500 CRYP hwrng: geode - Fix PCI device refcount leak hwrng: amd - Fix PCI device refcount leak crypto: qce - Set DMA alignment explicitly crypto: octeontx2 - Set DMA alignment explicitly crypto: octeontx - Set DMA alignment explicitly crypto: keembay - Set DMA alignment explicitly crypto: safexcel - Set DMA alignment explicitly crypto: hisilicon/hpre - Set DMA alignment explicitly crypto: chelsio - Set DMA alignment explicitly crypto: ccree - Set DMA alignment explicitly crypto: ccp - Set DMA alignment explicitly crypto: cavium - Set DMA alignment explicitly crypto: img-hash - Fix variable dereferenced before check 'hdev->req' crypto: arm64/ghash-ce - use frame_push/pop macros consistently crypto: arm64/crct10dif - use frame_push/pop macros consistently crypto: arm64/aes-modes - use frame_push/pop macros consistently ... commit 48ea09cddae0b794cde2070f106ef676703dbcd3 Merge: ad76bf1ff18e0 d272e01fa0a2f Author: Linus Torvalds Date: Wed Dec 14 12:20:00 2022 -0800 Merge tag 'hardening-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening updates from Kees Cook: - Convert flexible array members, fix -Wstringop-overflow warnings, and fix KCFI function type mismatches that went ignored by maintainers (Gustavo A. R. Silva, Nathan Chancellor, Kees Cook) - Remove the remaining side-effect users of ksize() by converting dma-buf, btrfs, and coredump to using kmalloc_size_roundup(), add more __alloc_size attributes, and introduce full testing of all allocator functions. Finally remove the ksize() side-effect so that each allocation-aware checker can finally behave without exceptions - Introduce oops_limit (default 10,000) and warn_limit (default off) to provide greater granularity of control for panic_on_oops and panic_on_warn (Jann Horn, Kees Cook) - Introduce overflows_type() and castable_to_type() helpers for cleaner overflow checking - Improve code generation for strscpy() and update str*() kern-doc - Convert strscpy and sigphash tests to KUnit, and expand memcpy tests - Always use a non-NULL argument for prepare_kernel_cred() - Disable structleak plugin in FORTIFY KUnit test (Anders Roxell) - Adjust orphan linker section checking to respect CONFIG_WERROR (Xin Li) - Make sure siginfo is cleared for forced SIGKILL (haifeng.xu) - Fix um vs FORTIFY warnings for always-NULL arguments * tag 'hardening-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (31 commits) ksmbd: replace one-element arrays with flexible-array members hpet: Replace one-element array with flexible-array member um: virt-pci: Avoid GCC non-NULL warning signal: Initialize the info in ksignal lib: fortify_kunit: build without structleak plugin panic: Expose "warn_count" to sysfs panic: Introduce warn_limit panic: Consolidate open-coded panic_on_warn checks exit: Allow oops_limit to be disabled exit: Expose "oops_count" to sysfs exit: Put an upper limit on how often we can oops panic: Separate sysctl logic from CONFIG_SMP mm/pgtable: Fix multiple -Wstringop-overflow warnings mm: Make ksize() a reporting-only function kunit/fortify: Validate __alloc_size attribute results drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() driver core: Add __alloc_size hint to devm allocators overflow: Introduce overflows_type() and castable_to_type() coredump: Proactively round up to kmalloc bucket size ... commit ad76bf1ff18e059d64b70047940d298641d4cc2f Merge: 6f1f5caed5bfa 80c2fe022ef5d Author: Linus Torvalds Date: Wed Dec 14 12:17:57 2022 -0800 Merge tag 'memblock-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: "Extend test coverage: - add tests that trigger reallocation of memblock structures from memblock itself via memblock_double_array() - add tests for memblock_alloc_exact_nid_raw() that verify that requested node and memory range constraints are respected" * tag 'memblock-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock tests: remove completed TODO item memblock tests: add generic NUMA tests for memblock_alloc_exact_nid_raw memblock tests: add bottom-up NUMA tests for memblock_alloc_exact_nid_raw memblock tests: add top-down NUMA tests for memblock_alloc_exact_nid_raw memblock tests: introduce range tests for memblock_alloc_exact_nid_raw memblock test: Update TODO list memblock test: Add test to memblock_reserve() 129th region memblock test: Add test to memblock_add() 129th region commit 4121d4481b72501aa4d22680be4ea1096d69d133 Author: Jiri Olsa Date: Wed Dec 14 13:35:42 2022 +0100 bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func Hao Sun reported crash in dispatcher image [1]. Currently we don't have any sync between bpf_dispatcher_update and bpf_dispatcher_xdp_func, so following race is possible: cpu 0: cpu 1: bpf_prog_run_xdp ... bpf_dispatcher_xdp_func in image at offset 0x0 bpf_dispatcher_update update image at offset 0x800 bpf_dispatcher_update update image at offset 0x0 in image at offset 0x0 -> crash Fixing this by synchronizing dispatcher image update (which is done in bpf_dispatcher_update function) with bpf_dispatcher_xdp_func that reads and execute the dispatcher image. Calling synchronize_rcu after updating and installing new image ensures that readers leave old image before it's changed in the next dispatcher update. The update itself is locked with dispatcher's mutex. The bpf_prog_run_xdp is called under local_bh_disable and synchronize_rcu will wait for it to leave [2]. [1] https://lore.kernel.org/bpf/Y5SFho7ZYXr9ifRn@krava/T/#m00c29ece654bc9f332a17df493bbca33e702896c [2] https://lore.kernel.org/bpf/0B62D35A-E695-4B7A-A0D4-774767544C1A@gmail.com/T/#mff43e2c003ae99f4a38f353c7969be4c7162e877 Reported-by: Hao Sun Signed-off-by: Jiri Olsa Acked-by: Yonghong Song Acked-by: Paul E. McKenney Link: https://lore.kernel.org/r/20221214123542.1389719-1-jolsa@kernel.org Signed-off-by: Martin KaFai Lau commit 813e693023ba10da9e75067780f8378465bf27cc Author: Tejun Heo Date: Sat Dec 10 08:33:10 2022 -1000 blk-iolatency: Fix memory leak on add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable to lazy-init rq_qos policies because they are optional features and add to hot path overhead once initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit() become noop's. Signed-off-by: Tejun Heo Reported-by: darklight2357@icloud.com Cc: Josef Bacik Cc: Linus Torvalds Fixes: d70675121546 ("block: introduce blk-iolatency io controller") Cc: stable@vger.kernel.org # v4.19+ Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/Y5TQ5gm3O4HXrXR3@slm.duckdns.org Signed-off-by: Jens Axboe commit 6f1f5caed5bfadd1cc8bdb0563eb8874dc3573ca Merge: cfb3162495fe5 31720a2b109b3 Author: Linus Torvalds Date: Wed Dec 14 11:16:33 2022 -0800 Merge tag 'for-linus-6.2-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: - fix problems with memory leaks on exit in sysfs and debufs (Zhang) - remove an unused variable and an unneeded assignment (Colin) * tag 'for-linus-6.2-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() orangefs: Fix kmemleak in orangefs_sysfs_init() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix sysfs not cleanup when dev init failed orangefs: remove redundant assignment to variable buffer_index orangefs: remove variable i commit 3c3bfb8586f848317ceba5d777e11204ba3e5758 Author: Tetsuo Handa Date: Tue Dec 6 07:10:31 2022 +0900 fbdev: fbcon: release buffer when fbcon_do_set_font() failed syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") missed that the buffer might be newly allocated by fbcon_set_font(). Link: https://syzkaller.appspot.com/bug?extid=25bdb7b1703639abd498 [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Tested-by: syzbot Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Helge Deller commit b20a558d377c73ed1eb1247046a5e16fe41da173 Author: ye xingchen Date: Mon Dec 5 16:31:39 2022 +0800 fbdev: sh_mobile_lcdcfb: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Signed-off-by: Helge Deller commit 522d5226eed96a7df6662857500777a74d60d341 Author: ye xingchen Date: Mon Dec 5 16:31:39 2022 +0800 fbdev: uvesafb: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Signed-off-by: Helge Deller commit f2ff0c430fed8c6a6d64d11a41f0582bf8bba6f7 Author: Christophe JAILLET Date: Sat Dec 10 12:35:23 2022 +0100 fbdev: uvesafb: Simplify uvesafb_remove() When the remove() function is called, we know that the probe() function has successfully been executed. So 'info' is known to be not NULL. Simplify the code accordingly. Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit a94371040712031ba129c7e9d8ff04a06a2f8207 Author: Christophe JAILLET Date: Sat Dec 10 12:35:22 2022 +0100 fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() If an error occurs after a successful uvesafb_init_mtrr() call, it must be undone by a corresponding arch_phys_wc_del() call, as already done in the remove function. This has been added in the remove function in commit 63e28a7a5ffc ("uvesafb: Clean up MTRR code") Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit 35b4f4d4a725cf8f8c10649163cd12aed509b953 Author: Randy Dunlap Date: Wed Nov 30 13:55:59 2022 -0800 fbdev: uvesafb: don't build on UML The uvesafb fbdev driver uses memory management information that is not available on ARCH=um, so don't allow this driver to be built on UML. Prevents these build errors: ../drivers/video/fbdev/uvesafb.c: In function ‘uvesafb_vbe_init’: ../drivers/video/fbdev/uvesafb.c:807:21: error: ‘__supported_pte_mask’ undeclared (first use in this function) 807 | if (__supported_pte_mask & _PAGE_NX) { ../drivers/video/fbdev/uvesafb.c:807:44: error: ‘_PAGE_NX’ undeclared (first use in this function) 807 | if (__supported_pte_mask & _PAGE_NX) { Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap Cc: Johannes Berg Cc: Richard Weinberger Cc: linux-um@lists.infradead.org Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: Michal Januszewski Signed-off-by: Helge Deller commit 71c53e19226b0166ba387d3c590d0509f541a0a1 Author: Randy Dunlap Date: Wed Nov 30 13:55:44 2022 -0800 fbdev: geode: don't build on UML The geode fbdev driver uses struct cpuinfo fields that are not present on ARCH=um, so don't allow this driver to be built on UML. Prevents these build errors: In file included from ../arch/x86/include/asm/olpc.h:7:0, from ../drivers/mfd/cs5535-mfd.c:17: ../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: ../arch/x86/include/asm/geode.h:16:24: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:16:39: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:17:17: error: ‘struct cpuinfo_um’ has no member named ‘x86’ (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:18:17: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ (boot_cpu_data.x86_model == 5)); ../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: ../arch/x86/include/asm/geode.h:23:24: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:23:39: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:24:17: error: ‘struct cpuinfo_um’ has no member named ‘x86’ (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:25:17: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ (boot_cpu_data.x86_model == 10)); Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap Cc: Johannes Berg Cc: Richard Weinberger Cc: linux-um@lists.infradead.org Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: Andres Salomon Cc: linux-geode@lists.infradead.org Signed-off-by: Helge Deller commit c84bf485a5aaf9aa0764a58832b7ef4375c29f03 Author: Gaosheng Cui Date: Wed Nov 23 17:29:43 2022 +0800 fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() The clk_disable_unprepare() should be called in the error handling of register_framebuffer(), fix it. Fixes: 0937a7b3625d ("video: ep93xx: Prepare clock before using it") Signed-off-by: Gaosheng Cui Signed-off-by: Helge Deller commit 3074742317e3b95dcd1faf248ad2b5c2d9d7a558 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:28 2022 +0100 fbdev: matroxfb: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit cd53860edd5e66f2faaf1bfbaef81d4be9109c82 Author: Dongliang Mu Date: Fri Nov 18 22:14:06 2022 +0800 fbdev: da8xx-fb: add missing regulator_disable() in fb_probe The error handling code in fb_probe misses regulator_disable if regulator_enable is called successfully. The previous commit only adds regulator_disable in the .remove(), forgetting the error handling code in the .probe. Fix this by adding a new error label to call regulator_disable. Fixes: 611097d5daea("fbdev: da8xx: add support for a regulator") Signed-off-by: Dongliang Mu Signed-off-by: Helge Deller commit ff61582e0dd7eea57ce4abbe6bdc567ff9282ed6 Author: Yu Zhe Date: Fri Nov 18 17:00:50 2022 +0800 fbdev: controlfb: fix spelling mistake "paramaters"->"parameters" There is a spelling mistake in comment. Fix it. Signed-off-by: Yu Zhe Signed-off-by: Helge Deller commit 001f2cdb952a9566c77fb4b5470cc361db5601bb Author: Xiongfeng Wang Date: Mon Nov 14 16:56:54 2022 +0800 fbdev: vermilion: decrease reference count in error path pci_get_device() will increase the reference count for the returned pci_dev. For the error path, we need to use pci_dev_put() to decrease the reference count. Fixes: dbe7e429fedb ("vmlfb: framebuffer driver for Intel Vermilion Range") Signed-off-by: Xiongfeng Wang Signed-off-by: Helge Deller commit b76449ee75e21acfe9fa4c653d8598f191ed7d68 Author: Dongliang Mu Date: Fri Nov 11 13:49:49 2022 +0800 fbdev: smscufx: fix error handling code in ufx_usb_probe The current error handling code in ufx_usb_probe have many unmatching issues, e.g., missing ufx_free_usb_list, destroy_modedb label should only include framebuffer_release, fb_dealloc_cmap only matches fb_alloc_cmap. My local syzkaller reports a memory leak bug: memory leak in ufx_usb_probe BUG: memory leak unreferenced object 0xffff88802f879580 (size 128): comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s) hex dump (first 32 bytes): 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|............. 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................ backtrace: [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045 [] kmalloc include/linux/slab.h:553 [inline] [] kzalloc include/linux/slab.h:689 [inline] [] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline] [] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:560 [inline] [] really_probe+0x12d/0x390 drivers/base/dd.c:639 [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808 [] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008 [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [] device_add+0x642/0xdc0 drivers/base/core.c:3517 [] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170 [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [] call_driver_probe drivers/base/dd.c:560 [inline] [] really_probe+0x12d/0x390 drivers/base/dd.c:639 [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778 Fix this bug by rewriting the error handling code in ufx_usb_probe. Reported-by: syzkaller Tested-by: Dongliang Mu Signed-off-by: Dongliang Mu Signed-off-by: Helge Deller commit 5886b130de953cfb8826f7771ec8640a79934a7f Author: Shang XiaoJing Date: Mon Nov 14 09:08:52 2022 +0800 fbdev: via: Fix error in via_core_init() via_core_init() won't exit the driver when pci_register_driver() failed. Exit the viafb-i2c and the viafb-gpio in failed path to prevent error. VIA Graphics Integration Chipset framebuffer 2.4 initializing Error: Driver 'viafb-i2c' is already registered, aborting... Error: Driver 'viafb-gpio' is already registered, aborting... Fixes: 7582eb9be85f ("viafb: Turn GPIO and i2c into proper platform devices") Signed-off-by: Shang XiaoJing Signed-off-by: Helge Deller commit ed359a464846b48f76ea6cc5cd8257e545ac97f4 Author: Yang Yingliang Date: Sat Nov 12 17:55:10 2022 +0800 fbdev: pm2fb: fix missing pci_disable_device() Add missing pci_disable_device() in error path of probe() and remove() path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit eceadc9219884fa4b05bf56cace688b77a2563e0 Author: wangkailong@jari.cn Date: Sun Nov 6 22:16:08 2022 +0800 fbdev: pxafb: Remove unnecessary print function dev_err() Eliminate the follow coccicheck warning: ./drivers/video/fbdev/pxafb.c:2330:2-9: line 2330 is redundant because platform_get_irq() already prints an error Signed-off-by: KaiLong Wang Signed-off-by: Helge Deller commit 23910a20f3fe7bdddd4c834a2c7b4547a554e86f Author: Dmitry Torokhov Date: Thu Nov 3 20:16:42 2022 -0700 fbdev: omapfb: panel-sharp-ls037v7dw01: fix included headers The driver is using gpiod API so it should include gpio/consumer.h and not gpio.gh or of_gpio.h. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 275a855829ac19d06edf3f91d39c6014032667eb Author: Dmitry Torokhov Date: Thu Nov 3 20:16:41 2022 -0700 fbdev: omapfb: panel-tpo-td028ttec1: stop including gpio.h The driver does not use gpios, so there is no need to include gpio.h. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit a6828b1eb72621ac577079efd3b54b93c885261e Author: Dmitry Torokhov Date: Thu Nov 3 20:16:40 2022 -0700 fbdev: omapfb: panel-lgphilips-lb035q02: remove backlight GPIO handling With f048e8c1d169 ("omapfb: panel-lgphilips-lb035q02: Remove legacy boot support") it is no longer possible to specify GPIO to control the backlight. Remove code trying to request and toggle it. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 891bbadf1cf178eba8f2e3e175eabeee37a61ce8 Author: Dmitry Torokhov Date: Thu Nov 3 20:16:39 2022 -0700 fbdev: omapfb: encoder-opa362: fix included headers The driver has been switched to gpiod API, so it should include gpio/consumer.h instead of gpio.h and of_gpio.h. With of_gpio.h no longer included we need mod_devicetable.h for of_device_id definition. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 90a687d61b4812d8fc035a59659dc36359783f60 Author: Dmitry Torokhov Date: Thu Nov 3 20:16:38 2022 -0700 fbdev: omapfb: connector-analog-tv: remove support for platform data There are no users of connector_atv_platform_data in the mainline kernel so support for it can be removed from the panel driver. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit b7ec002c05d8e01b961bf5d915cf2e42a4cff4dd Author: Dmitry Torokhov Date: Thu Nov 3 20:16:37 2022 -0700 fbdev: omapfb: panel-dpi: remove support for platform data There are no users of panel_dpi_platform_data in the mainline kernel so support for it can be removed from the panel driver. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 39630e0f138a4821cd219a83fd727cf39d304201 Author: Dmitry Torokhov Date: Thu Nov 3 20:16:36 2022 -0700 fbdev: omapfb: panel-nec-nl8048hl11: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Note that because existing DTSes specify incorrect polarity of reset lines (active high) and GPU drivers have adopted to this, we follow the suit and use inverted values when controlling reset lines. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 836bfb5688e3ea87574760af82c82fa752b2540f Author: Dmitry Torokhov Date: Thu Nov 3 20:16:35 2022 -0700 fbdev: omapfb: panel-tpo-td043mtea1: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 67c366de0593d00222e2e675e73a59dcf33f2f3a Author: Dmitry Torokhov Date: Thu Nov 3 20:16:34 2022 -0700 fbdev: omapfb: panel-dsi-cm: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Note that because existing DTSes specify incorrect polarity of reset lines (active high) and GPU drivers have adopted to this, we follow the suit and use inverted values when controlling reset lines. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 6378085bc373f71b21fb074d62e321088b9a181a Author: Dmitry Torokhov Date: Thu Nov 3 20:16:33 2022 -0700 fbdev: omapfb: encoder-tfp410: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 844c245fc49d21639ed9e00c4b3ac0f219b7c6ce Author: Dmitry Torokhov Date: Thu Nov 3 20:16:32 2022 -0700 fbdev: omapfb: panel-sony-acx565akm: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Note that because existing DTSes specify incorrect polarity of reset lines (active high) and GPU drivers have adopted to this, we follow the suit and use inverted values when controlling reset lines. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 5845b32edc1ee1039d040716cf9d78bbd52e13c3 Author: Dmitry Torokhov Date: Thu Nov 3 20:16:31 2022 -0700 fbdev: omapfb: panel-sony-acx565akm: remove support for platform data There are no users of panel_acx565akm_platform_data in the mainline kernel so support for it can be removed from the panel driver. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 257030d4ee7c76892e9a4e5bf94f8c0fc41c6e46 Author: Dmitry Torokhov Date: Thu Nov 3 20:16:30 2022 -0700 fbdev: omapfb: connector-hdmi: switch to using gpiod API Switch the driver from legacy gpio API that is deprecated to the newer gpiod API that respects line polarities described in ACPI/DT. Signed-off-by: Dmitry Torokhov Signed-off-by: Helge Deller commit 28f24e90ffc4bf2199c91783b98dfc71de1e3a2f Author: Colin Ian King Date: Tue Nov 1 10:29:47 2022 +0000 fbdev: omapfb: remove redundant variable checksum Variable checksum is being used to accumulate values however it is never read or used afterwards. It is redundant and can be removed. Signed-off-by: Colin Ian King Signed-off-by: Helge Deller commit 6273c43769cbd4451b03d239dc16d5c54bb7279a Author: Andy Shevchenko Date: Tue Nov 1 17:09:47 2022 +0200 fbdev: ssd1307fb: Drop duplicate NULL checks for PWM APIs pwm_disable() and pwm_put() are NULL-aware, no need to duplicate the check in the caller. Signed-off-by: Andy Shevchenko Signed-off-by: Helge Deller commit 025e3b507a3a8e1ee96a3112bb67495c77d6cdb6 Author: Andy Shevchenko Date: Tue Nov 1 17:09:46 2022 +0200 fbdev: ssd1307fb: Drop optional dependency Only a single out of three devices need a PWM, so from driver it's optional. Moreover it's a single driver in the entire kernel that currently selects PWM. Unfortunately this selection is a root cause of the circular dependencies when we want to enable optional PWM for some other drivers that select GPIOLIB. Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller") Signed-off-by: Andy Shevchenko Signed-off-by: Helge Deller commit ff5870a76c2abda389650d3711cdddc031d12665 Author: Moises Cardona Date: Wed Dec 14 07:08:30 2022 -0500 ASoC: Intel: Add HP Stream 8 to bytcr_rt5640.c The bytcr_rt5640.c file already supports the HP Stream 7. The HP Stream 8 is almost identical in terms of the hardware with the exception of it having stereo speakers, a SIM card slot and the obvious size difference. Signed-off-by: Moises Cardona Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20221214120830.1572474-1-moisesmcardona@gmail.com Signed-off-by: Mark Brown commit cfb3162495fe5b8702cf3854995508ef78a3f962 Merge: 87be949912eed 68c62bee9d081 Author: Linus Torvalds Date: Wed Dec 14 10:35:47 2022 -0800 Merge tag 'ceph-for-6.2-rc1' of https://github.com/ceph/ceph-client Pull cph update from Ilya Dryomov: "A fix to facilitate prompt cap releases on async creates from Xiubo. This should address sporadic "client isn't responding to mclientcaps (revoke) ..." warnings and potential associated MDS hangs" * tag 'ceph-for-6.2-rc1' of https://github.com/ceph/ceph-client: ceph: try to check caps immediately after async creating finishes ceph: remove useless session parameter for check_caps() commit 549a715b98a13c6d05452be3ad37e980087bb081 Author: Sean Christopherson Date: Wed Dec 7 00:09:59 2022 +0000 KVM: x86: Add proper ReST tables for userspace MSR exits/flags Add ReST formatting to the set of userspace MSR exits/flags so that the resulting HTML docs generate a table instead of malformed gunk. This also fixes a warning that was introduced by a recent cleanup of the relevant documentation (yay copy+paste). >> Documentation/virt/kvm/api.rst:7287: WARNING: Block quote ends without a blank line; unexpected unindent. Fixes: 1ae099540e8c ("KVM: x86: Allow deflecting unknown MSR accesses to user space") Fixes: 1f158147181b ("KVM: x86: Clean up KVM_CAP_X86_USER_SPACE_MSR documentation") Reported-by: kernel test robot Signed-off-by: Sean Christopherson Message-Id: <20221207000959.2035098-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 818448e9cf92e5c6b3c10320372eefcbe4174e4f Author: Tiezhu Yang Date: Fri Nov 18 17:16:39 2022 +0800 perf tools: Use "grep -E" instead of "egrep" The latest version of grep claims the egrep is now obsolete so the build now contains warnings that look like: egrep: warning: egrep is obsolescent; using grep -E fix this up by moving the related file to use "grep -E" instead. sed -i "s/egrep/grep -E/g" `grep egrep -rwl tools/perf` Here are the steps to install the latest grep: wget http://ftp.gnu.org/gnu/grep/grep-3.8.tar.gz tar xf grep-3.8.tar.gz cd grep-3.8 && ./configure && make sudo make install export PATH=/usr/local/bin:$PATH Signed-off-by: Tiezhu Yang Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/1668762999-9297-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit c587e77e100fa40eb6af10e00497c67acf493f33 Author: Namhyung Kim Date: Mon Dec 12 15:08:20 2022 -0800 perf stat: Do not delay the workload with --delay The -D/--delay option is to delay the measure after the program starts. But the current code goes to sleep before starting the program so the program is delayed too. This is not the intention, let's fix it. Before: $ time sudo ./perf stat -a -e cycles -D 3000 sleep 4 Events disabled Events enabled Performance counter stats for 'system wide': 4,326,949,337 cycles 4.007494118 seconds time elapsed real 0m7.474s user 0m0.356s sys 0m0.120s It ran the workload for 4 seconds and gave the 3 second delay. So it should skip the first 3 second and measure the last 1 second only. But as you can see, it delays 3 seconds and ran the workload after that for 4 seconds. So the total time (real) was 7 seconds. After: $ time sudo ./perf stat -a -e cycles -D 3000 sleep 4 Events disabled Events enabled Performance counter stats for 'system wide': 1,063,551,013 cycles 1.002769510 seconds time elapsed real 0m4.484s user 0m0.385s sys 0m0.086s The bug was introduced when it changed enablement of system-wide events with a command line workload. But it should've considered the initial delay case. The code was reworked since then (in bb8bc52e7578) so I'm afraid it won't be applied cleanly. Fixes: d0a0a511493d2695 ("perf stat: Fix forked applications enablement of counters") Reported-by: Kevin Nomura Signed-off-by: Namhyung Kim Tested-by: Thomas Richter Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Sumanth Korikkar Link: https://lore.kernel.org/r/20221212230820.901382-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5f8f95673f68914419e8657b3263736264b40e16 Author: Ian Rogers Date: Tue Dec 13 15:26:51 2022 -0800 perf evlist: Remove group option. The group option predates grouping events using curly braces added in commit 89efb029502d7f2d ("perf tools: Add support to parse event group syntax"). The --group option was retained for legacy support (in August 2012) but keeping it adds complexity. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Andi Kleen Cc: Anshuman Khandual Cc: Athira Jajeev Cc: Eelco Chaudron Cc: German Gomez Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Kim Phillips Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sandipan Das Cc: Sean Christopherson Cc: Shaomin Deng Cc: Stephane Eranian Cc: Timothy Hayes Cc: Xing Zhengjun Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213232651.1269909-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 542d3c03fd895eb8370992293498332ea383a3b9 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:06 2022 +0100 media: sun6i-isp: params: Unregister pending buffer on cleanup The state cleanup helper should unregister the pending buffer from the state after returning it to v4l2, like it is done for other buffers in the wait queue. Before this change, the pending buffer from a previous run might have been returned at the beginning of the next run, causing an error. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 94c34359c88737d903c44d1c1a265cfdc58acd0e Author: Paul Kocialkowski Date: Thu Dec 8 15:20:05 2022 +0100 media: sun6i-isp: params: Fix incorrect indentation Remove a heading whitespace that results in a smatch warning. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7266eb7c5a52efe8dc19a34c45c0fc8e3c0e4137 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:04 2022 +0100 media: sun6i-isp: capture: Fix uninitialized variable use While the stride_chroma variable was previously initialized to zero, it's actually stride_chroma_div4 that is set to hardware registers. Initialize it to zero instead to avoid an uninitialized variable use and get rid of the associated smatch warning. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 44723b8c4692566237321d658b482025bb0235f8 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:03 2022 +0100 media: sun6i-isp: proc: Declare subdev ops as static The static keyword is missing in the v4l2 subdev ops definition for the proc. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f72af770947825cd9947ce8b979bf9d6fe699c73 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:02 2022 +0100 media: sun6i-isp: proc: Error out on invalid port to fix warning The enabled variable is only set for a valid port and used later, which triggers an uninitialized use smatch warning. Explicitly error out in that case to fix the warning. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 504307f2b3ae2625ed591efe073c2d14d568dfc8 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:01 2022 +0100 media: sun6i-isp: proc: Fix return code handling in stream off path Explicitly set ret to zero on disable path to avoid a related smatch warning. This makes initialization at declaration useless. Signed-off-by: Paul Kocialkowski Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 761ebebabd0953fde1e6b77d6ff54356dc1639c4 Author: Paul Kocialkowski Date: Thu Dec 8 15:20:00 2022 +0100 media: sun8i-a83t-mipi-csi2: Clarify return code handling in stream off path Explicitly set ret to zero instead of assigning it and overwriting it later, which is a bit confusing to understand. Signed-off-by: Paul Kocialkowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 52109d91d2f91e9cc7a14ee46443e374a21573cf Author: Paul Kocialkowski Date: Thu Dec 8 15:19:59 2022 +0100 media: sun6i-mipi-csi2: Clarify return code handling in stream off path Explicitly set ret to zero instead of assigning it and overwriting it later, which is a bit confusing to understand. Signed-off-by: Paul Kocialkowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f2c174e5018ed3360fdfeb6f9cd5c05e6086d134 Author: Paul Kocialkowski Date: Thu Dec 8 15:19:58 2022 +0100 media: sun6i-csi: capture: Remove useless ret initialization There is no particular need to assign ret when declaring it as it will be assigned before there is any chance to return it. Signed-off-by: Paul Kocialkowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7fabed7ae6185ef7f5967f3a2271c906ec6b7b7d Author: Paul Kocialkowski Date: Thu Dec 8 15:19:56 2022 +0100 media: sun6i-csi: bridge: Error out on invalid port to fix warning The enabled variable is only set for a valid port and used later, which triggers an uninitialized use smatch warning. Explicitly error out in that case to fix the warning. Signed-off-by: Paul Kocialkowski Fixes: 0d2b746b1bef ("media: sun6i-csi: Add bridge v4l2 subdev with port management") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 87be949912eedb73690d8eaeb086f24bfe17438d Merge: c7020e1b346d5 52f31ed228212 Author: Linus Torvalds Date: Wed Dec 14 10:11:51 2022 -0800 Merge tag 'xfs-6.2-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull XFS updates from Darrick Wong: "The highlight of this is a batch of fixes for the online metadata checking code as we start the loooong march towards merging online repair. I aim to merge that in time for the 2023 LTS. There are also a large number of data corruption and race condition fixes in this patchset. Most notably fixed are write() calls to unwritten extents racing with writeback, which required some late(r than I prefer) code changes to iomap to support the necessary revalidations. I don't really like iomap changes going in past -rc4, but Dave and I have been working on it long enough that I chose to push it for 6.2 anyway. There are also a number of other subtle problems fixed, including the log racing with inode writeback to write inodes with incorrect link count to disk; file data mapping corruptions as a result of incorrect lock cycling when attaching dquots; refcount metadata corruption if one actually manages to share a block 2^32 times; and the log clobbering cow staging extents if they were formerly metadata blocks. Summary: - Fix a race condition w.r.t. percpu inode free counters - Fix a broken error return in xfs_remove - Print FS UUID at mount/unmount time - Numerous fixes to the online fsck code - Fix inode locking inconsistency problems when dealing with realtime metadata files - Actually merge pull requests so that we capture the cover letter contents - Fix a race between rebuilding VFS inode state and the AIL flushing inodes that could cause corrupt inodes to be written to the filesystem - Fix a data corruption problem resulting from a write() to an unwritten extent racing with writeback started on behalf of memory reclaim changing the extent state - Add debugging knobs so that we can test iomap invalidation - Fix the blockdev pagecache contents being stale after unmounting the filesystem, leading to spurious xfs_db errors and corrupt metadumps - Fix a file mapping corruption bug due to ilock cycling when attaching dquots to a file during delalloc reservation - Fix a refcount btree corruption problem due to the refcount adjustment code not handling MAXREFCOUNT correctly, resulting in unnecessary record splits - Fix COW staging extent alloctions not being classified as USERDATA, which results in filestreams being ignored and possible data corruption if the allocation was filled from the AGFL and the block buffer is still being tracked in the AIL - Fix new duplicated includes - Fix a race between the dquot shrinker and dquot freeing that could cause a UAF" * tag 'xfs-6.2-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (50 commits) xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING xfs: Remove duplicated include in xfs_iomap.c xfs: invalidate xfs_bufs when allocating cow extents xfs: get rid of assert from xfs_btree_islastblock xfs: estimate post-merge refcounts correctly xfs: hoist refcount record merge predicates xfs: fix super block buf log item UAF during force shutdown xfs: wait iclog complete before tearing down AIL xfs: attach dquots to inode before reading data/cow fork mappings xfs: shut up -Wuninitialized in xfsaild_push xfs: use memcpy, not strncpy, to format the attr prefix during listxattr xfs: invalidate block device page cache during unmount xfs: add debug knob to slow down write for fun xfs: add debug knob to slow down writeback for fun xfs: drop write error injection is unfixable, remove it xfs: use iomap_valid method to detect stale cached iomaps iomap: write iomap validity checks xfs: xfs_bmap_punch_delalloc_range() should take a byte range iomap: buffered write failure should not truncate the page cache xfs,iomap: move delalloc punching to iomap ... commit 73278d483378cf850ade923a1107a70297b2602a Author: Hans Verkuil Date: Mon Dec 12 08:32:20 2022 +0000 media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1 The patch adding support for dynamically allocated arrays accidentally dropped the line setting ctrl->is_new to 1, thus new string values were always ignored. Fixes: fb582cba4492 ("media: v4l2-ctrls: add support for dynamically allocated arrays.") Reported-by: Alice Yuan Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ad0fca2dceeab8fdd8e1135f4b4ef2dc46c2ead9 Author: Matthew Auld Date: Mon Dec 12 17:19:58 2022 +0000 drm/i915/ttm: consider CCS for backup objects It seems we can have one or more framebuffers that are still pinned when suspending lmem, in such a case we end up creating a shmem backup object, instead of evicting the object directly, but this will skip copying the CCS aux state, since we don't allocate the extra storage for the CCS pages as part of the ttm_tt construction. Since we can already deal with pinned objects just fine, it doesn't seem too nasty to just extend to support dealing with the CCS aux state, if the object is a pinned framebuffer. This fixes display corruption (like in gnome-shell) seen on DG2 when returning from suspend. Fixes: da0595ae91da ("drm/i915/migrate: Evict and restore the flatccs capable lmem obj") Signed-off-by: Matthew Auld Cc: Ville Syrjälä Cc: Nirmoy Das Cc: Andrzej Hajda Cc: Shuicheng Lin Cc: # v5.19+ Tested-by: Nirmoy Das Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20221212171958.82593-2-matthew.auld@intel.com (cherry picked from commit 95df9cc24bee8a09d39c62bcef4319b984814e18) Signed-off-by: Rodrigo Vivi commit 952d19190c6d482ec725f22e8bc8646bc0189d41 Author: Matthew Auld Date: Mon Dec 12 17:19:57 2022 +0000 drm/i915/migrate: fix corner case in CCS aux copying In the case of lmem -> lmem transfers, which is currently only possible with small-bar systems, we need to ensure we copy the CCS aux state as-is, rather than nuke it. This should fix some nasty display corruption sometimes seen on DG2 small-bar systems, when also using DG2_RC_CCS_CC for the surface. Fixes: e3afc690188b ("drm/i915/display: consider DG2_RC_CCS_CC when migrating buffers") Signed-off-by: Matthew Auld Cc: Ville Syrjälä Cc: Nirmoy Das Cc: Andrzej Hajda Cc: Shuicheng Lin Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20221212171958.82593-1-matthew.auld@intel.com (cherry picked from commit b29d26fbcb862526d5047caec82878be2eb75c0f) Signed-off-by: Rodrigo Vivi commit 85c50197716c60fe57f411339c579462e563ac57 Author: Isaac J. Manjarres Date: Thu Dec 8 13:29:01 2022 -0800 loop: Fix the max_loop commandline argument treatment when it is set to 0 Currently, the max_loop commandline argument can be used to specify how many loop block devices are created at init time. If it is not specified on the commandline, CONFIG_BLK_DEV_LOOP_MIN_COUNT loop block devices will be created. The max_loop commandline argument can be used to override the value of CONFIG_BLK_DEV_LOOP_MIN_COUNT. However, when max_loop is set to 0 through the commandline, the current logic treats it as if it had not been set, and creates CONFIG_BLK_DEV_LOOP_MIN_COUNT devices anyway. Fix this by starting max_loop off as set to CONFIG_BLK_DEV_LOOP_MIN_COUNT. This preserves the intended behavior of creating CONFIG_BLK_DEV_LOOP_MIN_COUNT loop block devices if the max_loop commandline parameter is not specified, and allowing max_loop to be respected for all values, including 0. This allows environments that can create all of their required loop block devices on demand to not have to unnecessarily preallocate loop block devices. Fixes: 732850827450 ("remove artificial software max_loop limit") Cc: stable@vger.kernel.org Cc: Ken Chen Signed-off-by: Isaac J. Manjarres Link: https://lore.kernel.org/r/20221208212902.765781-1-isaacmanjarres@google.com Signed-off-by: Jens Axboe commit c7020e1b346d5840e93b58cc4f2c67fc645d8df9 Merge: a0a6c76cf2a50 f826afe5eae85 Author: Linus Torvalds Date: Wed Dec 14 09:54:10 2022 -0800 Merge tag 'pci-v6.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Squash portdrv_{core,pci}.c into portdrv.c to ease maintenance and make more things static. - Make portdrv bind to Switch Ports that have AER. Previously, if these Ports lacked MSI/MSI-X, portdrv failed to bind, which meant the Ports couldn't be suspended to low-power states. AER on these Ports doesn't use interrupts, and the AER driver doesn't need to claim them. - Assign PCI domain IDs using ida_alloc(), which makes host bridge add/remove work better. Resource management: - To work better with recent BIOSes that use EfiMemoryMappedIO for PCI host bridge apertures, remove those regions from the E820 map (E820 entries normally prevent us from allocating BARs). In v5.19, we added some quirks to disable E820 checking, but that's not very maintainable. EfiMemoryMappedIO means the OS needs to map the region for use by EFI runtime services; it shouldn't prevent OS from using it. PCIe native device hotplug: - Build pciehp by default if USB4 is enabled, since Thunderbolt/USB4 PCIe tunneling depends on native PCIe hotplug. - Enable Command Completed Interrupt only if supported to avoid user confusion from lspci output that says this is enabled but not supported. - Prevent pciehp from binding to Switch Upstream Ports; this happened because of interaction with acpiphp and caused devices below the Upstream Port to disappear. Power management: - Convert AGP drivers to generic power management. We hope to remove legacy power management from the PCI core eventually. Virtualization: - Fix pci_device_is_present(), which previously always returned "false" for VFs, causing virtio hangs when unbinding the driver. Miscellaneous: - Convert drivers to gpiod API to prepare for dropping some legacy code. - Fix DOE fencepost error for the maximum data object length. Baikal-T1 PCIe controller driver: - Add driver and DT bindings. Broadcom STB PCIe controller driver: - Enable Multi-MSI. - Delay 100ms after PERST# deassert to allow power and clocks to stabilize. - Configure Read Completion Boundary to 64 bytes. Freescale i.MX6 PCIe controller driver: - Initialize PHY before deasserting core reset to fix a regression in v6.0 on boards where the PHY provides the reference. - Fix imx6sx and imx8mq clock names in DT schema. Intel VMD host bridge driver: - Fix Secondary Bus Reset on VMD bridges, which allows reset of NVMe SSDs in VT-d pass-through scenarios. - Disable MSI remapping, which gets re-enabled by firmware during suspend/resume. MediaTek PCIe Gen3 controller driver: - Add MT7986 and MT8195 support. Qualcomm PCIe controller driver: - Add SC8280XP/SA8540P basic interconnect support. Rockchip DesignWare PCIe controller driver: - Base DT schema on common Synopsys schema. Synopsys DesignWare PCIe core: - Collect DT items shared between Root Port and Endpoint (PERST GPIO, PHY info, clocks, resets, link speed, number of lanes, number of iATU windows, interrupt info, etc) to snps,dw-pcie-common.yaml. - Add dma-ranges support for Root Ports and Endpoints. - Consolidate DT resource retrieval for "dbi", "dbi2", "atu", etc. to reduce code duplication. - Add generic names for clocks and resets to encourage more consistent naming across drivers using DesignWare IP. - Stop advertising PTM Responder role for Endpoints, which aren't allowed to be responders. TI J721E PCIe driver: - Add j721s2 host mode ID to DT schema. - Add interrupt properties to DT schema. Toshiba Visconti PCIe controller driver: - Fix interrupts array max constraints in DT schema" * tag 'pci-v6.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (95 commits) x86/PCI: Use pr_info() when possible x86/PCI: Fix log message typo x86/PCI: Tidy E820 removal messages PCI: Skip allocate_resource() if too little space available efi/x86: Remove EfiMemoryMappedIO from E820 map PCI/portdrv: Allow AER service only for Root Ports & RCECs PCI: xilinx-nwl: Fix coding style violations PCI: mvebu: Switch to using gpiod API PCI: pciehp: Enable Command Completed Interrupt only if supported PCI: aardvark: Switch to using devm_gpiod_get_optional() dt-bindings: PCI: mediatek-gen3: add support for mt7986 dt-bindings: PCI: mediatek-gen3: add SoC based clock config dt-bindings: PCI: qcom: Allow 'dma-coherent' property PCI: mt7621: Add sentinel to quirks table PCI: vmd: Fix secondary bus reset for Intel bridges PCI: endpoint: pci-epf-vntb: Fix sparse ntb->reg build warning PCI: endpoint: pci-epf-vntb: Fix sparse build warning for epf_db PCI: endpoint: pci-epf-vntb: Replace hardcoded 4 with sizeof(u32) PCI: endpoint: pci-epf-vntb: Remove unused epf_db_phy struct member PCI: endpoint: pci-epf-vntb: Fix call pci_epc_mem_free_addr() in error path ... commit e89f3edffb860a0f54a9ed16deadb7a4a1fa3862 Author: Milan Landaverde Date: Tue Dec 13 12:57:14 2022 -0500 bpf: prevent leak of lsm program after failed attach In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, but in our validation to make sure the prog is meant to be attached to BPF_LSM_CGROUP, we return too early if the check fails. This results in lack of decrementing prog's refcnt (through bpf_prog_put) leaving the LSM program alive past the point of the expected lifecycle. This fix allows for the decrement to take place. [0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/ Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Signed-off-by: Milan Landaverde Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Reviewed-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20221213175714.31963-1-milan@mdaverde.com commit a8dfde09c90109e3a98af54847e91bde7dc2d5c2 Author: Song Liu Date: Tue Dec 13 14:05:00 2022 -0800 selftests/bpf: Select CONFIG_FUNCTION_ERROR_INJECTION BPF selftests require CONFIG_FUNCTION_ERROR_INJECTION to work. However, CONFIG_FUNCTION_ERROR_INJECTION is no longer 'y' by default after recent changes. As a result, we are seeing errors like the following from BPF CI: bpf_testmod_test_read() is not modifiable __x64_sys_setdomainname is not sleepable __x64_sys_getpgid is not sleepable Fix this by explicitly selecting CONFIG_FUNCTION_ERROR_INJECTION in the selftest config. Fixes: a4412fdd49dc ("error-injection: Add prompt for function error injection") Reported-by: Daniel Müller Signed-off-by: Song Liu Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Daniel Müller Link: https://lore.kernel.org/bpf/20221213220500.3427947-1-song@kernel.org commit ec9230b18b45853287298d70be23f8ec6bd44ff0 Author: Yonghong Song Date: Mon Dec 12 17:22:24 2022 -0800 selftests/bpf: Fix a selftest compilation error with CONFIG_SMP=n Kernel test robot reported bpf selftest build failure when CONFIG_SMP is not set. The error message looks below: >> progs/rcu_read_lock.c:256:34: error: no member named 'last_wakee' in 'struct task_struct' last_wakee = task->real_parent->last_wakee; ~~~~~~~~~~~~~~~~~ ^ 1 error generated. When CONFIG_SMP is not set, the field 'last_wakee' is not available in struct 'task_struct'. Hence the above compilation failure. To fix the issue, let us choose another field 'group_leader' which is available regardless of CONFIG_SMP set or not. Fixes: fe147956fca4 ("bpf/selftests: Add selftests for new task kfuncs") Fixes: 48671232fcb8 ("selftests/bpf: Add tests for bpf_rcu_read_lock()") Reported-by: kernel test robot Signed-off-by: David Vernet Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: David Vernet Link: https://lore.kernel.org/bpf/20221213012224.379581-1-yhs@fb.com commit d2b497a973fcb76a6b7a552f081b83a1edd91c86 Author: Donald Hunter Date: Mon Dec 12 10:16:00 2022 +0000 docs/bpf: Reword docs for BPF_MAP_TYPE_SK_STORAGE Improve the grammar of the function descriptions and highlight that the key is a socket fd. Fixes: f3212ad5b7e9 ("docs/bpf: Add documentation for BPF_MAP_TYPE_SK_STORAGE") Reported-by: Martin KaFai Lau Signed-off-by: Donald Hunter Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20221212101600.56026-1-donald.hunter@gmail.com commit a0a6c76cf2a506c061072db6c187f8a641dc85de Merge: ab425febda94c 08dcf0732cb4d Author: Linus Torvalds Date: Wed Dec 14 09:34:26 2022 -0800 Merge tag 'i3c/for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "A non-urgent fix and SETDASA is now exported to drivers" * tag 'i3c/for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: MAINTAINERS: mark I3C DRIVER FOR SYNOPSYS DESIGNWARE orphan i3c: export SETDASA method i3c: Correct the macro module_i3c_i2c_driver commit ab425febda94c7d287ea3433cbd0971771d6aeb4 Merge: 08cdc2157966c dbc94a0fb8177 Author: Linus Torvalds Date: Wed Dec 14 09:27:13 2022 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Usual size of updates, a new driver, and most of the bulk focusing on rxe: - Usual typos, style, and language updates - Driver updates for mlx5, irdma, siw, rts, srp, hfi1, hns, erdma, mlx4, srp - Lots of RXE updates: * Improve reply error handling for bad MR operations * Code tidying * Debug printing uses common loggers * Remove half implemented RD related stuff * Support IBA's recently defined Atomic Write and Flush operations - erdma support for atomic operations - New driver 'mana' for Ethernet HW available in Azure VMs. This driver only supports DPDK" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (122 commits) IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RDMA: Add missed netdev_put() for the netdevice_tracker RDMA/rxe: Enable RDMA FLUSH capability for rxe device RDMA/cm: Make QP FLUSHABLE for supported device RDMA/rxe: Implement flush completion RDMA/rxe: Implement flush execution in responder side RDMA/rxe: Implement RC RDMA FLUSH service in requester side RDMA/rxe: Extend rxe packet format to support flush RDMA/rxe: Allow registering persistent flag for pmem MR only RDMA/rxe: Extend rxe user ABI to support flush RDMA: Extend RDMA kernel verbs ABI to support flush RDMA: Extend RDMA user ABI to support flush RDMA/rxe: Fix incorrect responder length checking RDMA/rxe: Fix oops with zero length reads RDMA/mlx5: Remove not-used IB_FLOW_SPEC_IB define RDMA/hns: Fix XRC caps on HIP08 RDMA/hns: Fix error code of CMD RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix AH attr queried by query_qp ... commit 08cdc2157966c07d3f986a097ddaa74cee312751 Merge: aa5ad10f6cca6 d6c55c0a20e50 Author: Linus Torvalds Date: Wed Dec 14 09:15:43 2022 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd implementation from Jason Gunthorpe: "iommufd is the user API to control the IOMMU subsystem as it relates to managing IO page tables that point at user space memory. It takes over from drivers/vfio/vfio_iommu_type1.c (aka the VFIO container) which is the VFIO specific interface for a similar idea. We see a broad need for extended features, some being highly IOMMU device specific: - Binding iommu_domain's to PASID/SSID - Userspace IO page tables, for ARM, x86 and S390 - Kernel bypassed invalidation of user page tables - Re-use of the KVM page table in the IOMMU - Dirty page tracking in the IOMMU - Runtime Increase/Decrease of IOPTE size - PRI support with faults resolved in userspace Many of these HW features exist to support VM use cases - for instance the combination of PASID, PRI and Userspace IO Page Tables allows an implementation of DMA Shared Virtual Addressing (vSVA) within a guest. Dirty tracking enables VM live migration with SRIOV devices and PASID support allow creating "scalable IOV" devices, among other things. As these features are fundamental to a VM platform they need to be uniformly exposed to all the driver families that do DMA into VMs, which is currently VFIO and VDPA" For more background, see the extended explanations in Jason's pull request: https://lore.kernel.org/lkml/Y5dzTU8dlmXTbzoJ@nvidia.com/ * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (62 commits) iommufd: Change the order of MSI setup iommufd: Improve a few unclear bits of code iommufd: Fix comment typos vfio: Move vfio group specific code into group.c vfio: Refactor dma APIs for emulated devices vfio: Wrap vfio group module init/clean code into helpers vfio: Refactor vfio_device open and close vfio: Make vfio_device_open() truly device specific vfio: Swap order of vfio_device_container_register() and open_device() vfio: Set device->group in helper function vfio: Create wrappers for group register/unregister vfio: Move the sanity check of the group to vfio_create_group() vfio: Simplify vfio_create_group() iommufd: Allow iommufd to supply /dev/vfio/vfio vfio: Make vfio_container optionally compiled vfio: Move container related MODULE_ALIAS statements into container.c vfio-iommufd: Support iommufd for emulated VFIO devices vfio-iommufd: Support iommufd for physical VFIO devices vfio-iommufd: Allow iommufd to be used in place of a container fd vfio: Use IOMMU_CAP_ENFORCE_CACHE_COHERENCY for vfio_file_enforced_coherent() ... commit aa5ad10f6cca6d42f3fef6cb862e03b220ea19a6 Merge: e2ca6ba6ba015 4e80eef45ad77 Author: Linus Torvalds Date: Wed Dec 14 08:58:51 2022 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (target, ufs, smartpqi, lpfc). There are some core changes, mostly around reworking some of our user context assumptions in device put and moving some code around. The remaining updates are bug fixes and minor changes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (138 commits) scsi: sg: Fix get_user() in call sg_scsi_ioctl() scsi: megaraid_sas: Fix some spelling mistakes in comment scsi: core: Use SCSI_SCAN_INITIAL in do_scsi_scan_host() scsi: core: Use SCSI_SCAN_RESCAN in __scsi_add_device() scsi: ufs: ufs-mediatek: Remove unnecessary return code scsi: ufs: core: Fix the polling implementation scsi: libsas: Do not export sas_ata_wait_after_reset() scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset scsi: libsas: Add smp_ata_check_ready_type() scsi: Revert "scsi: hisi_sas: Don't send bcast events from HW during nexus HA reset" scsi: Revert "scsi: hisi_sas: Drain bcast events in hisi_sas_rescan_topology()" scsi: ufs: ufs-mediatek: Modify the return value scsi: ufs: ufs-mediatek: Remove unneeded code scsi: device_handler: alua: Call scsi_device_put() from non-atomic context scsi: device_handler: alua: Revert "Move a scsi_device_put() call out of alua_check_vpd()" scsi: snic: Fix possible UAF in snic_tgt_create() scsi: qla2xxx: Initialize vha->unknown_atio_[list, work] for NPIV hosts scsi: qla2xxx: Remove duplicate of vha->iocb_work initialization scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: sd: Use 16-byte SYNCHRONIZE CACHE on ZBC devices ... commit ff1cc97b1f4c10db224f276d9615b22835b8c424 Author: Jiri Slaby (SUSE) Date: Tue Dec 13 13:08:26 2022 +0100 block/blk-iocost (gcc13): keep large values in a new enum Since gcc13, each member of an enum has the same type as the enum [1]. And that is inherited from its members. Provided: VTIME_PER_SEC_SHIFT = 37, VTIME_PER_SEC = 1LLU << VTIME_PER_SEC_SHIFT, ... AUTOP_CYCLE_NSEC = 10LLU * NSEC_PER_SEC, the named type is unsigned long. This generates warnings with gcc-13: block/blk-iocost.c: In function 'ioc_weight_prfill': block/blk-iocost.c:3037:37: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'long unsigned int' block/blk-iocost.c: In function 'ioc_weight_show': block/blk-iocost.c:3047:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' So split the anonymous enum with large values to a separate enum, so that they don't affect other members. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 Cc: Martin Liska Cc: Tejun Heo Cc: Josef Bacik Cc: Jens Axboe Cc: cgroups@vger.kernel.org Cc: linux-block@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20221213120826.17446-1-jirislaby@kernel.org Signed-off-by: Jens Axboe commit 337366e02b370d2800110fbc99940f6ddddcbdfa Author: Yu Kuai Date: Wed Dec 14 11:31:55 2022 +0800 block, bfq: replace 0/1 with false/true in bic apis Just to make the code a litter cleaner, there are no functional changes. Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221214033155.3455754-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 452af7dc59033a76372d51a24682503377872b11 Author: Yu Kuai Date: Wed Dec 14 11:31:54 2022 +0800 block, bfq: don't return bfqg from __bfq_bic_change_cgroup() The return value is not used, hence remove it. Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221214033155.3455754-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 64dc8c732f5c2b406cc752e6aaa1bd5471159cab Author: Yu Kuai Date: Wed Dec 14 11:04:30 2022 +0800 block, bfq: fix possible uaf for 'bfqq->bic' Our test report a uaf for 'bfqq->bic' in 5.10: ================================================================== BUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30 CPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014 Call Trace: bfq_select_queue+0x378/0xa30 bfq_dispatch_request+0xe8/0x130 blk_mq_do_dispatch_sched+0x62/0xb0 __blk_mq_sched_dispatch_requests+0x215/0x2a0 blk_mq_sched_dispatch_requests+0x8f/0xd0 __blk_mq_run_hw_queue+0x98/0x180 __blk_mq_delay_run_hw_queue+0x22b/0x240 blk_mq_run_hw_queue+0xe3/0x190 blk_mq_sched_insert_requests+0x107/0x200 blk_mq_flush_plug_list+0x26e/0x3c0 blk_finish_plug+0x63/0x90 __iomap_dio_rw+0x7b5/0x910 iomap_dio_rw+0x36/0x80 ext4_dio_read_iter+0x146/0x190 [ext4] ext4_file_read_iter+0x1e2/0x230 [ext4] new_sync_read+0x29f/0x400 vfs_read+0x24e/0x2d0 ksys_read+0xd5/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Commit 3bc5e683c67d ("bfq: Split shared queues on move between cgroups") changes that move process to a new cgroup will allocate a new bfqq to use, however, the old bfqq and new bfqq can point to the same bic: 1) Initial state, two process with io in the same cgroup. Process 1 Process 2 (BIC1) (BIC2) | Λ | Λ | | | | V | V | bfqq1 bfqq2 2) bfqq1 is merged to bfqq2. Process 1 Process 2 (BIC1) (BIC2) | | \-------------\| V bfqq1 bfqq2(coop) 3) Process 1 exit, then issue new io(denoce IOA) from Process 2. (BIC2) | Λ | | V | bfqq2(coop) 4) Before IOA is completed, move Process 2 to another cgroup and issue io. Process 2 (BIC2) Λ |\--------------\ | V bfqq2 bfqq3 Now that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2. If all the requests are completed, and Process 2 exit, BIC2 will be freed while there is no guarantee that bfqq2 will be freed before BIC2. Fix the problem by clearing bfqq->bic while bfqq is detached from bic. Fixes: 3bc5e683c67d ("bfq: Split shared queues on move between cgroups") Suggested-by: Jan Kara Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221214030430.3304151-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit eb9d58947d40699d93e5e69e1ddc54e41da7e132 Author: Steven Rostedt (Google) Date: Tue Dec 13 22:12:27 2022 -0500 tracing: Fix cpumask() example typo The sample code for using cpumask used the wrong field for the __get_cpumask() helper. It used "cpus" which is the bitmask (but would still give a proper example) instead of the "cpum" that was there to be used. Although it produces the same output, fix it, because it's an example and is confusing in how to properly use the cpumask() macro. Link: https://lore.kernel.org/linux-trace-kernel/20221213221227.56560374@gandalf.local.home Cc: Andrew Morton Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit ea47666ca4288becf82c51eb3da6d3ff891470a4 Author: Guilherme G. Piccoli Date: Fri Aug 19 19:17:26 2022 -0300 tracing: Improve panic/die notifiers Currently the tracing dump_on_oops feature is implemented through separate notifiers, one for die/oops and the other for panic; given they have the same functionality, let's unify them. Also improve the function comment and change the priority of the notifier to make it execute earlier, avoiding showing useless trace data (like the callback names for the other notifiers); finally, we also removed an unnecessary header inclusion. Link: https://lkml.kernel.org/r/20220819221731.480795-7-gpiccoli@igalia.com Cc: Petr Mladek Cc: Sergei Shtylyov Signed-off-by: Guilherme G. Piccoli Signed-off-by: Steven Rostedt (Google) commit d0b24b4e91fcb8408c4979888547f86be514e337 Author: Guilherme G. Piccoli Date: Tue Nov 15 17:48:47 2022 -0300 ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels The function match_records() may take a while due to a large number of string comparisons, so when in PREEMPT_VOLUNTARY kernels we could face RCU stalls due to that. Add a cond_resched() to prevent that. Link: https://lkml.kernel.org/r/20221115204847.593616-1-gpiccoli@igalia.com Cc: Mark Rutland Suggested-by: Steven Rostedt Acked-by: Paul E. McKenney # from RCU CPU stall warning perspective Signed-off-by: Guilherme G. Piccoli Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit bd7bcc4f963c8898176ad864288959375154e038 Merge: 904f309ae7eda 5011a110295d2 Author: Rafael J. Wysocki Date: Wed Dec 14 17:05:45 2022 +0100 Merge tag 'thermal-v6.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal driver changes for 6.2-rc1 from Daniel Lezcano: "- Add the sm8450 QCom compatible string in the DT bindings (Luca Weiss) - Use devm_platform_get_and_ioremap_resource on the ST platform to group two calls into a single one (Minghao Chi) - Add the sm8550 QCom compatible string in the DT bindings (Neil Armstrong) - Use GENMASK instead of bitmaps and validate the temperature after reading it (Marcus Folkesson) - Convert generic-adc-thermal to DT schema (Rob Herring) - Fix the debug print message where the logic is inverted (Keerthy) - Fix memory leak on thermal_of_zone_register() failure (Ido Schimmel) - Add support for IPQ8074 in the tsens driver along with the DT bindings (Robert Marko) - Fix and rework the debugfs code in the tsens driver (Christian Marangi) - Add calibration and DT documentation for the imx8mm driver (Marek Vasut) - Add DT bindings and compatible for the Mediatek SoCs mt7981 and mt7983 (Daniel Golle) - Don't show an error message if it happens at probe time while it will be deferred on the QCom SPMI ADC driver (Johan Hovold) - Add the HWMon support on the imx8mm board (Alexander Stein) - Remove a pointless include in the power allocator governor (Christophe JAILLET) - Add interrupt DT bindings for QCom SoCs SC8280XP, SM6350 and SM8450 (Krzysztof Kozlowski) - Fix inaccurate warning message for the QCom tsens gen2 (Luca Weiss) - Demote error log of thermal zone register to debug on the tsens QCom driver (Manivannan Sadhasivam) - Consolidate the TI Bandgap driver regarding how is handled the efuse values and the errata handling (Bryan Brattlof) - Document the Renesas RZ/Five as compatible with RZ/G2UL in the DT bindings (Lad Prabhakar) - Fix the irq handler return value in the LMh driver (Bjorn Andersson) - Delete platform remove callback as it is empty (Uwe Kleine-König)" * tag 'thermal-v6.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (34 commits) thermal/drivers/imx_sc_thermal: Drop empty platform remove function thermal/drivers/qcom/lmh: Fix irq handler return value dt-bindings: thermal: qcom-tsens: Add compatible for sm8550 thermal/drivers/st: Use devm_platform_get_and_ioremap_resource() dt-bindings: thermal: rzg2l-thermal: Document RZ/Five SoC dt-bindings: thermal: k3-j72xx: conditionally require efuse reg range dt-bindings: thermal: k3-j72xx: elaborate on binding description thermal/drivers/k3_j72xx_bandgap: Map fuse_base only for erratum workaround thermal/drivers/k3_j72xx_bandgap: Remove fuse_base from structure thermal/drivers/k3_j72xx_bandgap: Use bool for i2128 erratum flag thermal/drivers/k3_j72xx_bandgap: Simplify k3_thermal_get_temp() function thermal/drivers/qcom: Demote error log of thermal zone register to debug thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 dt-bindings: thermal: qcom-tsens: narrow interrupts for SC8280XP, SM6350 and SM8450 thermal/core/power allocator: Remove a useless include thermal/drivers/imx8mm: Add hwmon support thermal: qcom-spmi-adc-tm5: suppress probe-deferral error message dt-bindings: thermal: mediatek: add compatible string for MT7986 and MT7981 SoC thermal: ti-soc-thermal: Drop comma after SoC match table sentinel thermal/drivers/imx: Add support for loading calibration data from OCOTP ... commit e5f30f6fb29a0b8fa7ca784e44571a610b949b04 Author: Pavel Begunkov Date: Fri Dec 2 17:47:24 2022 +0000 io_uring: ease timeout flush locking requirements We don't need completion_lock for timeout flushing, don't take it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1e3dc657975ac445b80e7bdc40050db783a5935a.1670002973.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 6971253f078766543c716db708ba2c787826690d Author: Pavel Begunkov Date: Fri Dec 2 17:47:23 2022 +0000 io_uring: revise completion_lock locking io_kill_timeouts() doesn't post any events but queues everything to task_work. Locking there is needed for protecting linked requests traversing, we should grab completion_lock directly instead of using io_cq_[un]lock helpers. Same goes for __io_req_find_next_prep(). Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/88e75d481a65dc295cb59722bb1cf76402d1c06b.1670002973.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ea011ee10231f5fa6cbb415007048ca0bb948baf Author: Pavel Begunkov Date: Fri Dec 2 17:47:22 2022 +0000 io_uring: protect cq_timeouts with timeout_lock Read cq_timeouts in io_flush_timeouts() only after taking the timeout_lock, as it's protected by it. There are many places where we also grab ->completion_lock, but for instance io_timeout_fn() doesn't and still modifies cq_timeouts. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9c79544dd6cf5c4018cb1bab99cf481a93ea46ef.1670002973.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 38792972de4294163f44d6360fd221e6f2c22a05 Author: Ard Biesheuvel Date: Tue Dec 13 14:24:07 2022 +0100 ftrace: Allow WITH_ARGS flavour of graph tracer with shadow call stack The recent switch on arm64 from DYNAMIC_FTRACE_WITH_REGS to DYNAMIC_FTRACE_WITH_ARGS failed to take into account that we currently require the former in order to allow the function graph tracer to be enabled in combination with shadow call stacks. This means that this is no longer permitted at all, in spite of the fact that either flavour of ftrace works perfectly fine in this combination. So permit WITH_ARGS as well as WITH_REGS. Fixes: ddc9863e9e90 ("scs: Disable when function graph tracing is enabled") Acked-by: Mark Rutland Acked-by: Steven Rostedt (Google) Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20221213132407.1485025-1-ardb@kernel.org Signed-off-by: Will Deacon commit 75333d48f92256a0dec91dbf07835e804fc411c0 Author: Dai Ngo Date: Mon Dec 12 14:50:11 2022 -0800 NFSD: fix use-after-free in __nfs42_ssc_open() Problem caused by source's vfsmount being unmounted but remains on the delayed unmount list. This happens when nfs42_ssc_open() return errors. Fixed by removing nfsd4_interssc_connect(), leave the vfsmount for the laundromat to unmount when idle time expires. We don't need to call nfs_do_sb_deactive when nfs42_ssc_open return errors since the file was not opened so nfs_server->active was not incremented. Same as in nfsd4_copy, if we fail to launch nfsd4_do_async_copy thread then there's no need to call nfs_do_sb_deactive Reported-by: Xingyuan Mo Signed-off-by: Dai Ngo Tested-by: Xingyuan Mo Signed-off-by: Chuck Lever commit e44a0fe630c58b0a87d8281f5c1077a3479e5fce Author: Christian König Date: Fri Nov 25 17:04:25 2022 +0100 drm/amdgpu: rework reserved VMID handling Instead of reserving a VMID for a single process allow that many processes use the reserved ID. This allows for proper isolation between the processes. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 053499f7b45dc56758240615569b349fe9e2fc8d Author: Christian König Date: Fri Nov 25 16:45:09 2022 +0100 drm/amdgpu: stop waiting for the VM during unreserve This is completely pointless since the VMID always stays allocated until the VM is idle. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 5f3c40e9e2460c42f5bf6c51b1e393d7159241c3 Author: Christian König Date: Fri Nov 25 16:42:45 2022 +0100 drm/amdgpu: cleanup SPM support a bit This should probably not access job->vm and also emit the SPM switch under the conditional execute. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 56b0989e2939811c11ed9c449ff84cf85878ffe3 Author: Christian König Date: Fri Nov 25 16:04:25 2022 +0100 drm/amdgpu: fix GDS/GWS/OA switch handling Bas pointed out that this isn't working as expected and could cause crashes. Fix the handling by storing the marker that a switch is needed inside the job instead. Reported-by: Bas Nieuwenhuizen Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit e0607c10ebf551a654c3577fc74b4bf5533e1cea Author: Evan Quan Date: Fri Dec 9 16:09:58 2022 +0800 drm/amd/pm: add missing SMU13.0.7 mm_dpm feature mapping Without this, the pp_dpm_vclk and pp_dpm_dclk outputs are not with correct data. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit 592cd24a08763975c75be850a7d4e461bfd353bf Author: Evan Quan Date: Fri Dec 9 16:05:12 2022 +0800 drm/amd/pm: add missing SMU13.0.0 mm_dpm feature mapping Without this, the pp_dpm_vclk and pp_dpm_dclk outputs are not with correct data. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x commit f95f51a4c3357eabf74fe14ab7daa5b5c0422b27 Author: Felix Kuehling Date: Wed Apr 21 21:09:54 2021 -0400 drm/amdgpu: Add notifier lock for KFD userptrs Add a per-process MMU notifier lock for processing notifiers from userptrs. Use that lock to properly synchronize page table updates with MMU notifiers. Signed-off-by: Felix Kuehling Reviewed-by: Xiaogang Chen Signed-off-by: Alex Deucher commit fe6872adb05e85bde38f2cdec01a0f4cfb826998 Author: Yifan Zhang Date: Thu Dec 8 11:55:15 2022 +0800 drm/amd/display: Add DCN314 display SG Support Add display SG support for DCN 3.1.4. Signed-off-by: Yifan Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4d2ccd96ac25846749fc58691f5142a966e65b3a Author: Christian König Date: Wed Nov 16 15:45:36 2022 +0100 drm/amdgpu: WARN when freeing kernel memory during suspend When buffers are freed during suspend there is no guarantee that they can be re-allocated during resume. The PSP subsystem seems to be quite buggy regarding this, so add a WARN_ON() to point out those bugs. Signed-off-by: Christian König Reviewed-by: Alex Deucher Tested-by: Guilherme G. Piccoli Signed-off-by: Alex Deucher commit 9c3db58bf8f7d0007049f686ce8c419eed4325d1 Author: Christian König Date: Wed Dec 7 08:47:30 2022 +0100 drm/amdgpu: fixx NULL pointer deref in gmc_v9_0_get_vm_pte We not only need to make sure that we have a BO, but also that the BO has some backing store. Fixes: d1a372af1c3d ("drm/amdgpu: Set MTYPE in PTE based on BO flags") Signed-off-by: Christian König Reviewed-by: Felix Kuehling Reviewed-by: Alex Deucher Reviewed-by: Luben Tuikov Signed-off-by: Alex Deucher commit 5011a110295d25418f5918a6af7bfcdb00dd4e34 Author: Uwe Kleine-König Date: Mon Dec 12 23:02:17 2022 +0100 thermal/drivers/imx_sc_thermal: Drop empty platform remove function A remove callback just returning 0 is equivalent to no remove callback at all. So drop the useless function. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20221212220217.3777176-1-u.kleine-koenig@pengutronix.de Signed-off-by: Daniel Lezcano commit 46a891e45be97c6781ac34f5ec777d69370e252b Author: Bjorn Andersson Date: Wed Mar 16 11:03:22 2022 -0700 thermal/drivers/qcom/lmh: Fix irq handler return value After enough invocations the LMh irq is eventually reported as bad, because the handler doesn't return IRQ_HANDLED, fix this. Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") Reported-by: Daniel Lezcano Signed-off-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220316180322.88132-1-bjorn.andersson@linaro.org Signed-off-by: Daniel Lezcano commit 4a9f20112c22cdcd6b81fafb18534a2a5a629a14 Author: Neil Armstrong Date: Wed Nov 16 11:09:50 2022 +0100 dt-bindings: thermal: qcom-tsens: Add compatible for sm8550 The Qualcomm SM8550 platform has three instances of the tsens block, add a compatible for these instances. Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Acked-by: Amit Kucheria Link: https://lore.kernel.org/r/20221114-narmstrong-sm8550-upstream-tsens-v1-0-0e169822830f@linaro.org Signed-off-by: Daniel Lezcano commit 33dc955c5a2795f17ff81751563836d498ac794f Author: Minghao Chi Date: Thu Nov 17 14:09:52 2022 +0800 thermal/drivers/st: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Minghao Chi Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202211171409524332954@zte.com.cn Signed-off-by: Daniel Lezcano commit bf438ed026199ff0182408d8592b6c11382d1a51 Author: Lad Prabhakar Date: Tue Nov 15 12:16:29 2022 +0000 dt-bindings: thermal: rzg2l-thermal: Document RZ/Five SoC The TSU block on the RZ/Five SoC is identical to one found on the RZ/G2UL SoC. "renesas,r9a07g043-tsu" compatible string will be used on the RZ/Five SoC so to make this clear, update the comment to include RZ/Five SoC. No driver changes are required as generic compatible string "renesas,rzg2l-tsu" will be used as a fallback on RZ/Five SoC. Signed-off-by: Lad Prabhakar Acked-by: Rob Herring Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20221115121629.1181667-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Daniel Lezcano commit c4026d3e2578291016703cd75f3a6f786f60cd80 Author: Bryan Brattlof Date: Mon Oct 31 18:26:57 2022 -0500 dt-bindings: thermal: k3-j72xx: conditionally require efuse reg range Only some of TI's J721E SoCs will need a eFuse register range mapped to determine if they're affected by TI's i2128 erratum. All other SoC will not need this eFuse range to function properly Update the bindings for the k3_j72xx_bandgap thermal driver so other devices will only need two register ranges Signed-off-by: Bryan Brattlof Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221031232702.10339-7-bb@ti.com Signed-off-by: Daniel Lezcano commit effe8db0a421480fc4dad0c7bf380b8e245cbb8c Author: Bryan Brattlof Date: Mon Oct 31 18:26:56 2022 -0500 dt-bindings: thermal: k3-j72xx: elaborate on binding description Elaborate on the function of this device node as well as some of the properties this node uses. Signed-off-by: Bryan Brattlof Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221031232702.10339-6-bb@ti.com Signed-off-by: Daniel Lezcano commit 366444ebe7e2e1c987c6a07551f06db4b5b7c0ad Author: Bryan Brattlof Date: Mon Oct 31 18:26:55 2022 -0500 thermal/drivers/k3_j72xx_bandgap: Map fuse_base only for erratum workaround Some of TI's J721E SoCs require a software trimming procedure for the temperature monitors to function properly. To determine if a particular J721E is not affected by this erratum, both bits in the WKUP_SPARE_FUSE0 region must be set. Other SoCs, not affected by this erratum, will not need this region. Map the 'fuse_base' region only when the erratum fix is needed. Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20221031232702.10339-5-bb@ti.com Signed-off-by: Daniel Lezcano commit 156f0e2fda420c4a4a7b244a909df04086039bd6 Author: Bryan Brattlof Date: Mon Oct 31 18:26:54 2022 -0500 thermal/drivers/k3_j72xx_bandgap: Remove fuse_base from structure 'fuse_base' is only needed during the initial probe function to provide data for a software trimming method for some of TI's devices affected by the i2128 erratum. The devices not affected will not use this region Remove fuse_base from the main k3_j72xx_bandgap structure Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20221031232702.10339-4-bb@ti.com Signed-off-by: Daniel Lezcano commit 311f328ffc7572219bee65db77645e5fedd4e8e6 Author: Bryan Brattlof Date: Mon Oct 31 18:26:53 2022 -0500 thermal/drivers/k3_j72xx_bandgap: Use bool for i2128 erratum flag Some of TI's J721E SoCs require a software trimming method to report temperatures accurately. Currently we are using a few different data types to indicate when we should apply the erratum. Change the 'workaround_needed' variable's data type to a bool to align with how we are using this variable currently. Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20221031232702.10339-3-bb@ti.com Signed-off-by: Daniel Lezcano commit 46cab93ab49f303a7abbcf920cf9ef95d02a113c Author: Bryan Brattlof Date: Mon Oct 31 18:26:52 2022 -0500 thermal/drivers/k3_j72xx_bandgap: Simplify k3_thermal_get_temp() function The k3_thermal_get_temp() function can be simplified to return only the result of k3_bgp_read_temp() without needing the 'ret' variable Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20221031232702.10339-2-bb@ti.com Signed-off-by: Daniel Lezcano commit 2baad2496383c6036bdb0945ef8aa6b1a5d18c19 Author: Manivannan Sadhasivam Date: Sat Oct 29 10:59:33 2022 +0530 thermal/drivers/qcom: Demote error log of thermal zone register to debug devm_thermal_of_zone_register() can fail with -ENODEV if thermal zone for the channel is not represented in DT. This is perfectly fine since not all sensors needs to be used for thermal zones but only a few in real world. So demote the error log to debug to avoid spamming users. Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20221029052933.32421-1-manivannan.sadhasivam@linaro.org Signed-off-by: Daniel Lezcano commit 8763f8acbf8aef22a2321d4c978cd078aa3b8f64 Author: Luca Weiss Date: Thu Oct 20 16:52:37 2022 +0200 thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 On gen2 chips the stage2 threshold is not 140 degC but 125 degC. Make the warning message clearer by using this variable and also by including the temperature that was checked for. Fixes: aa92b3310c55 ("thermal/drivers/qcom-spmi-temp-alarm: Add support for GEN2 rev 1 PMIC peripherals") Signed-off-by: Luca Weiss Reviewed-by: Amit Kucheria Link: https://lore.kernel.org/r/20221020145237.942146-1-luca.weiss@fairphone.com Signed-off-by: Daniel Lezcano commit fa17c4136db0bc91e698bd227cb478c648863d11 Author: Krzysztof Kozlowski Date: Wed Nov 16 12:31:40 2022 +0100 dt-bindings: thermal: qcom-tsens: narrow interrupts for SC8280XP, SM6350 and SM8450 Narrow number of interrupts per variants: SC8280XP, SM6350 and SM8450. The compatibles are already used and described. They only missed the constraints of number of interrupts. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221116113140.69587-1-krzysztof.kozlowski@linaro.org Signed-off-by: Daniel Lezcano commit de04f680b0ab71d2b9085903fe608a15541f66cb Author: Christophe JAILLET Date: Sat Nov 26 11:42:25 2022 +0100 thermal/core/power allocator: Remove a useless include This file does not use rcu, so there is no point in including . Remove it. Signed-off-by: Christophe JAILLET Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/9adeec47cb5a8193016272d5c8bf936235c1711d.1669459337.git.christophe.jaillet@wanadoo.fr Signed-off-by: Daniel Lezcano commit de95d1341a3e682b95ad759bd58b86224819fbec Author: Alexander Stein Date: Tue Jul 26 14:23:31 2022 +0200 thermal/drivers/imx8mm: Add hwmon support Expose thermal sensors as HWMON devices. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20220726122331.323093-1-alexander.stein@ew.tq-group.com Signed-off-by: Daniel Lezcano commit 6f8941646234e2d6e589377aea0dd1ba52365623 Author: Johan Hovold Date: Wed Nov 2 16:26:30 2022 +0100 thermal: qcom-spmi-adc-tm5: suppress probe-deferral error message Drivers should not be logging errors on probe deferral. Switch to using dev_err_probe() to log failures when parsing the devicetree to avoid errors like: qcom-spmi-adc-tm5 c440000.spmi:pmic@0:adc-tm@3400: get dt data failed: -517 when a channel is not yet available. Signed-off-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Reviewed-by: Andrew Halaney Link: https://lore.kernel.org/r/20221102152630.696-1-johan+linaro@kernel.org Signed-off-by: Daniel Lezcano commit c464856e63a4c9631add6a27340bd94beb9eb27f Author: Daniel Golle Date: Wed Nov 30 13:20:38 2022 +0000 dt-bindings: thermal: mediatek: add compatible string for MT7986 and MT7981 SoC Document compatible string 'mediatek,mt7986-thermal' for V3 thermal unit found in MT7986 SoCs. 'mediatek,mt7981-thermal' is also added as it is identical with the thermal unit of MT7986. Signed-off-by: Daniel Golle Acked-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano commit 3f9cb57962bcfad88bcac750f85ef7425475b102 Author: Geert Uytterhoeven Date: Mon Nov 21 16:47:10 2022 +0100 thermal: ti-soc-thermal: Drop comma after SoC match table sentinel It does not make sense to have a comma after a sentinel, as any new elements must be added before the sentinel. Signed-off-by: Geert Uytterhoeven Acked-by: Keerthy Link: https://lore.kernel.org/r/1d6de2a80b919cb11199e56ac06ad21c273ebe57.1669045586.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano commit 403291648823f819f7baaccd47589fcf87187c32 Author: Marek Vasut Date: Fri Dec 2 17:23:53 2022 +0100 thermal/drivers/imx: Add support for loading calibration data from OCOTP The TMU TASR, TCALIVn, TRIM registers must be explicitly programmed with calibration values in OCOTP. Add support for reading the OCOTP calibration data and programming those into the TMU hardware. The MX8MM/MX8MN TMUv1 uses only one OCOTP cell, while MX8MP TMUv2 uses 4, the programming differs in each case. Based on U-Boot commits: 70487ff386c ("imx8mm: Load fuse for TMU TCALIV and TASR") ebb9aab318b ("imx: load calibration parameters from fuse for i.MX8MP") Reviewed-by: Peng Fan Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano commit 8848c0d7a0782c263a7827697d5acfcc09a19a5f Author: Marek Vasut Date: Fri Dec 2 17:23:49 2022 +0100 dt-bindings: thermal: imx8mm-thermal: Document optional nvmem-cells The TMU TASR, TCALIVn, TRIM registers must be explicitly programmed with calibration values from OCOTP. Document optional phandle to OCOTP nvmem provider. Acked-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano commit 89992d95ed1046338c7866ef7bbe6de543a2af91 Author: Christian Marangi Date: Sat Oct 22 14:56:57 2022 +0200 thermal/drivers/qcom/tsens: Rework debugfs file structure The current tsens debugfs structure is composed by: - a tsens dir in debugfs with a version file - a directory for each tsens istance with sensors file to dump all the sensors value. This works on the assumption that we have the same version for each istance but this assumption seems fragile and with more than one tsens istance results in the version file not tracking each of them. A better approach is to just create a subdirectory for each tsens istance and put there version and sensors debugfs file. Using this new implementation results in less code since debugfs entry are created only on successful tsens probe. Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20221022125657.22530-4-ansuelsmth@gmail.com Signed-off-by: Daniel Lezcano commit c7e077e921fa94e0c06c8d14af6c0504c8a5f4bd Author: Christian Marangi Date: Sat Oct 22 14:56:56 2022 +0200 thermal/drivers/qcom/tsens: Fix wrong version id dbg_version_show For VER_0 the version was incorrectly reported as 0.1.0. Fix that and correctly report the major version for this old tsens revision. Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20221022125657.22530-3-ansuelsmth@gmail.com Signed-off-by: Daniel Lezcano commit de48d8766afcd97d147699aaff78a338081c9973 Author: Christian Marangi Date: Sat Oct 22 14:56:55 2022 +0200 thermal/drivers/qcom/tsens: Init debugfs only with successful probe Calibrate and tsens_register can fail or PROBE_DEFER. This will cause a double or a wrong init of the debugfs information. Init debugfs only with successful probe fixing warning about directory already present. Signed-off-by: Christian Marangi Acked-by: Thara Gopinath Link: https://lore.kernel.org/r/20221022125657.22530-2-ansuelsmth@gmail.com Signed-off-by: Daniel Lezcano commit 6840455debd38ea82b1f9fbbf8019944da36f7eb Author: Robert Marko Date: Fri Aug 19 00:02:44 2022 +0200 thermal/drivers/tsens: Add IPQ8074 support Qualcomm IPQ8074 uses tsens v2.3 IP, however unlike other tsens v2 IP it only has one IRQ, that is used for up/low as well as critical. It also does not support negative trip temperatures. Signed-off-by: Robert Marko Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220818220245.338396-4-robimarko@gmail.com Signed-off-by: Daniel Lezcano commit f63baced3839f591db76c227e09d47001373d6db Author: Robert Marko Date: Fri Aug 19 00:02:43 2022 +0200 thermal/drivers/tsens: Allow configuring min and max trips IPQ8074 and IPQ6018 dont support negative trip temperatures and support up to 204 degrees C as the max trip temperature. So, instead of always setting the -40 as min and 120 degrees C as max allow it to be configured as part of the features. Signed-off-by: Robert Marko Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220818220245.338396-3-robimarko@gmail.com Signed-off-by: Daniel Lezcano commit 4360af35273b742ffc6605ce44f37ac654272443 Author: Robert Marko Date: Fri Aug 19 00:02:42 2022 +0200 thermal/drivers/tsens: Add support for combined interrupt Despite using tsens v2.3 IP, IPQ8074 and IPQ6018 only have one IRQ for signaling both up/low and critical trips. Signed-off-by: Robert Marko Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220818220245.338396-2-robimarko@gmail.com Signed-off-by: Daniel Lezcano commit c6db32ec7c600ae7ab92eb6c56a9fb2918fcd780 Author: Robert Marko Date: Fri Aug 19 00:02:41 2022 +0200 dt-bindings: thermal: tsens: Add ipq8074 compatible Qualcomm IPQ8074 has tsens v2.3.0 block, though unlike existing v2 IP it only uses one IRQ, so tsens v2 compatible cannot be used as the fallback. We also have to make sure that correct interrupts are set according to compatibles, so populate interrupt information per compatibles. Signed-off-by: Robert Marko Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220818220245.338396-1-robimarko@gmail.com Signed-off-by: Daniel Lezcano commit 7ef2f023c2c77a452ba5d0c9b1ad04a5a895d553 Author: Ido Schimmel Date: Thu Oct 20 13:36:58 2022 +0300 thermal/of: Fix memory leak on thermal_of_zone_register() failure The function does not free 'of_ops' upon failure, leading to a memory leak [1]. Fix by freeing 'of_ops' in the error path. [1] unreferenced object 0xffff8ee846198c80 (size 128): comm "swapper/0", pid 1, jiffies 4294699704 (age 70.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ d0 3f 6e 8c ff ff ff ff 00 00 00 00 00 00 00 00 .?n............. backtrace: [<00000000d136f562>] __kmalloc_node_track_caller+0x42/0x120 [<0000000063f31678>] kmemdup+0x1d/0x40 [<00000000e6d24096>] thermal_of_zone_register+0x49/0x520 [<000000005e78c755>] devm_thermal_of_zone_register+0x54/0x90 [<00000000ee6b209e>] pmbus_add_sensor+0x1b4/0x1d0 [<00000000896105e3>] pmbus_add_sensor_attrs_one+0x123/0x440 [<0000000049e990a6>] pmbus_add_sensor_attrs+0xfe/0x1d0 [<00000000466b5440>] pmbus_do_probe+0x66b/0x14e0 [<0000000084d42285>] i2c_device_probe+0x13b/0x2f0 [<0000000029e2ae74>] really_probe+0xce/0x2c0 [<00000000692df15c>] driver_probe_device+0x19/0xd0 [<00000000547d9cce>] __device_attach_driver+0x6f/0x100 [<0000000020abd24b>] bus_for_each_drv+0x76/0xc0 [<00000000665d9563>] __device_attach+0xfc/0x180 [<000000008ddd4d6a>] bus_probe_device+0x82/0xa0 [<000000009e61132b>] device_add+0x3fe/0x920 Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") Signed-off-by: Ido Schimmel Reviewed-by: Vadim Pasternak Link: https://lore.kernel.org/r/20221020103658.802457-1-idosch@nvidia.com Signed-off-by: Daniel Lezcano commit a7c42af78b19a11e98a5555a664c343e3a672632 Author: Keerthy Date: Mon Oct 10 09:11:26 2022 +0530 thermal/drivers/k3_j72xx_bandgap: Fix the debug print message The debug print message to check the workaround applicability is inverted. Fix the same. Fixes: ffcb2fc86eb7 ("thermal: k3_j72xx_bandgap: Add the bandgap driver support") Reported-by: Bryan Brattlof Signed-off-by: Keerthy Link: https://lore.kernel.org/r/20221010034126.3550-1-j-keerthy@ti.com Signed-off-by: Daniel Lezcano commit 87f9fe8c4b603bd18f025d8c5fc9bb5f17b9a4cc Author: Rob Herring Date: Tue Oct 11 12:52:35 2022 -0500 dt-bindings: thermal: Convert generic-adc-thermal to DT schema Convert the 'generic-adc-thermal' binding to DT schema format. The binding said '#thermal-sensor-cells' should be 1, but all in tree users are 0 and 1 doesn't make sense for a single channel. Drop the example's related providers and consumers of the 'generic-adc-thermal' node as the convention is to not have those in the examples. Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221011175235.3191509-1-robh@kernel.org Signed-off-by: Daniel Lezcano commit d37edc7370273306d8747097fafa62436c1cfe16 Author: Marcus Folkesson Date: Fri Oct 14 09:35:07 2022 +0200 thermal/drivers/imx8mm_thermal: Validate temperature range Check against the upper temperature limit (125 degrees C) before consider the temperature valid. Fixes: 5eed800a6811 ("thermal: imx8mm: Add support for i.MX8MM thermal monitoring unit") Signed-off-by: Marcus Folkesson Reviewed-by: Jacky Bai Link: https://lore.kernel.org/r/20221014073507.1594844-1-marcus.folkesson@gmail.com Signed-off-by: Daniel Lezcano commit 1f455f144fb05e53ae47f84eb109a8021fe168d1 Author: Marcus Folkesson Date: Fri Oct 14 10:16:20 2022 +0200 thermal/drivers/imx8mm_thermal: Use GENMASK() when appropriate GENMASK() is preferred to use for bitmasks. Signed-off-by: Marcus Folkesson Link: https://lore.kernel.org/r/20221014081620.1599511-1-marcus.folkesson@gmail.com Signed-off-by: Daniel Lezcano commit f0f4c3adcfe6d93508a7fbe241b115aa5b24fe36 Author: Luca Weiss Date: Sun Oct 16 11:00:34 2022 +0200 dt-bindings: thermal: tsens: Add sm8450 compatible Document the tsens-v2 compatible for sm8450 SoC. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221016090035.565350-5-luca@z3ntu.xyz Signed-off-by: Daniel Lezcano commit 3b553e0041a65e499fa4e25ee146f01f4ec4e617 Author: Christophe Leroy Date: Wed Dec 14 14:41:33 2022 +0100 spi: fsl_spi: Don't change speed while chipselect is active Commit c9bfcb315104 ("spi_mpc83xx: much improved driver") made modifications to the driver to not perform speed changes while chipselect is active. But those changes where lost with the convertion to tranfer_one. Previous implementation was allowing speed changes during message transfer when cs_change flag was set. At the time being, core SPI does not provide any feature to change speed while chipselect is off, so do not allow any speed change during message transfer, and perform the transfer setup in prepare_message in order to set correct speed while chipselect is still off. Reported-by: Herve Codina Fixes: 64ca1a034f00 ("spi: fsl_spi: Convert to transfer_one") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Tested-by: Herve Codina Reviewed-by: Herve Codina Link: https://lore.kernel.org/r/8aab84c51aa330cf91f4b43782a1c483e150a4e3.1671025244.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit caec54705adb73b0015bce4dc781e0d19a91ff18 Author: Ian Rogers Date: Tue Dec 13 15:26:47 2022 -0800 perf build: Fix python/perf.so library's name Since Python 3.3 extensions have a suffix encoding platform and version information. For example, the perf extension was previously perf.so but now maybe perf.cpython-310-x86_64-linux-gnu.so. Compute the extension using Python and then use this in the target name. Doing this avoids the "perf.so" target always being rebuilt. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Andi Kleen Cc: Anshuman Khandual Cc: Athira Jajeev Cc: Eelco Chaudron Cc: German Gomez Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Kim Phillips Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sandipan Das Cc: Sean Christopherson Cc: Shaomin Deng Cc: Stephane Eranian Cc: Timothy Hayes Cc: Xing Zhengjun Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213232651.1269909-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9440ebdc333dd12e2344aec8fd3fb7d440f9463c Author: James Clark Date: Tue Dec 13 11:47:39 2022 +0000 perf test arm64: Add attr tests for new VG register Ensure that the availability of the VG register behaves as expected depending on the kernel version and SVE support. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213114739.2312862-5-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ee26adf627e65c8e26b13aa35d5de1875973114f Author: James Clark Date: Tue Dec 13 11:47:38 2022 +0000 perf test: Add mechanism for skipping attr tests on kernel versions The first two version numbers are used since that is where the ABI changes happen, so seems to be the most useful for now. 'Until' is exclusive and 'since' is inclusive so that the same version number can be used to mark a point where the change comes into effect. This allows keeping the tests in a state where new tests will also pass on older kernels if the existence of a new feature isn't explicitly broadcast by the kernel. For example extended user regs are currently discovered by trial and error calls to perf_event_open. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213114739.2312862-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit c3a8f85351b15167d6c8d178656df82ba3c34712 Author: James Clark Date: Tue Dec 13 11:47:37 2022 +0000 perf test: Add mechanism for skipping attr tests on auxiliary vector values This can be used to skip tests or provide different test values on different platforms. For example to run a test only where Arm SVE is present add this to the config section: auxv = auxv["AT_HWCAP"] & 0x200000 == 0x200000 The value is a freeform Python expression that is evaled in the context of a map called "auxv" that contains the decoded auxiliary vector. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213114739.2312862-3-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit a8f26192ca769c6b37a04b3ee188f28069fd5d53 Author: James Clark Date: Tue Dec 13 11:47:36 2022 +0000 perf test: Add ability to test exit code for attr tests Currently the return value is used to skip the test, but sometimes it can be useful to test if a certain command should return a certain exit code. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221213114739.2312862-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit e8478b84d6ba9ccfac15dfce103062c4fa7ded2f Author: Petar Gligoric Date: Tue Dec 6 10:44:06 2022 -0500 perf test: add new task-analyzer tests Provide task-analyzer test cases for all possible arguments and a subset of possible combinations. 12 Tests in total. test_basic: - cmd:"perf script report task-analyzer" - Fundamental test of script without arguments. - Check for standard output. test_ns_rename: - cmd:"perf script report task-analyzer --ns --rename-comms-by-tids 0:random" - Standard task with timestamps in nanoseconds and comm renamed. - Check for standard output. test_ms_filtertasks_highlight: - cmd:"perf script report task-analyzer --ms --filter-tasks perf --highlight-tasks perf" - Standard task with timestamps in milliseconds, task filtered out and highlighted. - Check for standard output. test_extended_times_timelimit_limittasks: - cmd "perf script report task-analyzer --extended-times --time-limit :99999" - Standard task with additional schedule out/in info and timlimit active at 99999. - Check for extended table output. test_summary: - cmd:"perf script report task-analyzer --summary" - Standard task with additional summary output. - Check for summary print. test_summary_extended: - cmd:"perf script report task-analyzer --summary-extended" - Standard task with summary and additional schedule in/out info. - Chceck for extended table print. test_summaryonly: - cmd:"perf script report task-analyzer --summary-only" - Only summary should be printed. - Check for summary print. test_extended_times_summary_ns: - cmd:"perf script report task-analyzer --extended-times --summary --ns" - Standard task with extended schedule in/out information and summary in ns. - Check for extended table and summary. test_csv: - cmd:"perf script report task-analyzer --csv csv" - Print standard task to csv file in csv format. - Check for csv format. test_csv_extended_times: - cmd:"perf script report task-analyzer --csv csv --extended-times" - Print standard task to csv file in csv format with additional schedule in/out information. - Check for additional information and csv format. test_csvsummary: - cmd:"perf script report task-analyzer --csv-summary csvsummary" - Print summary to csvsummary file in csv format. - Check for csv format. test_csvsummary_extended: - cmd:"perf script report task-analyzer --csv-summary csvsummary --summary-extended" - Print summary to csvsummary file in csv format with additional schedule in/out information. - Check for additional information and csv format. Suggested-by: Ian Rogers Signed-off-by: Petar Gligoric Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20221206154406.41941-4-petar.gligor@gmail.com Signed-off-by: Hagen Paul Pfeifer Signed-off-by: Arnaldo Carvalho de Melo commit fdd0f81f0528d55d4362d072c6d6ecc7ecd61def Author: Petar Gligoric Date: Tue Dec 6 10:44:05 2022 -0500 perf script: task-analyzer add csv support This patch adds the possibility to write the trace and the summary as csv files to a user specified file. A format as such simplifies further data processing. This is achieved by having ";" as separators instead of spaces and solely one header per file. Additional parameters are being considered, like in the normal usage of the script. Colors are turned off in the case of a csv output, thus the highlight option is also being ignored. Usage: Write standard task to csv file: $ perf script report tasks-analyzer --csv write limited output to csv file in nanoseconds: $ perf script report tasks-analyzer --csv --ns --limit-to-tasks 1337 Write summary to a csv file: $ perf script report tasks-analyzer --csv-summary Write summary to csv file with additional schedule information: $ perf script report tasks-analyzer --csv-summary --summary-extended Write both summary and standard task to a csv file: $ perf script report tasks-analyzer --csv --csv-summary The following examples illustrate what is possible with the CSV output. The first command sequence will record all scheduler switch events for 10 seconds, the task-analyzer calculates task information like runtimes as CSV. A small python snippet using pandas and matplotlib will visualize the most frequent task (e.g. kworker/1:1) runtimes - each runtime as a bar in a bar chart: $ perf record -e sched:sched_switch -a -- sleep 10 $ perf script report tasks-analyzer --ns --csv tasks.csv $ cat << EOF > /tmp/freq-comm-runtimes-bar.py import pandas as pd import matplotlib.pyplot as plt df = pd.read_csv("tasks.csv", sep=';') most_freq_comm = df["COMM"].value_counts().idxmax() most_freq_runtimes = df[df["COMM"]==most_freq_comm]["Runtime"] plt.title(f"Runtimes for Task {most_freq_comm} in Nanoseconds") plt.bar(range(len(most_freq_runtimes)), most_freq_runtimes) plt.show() $ python3 /tmp/freq-comm-runtimes-bar.py As a seconds example, the subsequent script generates a pie chart of all accumulated tasks runtimes for 10 seconds of system recordings: $ perf record -e sched:sched_switch -a -- sleep 10 $ perf script report tasks-analyzer --csv-summary task-summary.csv $ cat << EOF > /tmp/accumulated-task-pie.py import pandas as pd from matplotlib.pyplot import pie, axis, show df = pd.read_csv("task-summary.csv", sep=';') sums = df.groupby(df["Comm"])["Accumulated"].sum() axis("equal") pie(sums, labels=sums.index); show() EOF $ python3 /tmp/accumulated-task-pie.py A variety of other visualizations are possible in matplotlib and other environments. Of course, pandas, numpy and co. also allow easy statistical analysis of the data! Signed-off-by: Petar Gligoric Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20221206154406.41941-3-petar.gligor@gmail.com Signed-off-by: Hagen Paul Pfeifer Signed-off-by: Arnaldo Carvalho de Melo commit e76aff0523f7d3393f967bc13b10bb04b759abfa Author: Hagen Paul Pfeifer Date: Tue Dec 6 10:44:04 2022 -0500 perf script: Introduce task analyzer python script Introduce a new 'perf script' to analyze task scheduling behavior. During the task analysis, some data is always needed - which goes beyond the simple time of switching on and off a task (process/thread). This concerns for example the runtime of a process or the frequency with which the process was called. This script serves to simplify this recurring analyze process. It immediately provides the user with helpful task characteristic information about the tasks runtimes. Usage: Recorded can be in two ways: $ perf script record tasks-analyzer -- sleep 10 $ perf record -e sched:sched_switch -a -- sleep 10 The script can parse all perf.data files, most important: sched:sched_switch events are mandatory, other events will be ignored. Most simple report use case is to just call the script without arguments: $ perf script report tasks-analyzer Switched-In Switched-Out CPU PID TID Comm Runtime Time Out-In 15576.658891407 15576.659156086 4 2412 2428 gdbus 265 1949 15576.659111320 15576.659455410 0 2412 2412 gnome-shell 344 2267 15576.659491326 15576.659506173 2 74 74 kworker/2:1 15 13145 15576.659506173 15576.659825748 2 2858 2858 gnome-terminal- 320 63263 15576.659871270 15576.659902872 6 20932 20932 kworker/u16:0 32 2314582 15576.659909951 15576.659945501 3 27264 27264 sh 36 -1 15576.659853285 15576.659971052 7 27265 27265 perf 118 5050741 [...] What is not shown here are the ASCII color sequences. For example, if the task consists of only one thread, the TID is grayed out. Runtime is the time the task was running on the CPU, Time Out-In is the time between the process being scheduled *out* and scheduled back *in*. So the last time span between two executions. If -1 is printed, then the task simply ran the first time in the measurements - a Out-In delta could not be calculated. In addition to the chronological representation, there is a summary on task level. This output can be additionally switched on via the --summary option and provides information such as max, min & average runtime per process. The maximum runtime is often important for debugging. The call looks like this: $ perf script report tasks-analyzer --summary Summary Task Information Runtime Information PID TID Comm Runs Accumulated Mean Median Min Max Max At 14 14 ksoftirqd/0 13 334 26 15 9 127 15571.621211956 15 15 rcu_preempt 133 1778 13 13 2 33 15572.581176024 16 16 migration/0 3 49 16 13 12 24 15571.608915425 20 20 migration/1 3 34 11 13 8 13 15571.639101555 25 25 migration/2 3 32 11 12 9 12 15575.639239896 [...] Besides these two options, there are a number of other options that change the output and behavior. This can be queried via --help. Options worth mentioning include: - filter-tasks - filter out unneeded tasks, --filter-task 1337,/sbin/init - highlight-tasks - more pleasant focusing, --highlight-tasks 1:red,mutt:yellow - extended-times - show combinations of elapsed times between schedule in/schedule out - summary-extended - summary with additional information, like maximum delta time statistics - rename-comms-by-tids - handy for inexpressive processnames like python, --rename 1337:my-python-app - ms - show timestamps in milliseconds, nanoseconds is also possible (--ns) - time-limit - limit the analyzer to a time range, --time-limit 15576.0:15576.1 Script is tested and prime time ready for python2 & python3: - make PYTHON=python3 prefix=/usr/local install - make PYTHON=python2 prefix=/usr/local install Signed-off-by: Hagen Paul Pfeifer Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20221206154406.41941-2-petar.gligor@gmail.com Signed-off-by: Petar Gligoric Signed-off-by: Arnaldo Carvalho de Melo commit 55c1de9973d665161c1c0c146ff15c6884060e19 Author: James Clark Date: Mon Dec 12 15:55:13 2022 +0000 perf cs-etm: Print auxtrace info even if OpenCSD isn't linked Printing the info doesn't have any dependency on OpenCSD, and neither does recording Coresight data. Because it's sometimes useful to look at the info for debugging, it makes sense to be able to see it on the same platform that the recording was made on. So pull the auxtrace info printing parts into a new file that is always compiled into Perf. Signed-off-by: James Clark Cc: Al Grant Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20221212155513.2259623-6-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit fd63091f2a0317f8943c816acf3ac5f4002adf5c Author: James Clark Date: Mon Dec 12 15:55:12 2022 +0000 perf cs-etm: Cleanup cs_etm__process_auxtrace_info() hdr is a copy of 3 values of ptr and doesn't need to be long lived. So just use ptr instead which means the malloc and the extra error path can be removed to simplify things. Signed-off-by: James Clark Cc: Al Grant Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20221212155513.2259623-5-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit b00204f5c21ca1bd38b8cb45d12a605b4e60a884 Author: James Clark Date: Mon Dec 12 15:55:11 2022 +0000 perf cs-etm: Tidy up auxtrace info header printing cs_etm__print_auxtrace_info() is called twice in case there is an error somewhere in cs_etm__process_auxtrace_info(), but all the info is already available at the beginning so just print it there instead. Also use u64 and the already cast ptr variable to make it more consistent with the rest of the etm code. Signed-off-by: James Clark Cc: Al Grant Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20221212155513.2259623-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit fe55ba183264d40d44bfbe71deb148ff64f2ea2d Author: James Clark Date: Mon Dec 12 15:55:10 2022 +0000 perf cs-etm: Remove unused stub methods These aren't used outside of cs-etm so don't need stubs. Leave cs_etm__process_auxtrace_info() which is used externally, and add an error message so that it's obvious to users why it causes errors. Signed-off-by: James Clark Cc: Al Grant Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20221212155513.2259623-3-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ab6bd55e9968ff063c0ee28f8941903811dee09a Author: James Clark Date: Mon Dec 12 15:55:09 2022 +0000 perf cs-etm: Print unknown header version as an error This is an error rather than just for the raw trace dump so always print it as an error. Also remove the duplicate header version check. Signed-off-by: James Clark Cc: Al Grant Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20221212155513.2259623-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 22ddcb6b4a62eb97f7d988ac59032b74c64afb20 Author: Namhyung Kim Date: Fri Dec 9 11:07:27 2022 -0800 perf test: Update perf lock contention test Add test cases for the task and addr aggregation modes. $ sudo ./perf test -v contention 86: kernel lock contention analysis test : --- start --- test child forked, pid 680006 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr test child finished with 0 ---- end ---- kernel lock contention analysis test: Ok Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221209190727.759804-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 688d2e8de231c54e289b640547af246343732348 Author: Namhyung Kim Date: Fri Dec 9 11:07:26 2022 -0800 perf lock contention: Add -l/--lock-addr option The -l/--lock-addr option is to implement per-lock-instance contention stat using LOCK_AGGR_ADDR. It displays lock address and optionally symbol name if exists. $ sudo ./perf lock con -abl sleep 1 contended total wait max wait avg wait address symbol 1 36.28 us 36.28 us 36.28 us ffff92615d6448b8 9 10.91 us 1.84 us 1.21 us ffffffffbaed50c0 rcu_state 1 10.49 us 10.49 us 10.49 us ffff9262ac4f0c80 8 4.68 us 1.67 us 585 ns ffffffffbae07a40 jiffies_lock 3 3.03 us 1.45 us 1.01 us ffff9262277861e0 1 924 ns 924 ns 924 ns ffff926095ba9d20 1 436 ns 436 ns 436 ns ffff9260bfda4f60 Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221209190727.759804-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit eca949b2b4addd941d369d4c2014b87f3c3e203b Author: Namhyung Kim Date: Fri Dec 9 11:07:25 2022 -0800 perf lock contention: Implement -t/--threads option for BPF The BPF didn't show the per-thread stat properly. Use task's thread id (PID) as a key instead of stack_id and add a task_data map to save task comm names. $ sudo ./perf lock con -abt -E 5 sleep 1 contended total wait max wait avg wait pid comm 1 740.66 ms 740.66 ms 740.66 ms 1950 nv_queue 3 305.50 ms 298.19 ms 101.83 ms 1884 nvidia-modeset/ 1 25.14 us 25.14 us 25.14 us 2725038 EventManager_De 12 23.09 us 9.30 us 1.92 us 0 swapper 1 20.18 us 20.18 us 20.18 us 2725033 EventManager_De Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221209190727.759804-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fd507d3e359c7e06d74321cd3d8a5ec8769d05a9 Author: Namhyung Kim Date: Fri Dec 9 11:07:24 2022 -0800 perf lock contention: Add lock_data.h for common data Accessing BPF maps should use the same data types. Add bpf_skel/lock_data.h to define the common data structures. No functional changes. Committer notes: Fixed contention_key.stack_id missing rename to contention_key.stack_or_task_id. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Blake Jones Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20221209190727.759804-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3cad53a6f9cdbafa32ea8413809f23a28734c7c5 Author: Khem Raj Date: Sun Dec 4 18:55:34 2022 -0800 perf python: Account for multiple words in CC Sometimes build systems may append options e.g. --sysroot etc. to CC variable especially in cross-compile environments like yocto project where CC varable is composed of cross-compiler name and some needed options for it to work in a relocatable environment. Therefore separate out the compiler name from rest of the options in CC, then add the options via second argument to Popen() API Reviewed-by: Florian Fainelli Signed-off-by: Khem Raj Cc: Adrian Hunter Cc: Fangrui Song Cc: Florian Fainelli Cc: Ian Rogers Cc: Jiri Olsa Cc: John Keeping Cc: Leo Yan Cc: Michael Petlan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Sedat Dilek Link: https://lore.kernel.org/r/20221205025534.150006-1-raj.khem@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 167b266bf66c5b93171011ef9d1f09b070c2c537 Author: Namhyung Kim Date: Thu Dec 8 10:26:36 2022 -0800 perf off_cpu: Fix a typo in BTF tracepoint name, it should be 'btf_trace_sched_switch' In BTF, tracepoint definitions have the "btf_trace_" prefix. The off-cpu profiler needs to check the signature of the sched_switch event using that definition. But there's a typo (s/bpf/btf/) so it failed always. Fixes: b36888f71c8542cd ("perf record: Handle argument change in sched_switch") Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: bpf@vger.kernel.org Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20221208182636.524139-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 232b82d201cbade4f15e243bc0472ac241239d8c Author: Athira Rajeev Date: Wed Dec 7 22:28:15 2022 +0530 perf test: Update event group check for support of uncore event The event group test checks group creation for combinations of hw, sw and uncore PMU events. Some of the uncore pmus may require additional permission to access the counters. For example, in case of hv_24x7, partition need to have permissions to access hv_24x7 pmu counters. If not, event_open will fail. Hence add a sanity check to see if event_open succeeds before proceeding with the test. Fixes: 9d9b22bedad13d96 ("perf test: Add event group test for events in multiple PMUs") Signed-off-by: Athira Jajeev Acked-by: Ravi Bangoria Cc: Disha Goel Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: linuxppc-dev@lists.ozlabs.org Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20221207165815.774-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit b9a49f8cb02f08592054b953adcacecd59b7ae4b Author: Arnaldo Carvalho de Melo Date: Thu Dec 8 19:28:58 2022 -0300 perf tools: Check if libtracevent has TEP_FIELD_IS_RELATIVE Some distros have older versions of libtraceevent where TEP_FIELD_IS_RELATIVE and its associated semantics are not present, so we need to check if the version has it, it was introduced in libtraceevent 1.5.0. Reported-by: Athira Jajeev Tested-by: Athira Jajeev Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Desaulniers Cc: Peter Zijlstra , Cc: Stephane Eranian Signed-off-by: Arnaldo Carvalho de Melo commit 4171925aa9f3f7bf57b100238f148b50c45c3b1b Author: Ian Rogers Date: Tue Nov 29 22:29:35 2022 -0800 tools lib traceevent: Remove libtraceevent libtraceevent is now out-of-date and it is better to depend on the system version. Remove this code that is no longer depended upon by any builds. Committer notes: Removed the removed tools/lib/traceevent/ from tools/perf/MANIFEST, so that 'make perf-tar-src-pkg' works. Signed-off-by: Ian Rogers Acked-by: Steven Rostedt (VMware) Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20221130062935.2219247-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 378ef0f5d9d7f4652d7a40e0711e8b845ada1cbd Author: Ian Rogers Date: Mon Dec 5 14:59:39 2022 -0800 perf build: Use libtraceevent from the system Remove the LIBTRACEEVENT_DYNAMIC and LIBTRACEFS_DYNAMIC make command line variables. If libtraceevent isn't installed or NO_LIBTRACEEVENT=1 is passed to the build, don't compile in libtraceevent and libtracefs support. This also disables CONFIG_TRACE that controls "perf trace". CONFIG_LIBTRACEEVENT is used to control enablement in Build/Makefiles, HAVE_LIBTRACEEVENT is used in C code. Without HAVE_LIBTRACEEVENT tracepoints are disabled and as such the commands kmem, kwork, lock, sched and timechart are removed. The majority of commands continue to work including "perf test". Committer notes: Fixed up a tools/perf/util/Build reject and added: #include to tools/perf/util/scripting-engines/trace-event-perl.c. Committer testing: $ rpm -qi libtraceevent-devel Name : libtraceevent-devel Version : 1.5.3 Release : 2.fc36 Architecture: x86_64 Install Date: Mon 25 Jul 2022 03:20:19 PM -03 Group : Unspecified Size : 27728 License : LGPLv2+ and GPLv2+ Signature : RSA/SHA256, Fri 15 Apr 2022 02:11:58 PM -03, Key ID 999f7cbf38ab71f4 Source RPM : libtraceevent-1.5.3-2.fc36.src.rpm Build Date : Fri 15 Apr 2022 10:57:01 AM -03 Build Host : buildvm-x86-05.iad2.fedoraproject.org Packager : Fedora Project Vendor : Fedora Project URL : https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/ Bug URL : https://bugz.fedoraproject.org/libtraceevent Summary : Development headers of libtraceevent Description : Development headers of libtraceevent-libs $ Default build: $ ldd ~/bin/perf | grep tracee libtraceevent.so.1 => /lib64/libtraceevent.so.1 (0x00007f1dcaf8f000) $ # perf trace -e sched:* --max-events 10 0.000 migration/0/17 sched:sched_migrate_task(comm: "", pid: 1603763 (perf), prio: 120, dest_cpu: 1) 0.005 migration/0/17 sched:sched_wake_idle_without_ipi(cpu: 1) 0.011 migration/0/17 sched:sched_switch(prev_comm: "", prev_pid: 17 (migration/0), prev_state: 1, next_comm: "", next_prio: 120) 1.173 :0/0 sched:sched_wakeup(comm: "", pid: 3138 (gnome-terminal-), prio: 120) 1.180 :0/0 sched:sched_switch(prev_comm: "", prev_prio: 120, next_comm: "", next_pid: 3138 (gnome-terminal-), next_prio: 120) 0.156 migration/1/21 sched:sched_migrate_task(comm: "", pid: 1603763 (perf), prio: 120, orig_cpu: 1, dest_cpu: 2) 0.160 migration/1/21 sched:sched_wake_idle_without_ipi(cpu: 2) 0.166 migration/1/21 sched:sched_switch(prev_comm: "", prev_pid: 21 (migration/1), prev_state: 1, next_comm: "", next_prio: 120) 1.183 :0/0 sched:sched_wakeup(comm: "", pid: 1602985 (kworker/u16:0-f), prio: 120, target_cpu: 1) 1.186 :0/0 sched:sched_switch(prev_comm: "", prev_prio: 120, next_comm: "", next_pid: 1602985 (kworker/u16:0-f), next_prio: 120) # Had to tweak tools/perf/util/setup.py to make sure the python binding shared object links with libtraceevent if -DHAVE_LIBTRACEEVENT is present in CFLAGS. Building with NO_LIBTRACEEVENT=1 uncovered some more build failures: - Make building of data-convert-bt.c to CONFIG_LIBTRACEEVENT=y - perf-$(CONFIG_LIBTRACEEVENT) += scripts/ - bpf_kwork.o needs also to be dependent on CONFIG_LIBTRACEEVENT=y - The python binding needed some fixups and util/trace-event.c can't be built and linked with the python binding shared object, so remove it in tools/perf/util/setup.py and exclude it from the list of dependencies in the python/perf.so Makefile.perf target. Building without libtraceevent-devel installed uncovered more build failures: - The python binding tools/perf/util/python.c was assuming that traceevent/parse-events.h was always available, which was the case when we defaulted to using the in-kernel tools/lib/traceevent/ files, now we need to enclose it under ifdef HAVE_LIBTRACEEVENT, just like the other parts of it that deal with tracepoints. - We have to ifdef the rules in the Build files with CONFIG_LIBTRACEEVENT=y to build builtin-trace.c and tools/perf/trace/beauty/ as we only ifdef setting CONFIG_TRACE=y when setting NO_LIBTRACEEVENT=1 in the make command line, not when we don't detect libtraceevent-devel installed in the system. Simplification here to avoid these two ways of disabling builtin-trace.c and not having CONFIG_TRACE=y when libtraceevent-devel isn't installed is the clean way. From Athira: tools/perf/arch/powerpc/util/Build -perf-y += kvm-stat.o +perf-$(CONFIG_LIBTRACEEVENT) += kvm-stat.o Then, ditto for arm64 and s390, detected by container cross build tests. - s/390 uses test__checkevent_tracepoint() that is now only available if HAVE_LIBTRACEEVENT is defined, enclose the callsite with ifder HAVE_LIBTRACEEVENT. Also from Athira: With this change, I could successfully compile in these environment: - Without libtraceevent-devel installed - With libtraceevent-devel installed - With “make NO_LIBTRACEEVENT=1” Then, finally rename CONFIG_TRACEEVENT to CONFIG_LIBTRACEEVENT for consistency with other libraries detected in tools/perf/. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Tested-by: Athira Rajeev Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephane Eranian Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20221205225940.3079667-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 40769665b63d8c84b5b1c63fee404d4c20cff751 Author: Ian Rogers Date: Tue Dec 6 21:59:08 2022 -0800 perf jevents: Parse metrics during conversion Currently the 'MetricExpr' json value is passed from the json file to the pmu-events.c. This change introduces an expression tree that is parsed into. The parsing is done largely by using operator overloading and python's 'eval' function. Two advantages in doing this are: 1) Broken metrics fail at compile time rather than relying on `perf test` to detect. `perf test` remains relevant for checking event encoding and actual metric use. 2) The conversion to a string from the tree can minimize the metric's string size, for example, preferring 1e6 over 1000000, avoiding multiplication by 1 and removing unnecessary whitespace. On x86 this reduces the string size by 2,930bytes (0.07%). In future changes it would be possible to programmatically generate the json expressions (a single line of text and so a pain to write manually) for an architecture using the expression tree. This could avoid copy-pasting metrics for all architecture variants. v4. Doesn't simplify "0*SLOTS" to 0, as the pattern is used to fix Intel metrics with topdown events. v3. Avoids generic types on standard types like set that aren't supported until Python 3.9, fixing an issue with Python 3.6 reported-by John Garry. v3 also fixes minor pylint issues and adds a call to Simplify on the read expression tree. v2. Improvements to type information. Committer notes: Added one-line fixer from Ian, see first Link: tag below. Signed-off-by: Ian Rogers Reviewed-by: John Garry Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Thomas Richter Link: https://lore.kernel.org/r/CAP-5=fWa=zNK_ecpWGoGggHCQx7z-oW0eGMQf19Maywg0QK=4g@mail.gmail.com Link: https://lore.kernel.org/r/20221207055908.1385448-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b897613510890d6e92b6a276a20f6c3d96fe90e8 Author: Namhyung Kim Date: Tue Dec 6 09:58:04 2022 -0800 perf stat: Update event skip condition for system-wide per-thread mode and merged uncore and hybrid events In print_counter_aggrdata(), it skips some events that has no aggregate count. It's actually for system-wide per-thread mode and merged uncore and hybrid events. Let's update the condition to check them explicitly. Fixes: 91f85f98da7ab8c3 ("perf stat: Display event stats using aggr counts") Reported-by: Athira Jajeev Signed-off-by: Namhyung Kim Acked-by: Athira Jajeev Cc: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221206175804.391387-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 616aa32d6f221faa0235d2586ec1706dca70a439 Author: Ian Rogers Date: Mon Dec 5 14:59:38 2022 -0800 perf build: Fixes for LIBTRACEEVENT_DYNAMIC If LIBTRACEEVENT_DYNAMIC is enabled then avoid the install step for the plugins. If disabled correct DESTDIR so that the plugins are installed under /traceevent/plugins. Fixes: ef019df01e207971 ("perf build: Install libtraceevent locally when building") Reported-by: Alexander Gordeev Signed-off-by: Ian Rogers Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20221205225940.3079667-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit cc2367eebb0c3c5501cddd5823e5feda7b57f706 Author: Arnaldo Carvalho de Melo Date: Tue Dec 6 13:49:04 2022 -0300 machine: Adopt is_lock_function() from builtin-lock.c It is used in bpf_lock_contention.c and builtin-lock.c will be made CONFIG_LIBTRACEEVENT=y conditional, so move it to machine.c, that is always available. This makes those 4 global variables for sched and lock text start and end to move to 'struct machine' too, as conceivably we can have that info for several machine instances, say some 'perf diff' like tool. Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephane Eranian Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/ Signed-off-by: Arnaldo Carvalho de Melo commit 9d9b22bedad13d96b34fe005ef44b4523c4eb786 Author: Ravi Bangoria Date: Tue Dec 6 10:02:37 2022 +0530 perf test: Add event group test for events in multiple PMUs Multiple events in a group can belong to one or more PMUs, however there are some limitations. One of the limitations is that perf doesn't allow creating a group of events from different hw PMUs. Write a simple test to create various combinations of hw, sw and uncore PMU events and verify group creation succeeds or fails as expected. Signed-off-by: Ravi Bangoria Acked-by: Ian Rogers Acked-by: Kan Liang Acked-by: Madhavan Srinivasan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Athira Jajeev Cc: Carsten Haitzler Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Cc: Thomas Richter Link: https://lore.kernel.org/r/20221206043237.12159-3-ravi.bangoria@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 336b92da1aa4228a664f27972f61e6186f369e79 Author: Ravi Bangoria Date: Tue Dec 6 10:02:36 2022 +0530 perf tool: Move pmus list variable to a new file The 'pmus' list variable is defined as static variable under pmu.c file. Introduce a new pmus.c file and migrate this variable to it. Also make it non static so that it can be accessed from outside. Suggested-by: Ian Rogers Signed-off-by: Ravi Bangoria Acked-by: Ian Rogers Acked-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Athira Jajeev Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Madhavan Srinivasan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Cc: Thomas Richter Cc: carsten.haitzler@arm.com Link: https://lore.kernel.org/r/20221206043237.12159-2-ravi.bangoria@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 5b7a29fb0b7d67e5d40cd6557e073afb6a7466ab Author: Ian Rogers Date: Tue Nov 29 22:29:33 2022 -0800 perf util: Add host_is_bigendian to util.h Avoid libtraceevent dependency for tep_is_bigendian or trace-event.h dependency for bigendian. Add a new host_is_bigendian to util.h, using the compiler defined __BYTE_ORDER__ when available. Committer notes: Added: #else /* !__BYTE_ORDER__ */ On that nested #ifdef block, as per Namhyung's suggestion. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Steven Rostedt (VMware) Link: https://lore.kernel.org/r/20221130062935.2219247-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit fce9a619145181ca6a41253f7de3df56b1e4ad59 Author: Ian Rogers Date: Tue Nov 29 22:29:32 2022 -0800 perf util: Make header guard consistent with tool Remove git reference by changing GIT_COMPAT_UTIL_H to __PERF_UTIL_H. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Steven Rostedt (VMware) Link: https://lore.kernel.org/r/20221130062935.2219247-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3f81f72d30b46efb614d93f430684c0deb8439b7 Author: James Clark Date: Wed Nov 30 11:15:21 2022 +0000 perf stat: Fix invalid output handle In this context, 'os' is already a pointer so the extra dereference isn't required. This fixes the following test failure on aarch64: $ ./perf test "json output" -vvv 92: perf stat JSON output linter : --- start --- Checking json output: no args Test failed for input: ... Fatal error: glibc detected an invalid stdio handle ---- end ---- perf stat JSON output linter: FAILED! Fixes: e7f4da312259e618 ("perf stat: Pass struct outstate to printout()") Signed-off-by: James Clark Tested-by: Athira Jajeev Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20221130111521.334152-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 117195d9f8af74c65bf57d9b56f496b5b3655bcb Author: Namhyung Kim Date: Fri Dec 2 11:04:47 2022 -0800 perf stat: Fix multi-line metric output in JSON When a metric produces more than one values, it missed to print the opening bracket. Fixes: ab6baaae27357290 ("perf stat: Fix JSON output in metric-only mode") Reported-by: Weilin Wang Signed-off-by: Namhyung Kim Tested-by: Weilin Wang Cc: Adrian Hunter Cc: Athira Jajeev Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20221202190447.1588680-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 113bb3964297467baeb1fd2c4f86d0a4142e4259 Author: Ian Rogers Date: Thu Dec 1 20:57:42 2022 -0800 tools lib symbol: Add dependency test to install_headers Compute the headers to be installed from their source headers and make each have its own build target to install it. Using dependencies avoids headers being reinstalled and getting a new timestamp which then causes files that depend on the header to be rebuilt. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20221202045743.2639466-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5d890591db6bed8ca69bd4bfe0cdaca372973033 Author: Ian Rogers Date: Thu Dec 1 20:57:41 2022 -0800 tools lib subcmd: Add dependency test to install_headers Compute the headers to be installed from their source headers and make each have its own build target to install it. Using dependencies avoids headers being reinstalled and getting a new timestamp which then causes files that depend on the header to be rebuilt. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20221202045743.2639466-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 47e02b94a4c98dcc8072e56efaae5057174050fa Author: Ian Rogers Date: Thu Dec 1 20:57:40 2022 -0800 tools lib perf: Add dependency test to install_headers Compute the headers to be installed from their source headers and make each have its own build target to install it. Using dependencies avoids headers being reinstalled and getting a new timestamp which then causes files that depend on the header to be rebuilt. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20221202045743.2639466-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1849f9f00926c54fa284be3b7f801de8b010572b Author: Ian Rogers Date: Thu Dec 1 20:57:39 2022 -0800 tools lib api: Add dependency test to install_headers Compute the headers to be installed from their source headers and make each have its own build target to install it. Using dependencies avoids headers being reinstalled and getting a new timestamp which then causes files that depend on the header to be rebuilt. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20221202045743.2639466-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8f4b1e3cebce5d12048409393de751e4d663ce42 Author: Athira Rajeev Date: Mon Dec 5 09:58:52 2022 +0530 perf stat: Fix printing field separator in CSV metrics output In 'perf stat' with CSV output option, number of fields in metrics output is not matching with number of fields in other event output lines. Sample output below after applying patch to fix printing os->prefix. # ./perf stat -x, --per-socket -a -C 1 ls S0,1,82.11,msec,cpu-clock,82111626,100.00,1.000,CPUs utilized S0,1,2,,context-switches,82109314,100.00,24.358,/sec ------ ====> S0,1,,,,,,,1.71,stalled cycles per insn The above command line uses field separator as "," via "-x," option and per-socket option displays socket value as first field. But here the last line for "stalled cycles per insn" has more separators. Each csv output line is expected to have 8 field separators (for the 9 fields), where as last line has 9 "," in the result. Patch fixes this issue. The counter stats are displayed by function "perf_stat__print_shadow_stats" in code "util/stat-shadow.c". While printing the stats info for "stalled cycles per insn", function "new_line_csv" is used as new_line callback. The fields printed in each line contains: "Socket_id,aggr nr,Avg,unit,event_name,run,enable_percent,ratio,unit" The metric output prints Socket_id, aggr nr, ratio and unit. It has to skip through remaining five fields ie, Avg,unit,event_name,run,enable_percent. The csv line callback uses "os->nfields" to know the number of fields to skip to match with other lines. Currently it is set as: os.nfields = 3 + aggr_fields[config->aggr_mode] + (counter->cgrp ? 1 : 0); But in case of aggregation modes, csv_sep already gets printed along with each field (Function "aggr_printout" in util/stat-display.c). So aggr_fields can be removed from nfields. And fixed number of fields to skip has to be "4". This is to skip fields for: "avg, unit, event name, run, enable_percent" This needs 4 csv separators. Patch removes aggr_fields and uses 4 as fixed number of os->nfields to skip. After the patch: # ./perf stat -x, --per-socket -a -C 1 ls S0,1,79.08,msec,cpu-clock,79085956,100.00,1.000,CPUs utilized S0,1,7,,context-switches,79084176,100.00,88.514,/sec ------ ====> S0,1,,,,,,0.81,stalled cycles per insn Fixes: 92a61f6412d3a09d ("perf stat: Implement CSV metrics output") Reported-by: Disha Goel Reviewed-by: Kajol Jain Signed-off-by: Athira Jajeev Tested-by: Arnaldo Carvalho de Melo Tested-by: Disha Goel Cc: Andi Kleen Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20221205042852.83382-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 955f6def5590ce6ca11a1c1ced0d2d1c95421059 Author: Anshuman Khandual Date: Mon Dec 5 12:14:43 2022 +0530 perf record: Add remaining branch filters: "no_cycles", "no_flags" & "hw_index" This adds all remaining branch filters i.e "no_cycles", "no_flags" and "hw_index". While here, also updates the documentation. Signed-off-by: Anshuman Khandual Cc: James Clark Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20221205064443.533587-1-anshuman.khandual@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3c97d25ceb75fd3e660ba9fcd4c630d0b057a5a2 Author: Ian Rogers Date: Mon Dec 5 09:34:04 2022 -0300 perf stat: Check existence of os->prefix, fixing a segfault We need to check if we have a OS prefix, otherwise we stumble on a metric segv that I'm now seeing in Arnaldo's tree: $ gdb --args perf stat -M Backend true ... Performance counter stats for 'true': 4,712,355 TOPDOWN.SLOTS # 17.3 % tma_core_bound Program received signal SIGSEGV, Segmentation fault. __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex.S:77 77 ../sysdeps/x86_64/multiarch/strlen-evex.S: No such file or directory. (gdb) bt #0 __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex.S:77 #1 0x00007ffff74749a5 in __GI__IO_fputs (str=0x0, fp=0x7ffff75f5680 <_IO_2_1_stderr_>) #2 0x0000555555779f28 in do_new_line_std (config=0x555555e077c0 , os=0x7fffffffbf10) at util/stat-display.c:356 #3 0x000055555577a081 in print_metric_std (config=0x555555e077c0 , ctx=0x7fffffffbf10, color=0x0, fmt=0x5555558b77b5 "%8.1f", unit=0x7fffffffbb10 "% tma_memory_bound", val=13.165355724442199) at util/stat-display.c:380 #4 0x00005555557768b6 in generic_metric (config=0x555555e077c0 , metric_expr=0x55555593d5b7 "((CYCLE_ACTIVITY.STALLS_MEM_ANY + EXE_ACTIVITY.BOUND_ON_STORES) / (CYCLE_ACTIVITY.STALLS_TOTAL + (EXE_ACTIVITY.1_PORTS_UTIL + tma_retiring * EXE_ACTIVITY.2_PORTS_UTIL) + EXE_ACTIVITY.BOUND_ON_STORES))"..., metric_events=0x555555f334e0, metric_refs=0x555555ec81d0, name=0x555555f32e80 "TOPDOWN.SLOTS", metric_name=0x555555f26c80 "tma_memory_bound", metric_unit=0x55555593d5b1 "100%", runtime=0, map_idx=0, out=0x7fffffffbd90, st=0x555555e9e620 ) at util/stat-shadow.c:934 #5 0x0000555555778cac in perf_stat__print_shadow_stats (config=0x555555e077c0 , evsel=0x555555f289d0, avg=4712355, map_idx=0, out=0x7fffffffbd90, metric_events=0x555555e078e8 , st=0x555555e9e620 ) at util/stat-shadow.c:1329 #6 0x000055555577b6a0 in printout (config=0x555555e077c0 , os=0x7fffffffbf10, uval=4712355, run=325322, ena=325322, noise=4712355, map_idx=0) at util/stat-display.c:741 #7 0x000055555577bc74 in print_counter_aggrdata (config=0x555555e077c0 , counter=0x555555f289d0, s=0, os=0x7fffffffbf10) at util/stat-display.c:838 #8 0x000055555577c1d8 in print_counter (config=0x555555e077c0 , counter=0x555555f289d0, os=0x7fffffffbf10) at util/stat-display.c:957 #9 0x000055555577dba0 in evlist__print_counters (evlist=0x555555ec3610, config=0x555555e077c0 , _target=0x555555e01c80 , ts=0x0, argc=1, argv=0x7fffffffe450) at util/stat-display.c:1413 #10 0x00005555555fc821 in print_counters (ts=0x0, argc=1, argv=0x7fffffffe450) at builtin-stat.c:1040 #11 0x000055555560091a in cmd_stat (argc=1, argv=0x7fffffffe450) at builtin-stat.c:2665 #12 0x00005555556b1eea in run_builtin (p=0x555555e11f70 , argc=4, argv=0x7fffffffe450) at perf.c:322 #13 0x00005555556b2181 in handle_internal_command (argc=4, argv=0x7fffffffe450) at perf.c:376 #14 0x00005555556b22d7 in run_argv (argcp=0x7fffffffe27c, argv=0x7fffffffe270) at perf.c:420 #15 0x00005555556b26ef in main (argc=4, argv=0x7fffffffe450) at perf.c:550 (gdb) Fixes: f123b2d84ecec9a3 ("perf stat: Remove prefix argument in print_metric_headers()") Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Athira Jajeev Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/CAP-5=fUOjSM5HajU9TCD6prY39LbX4OQbkEbtKPPGRBPBN=_VQ@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit fb9f5ee9bf5cf7ebc8731a7033e57d98832dc650 Author: Steven Rostedt (Google) Date: Tue Dec 13 17:24:29 2022 -0500 tracing: Do not synchronize freeing of trigger filter on boot up If a trigger filter on the kernel command line fails to apply (due to syntax error), it will be freed. The freeing will call tracepoint_synchronize_unregister(), but this is not needed during early boot up, and will even trigger a lockdep splat. Avoid calling the synchronization function when system_state is SYSTEM_BOOTING. Link: https://lore.kernel.org/linux-trace-kernel/20221213172429.7774f4ba@gandalf.local.home Cc: Andrew Morton Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 904f309ae7edaadc9fd0ee04be8281d7781d97e4 Author: Srinivas Pandruvada Date: Tue Dec 13 18:06:51 2022 -0800 thermal: intel: Don't set HFI status bit to 1 When CPU doesn't support HFI (Hardware Feedback Interface), don't include BIT 26 in the mask to prevent clearing. otherwise this results in: unchecked MSR access error: WRMSR to 0x1b1 (tried to write 0x0000000004000aa8) at rIP: 0xffffffff8b8559fe (throttle_active_work+0xbe/0x1b0) Fixes: 6fe1e64b6026 ("thermal: intel: Prevent accidental clearing of HFI status") Reported-by: Linus Torvalds Tested-by: Linus Torvalds Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 0debed5b117d11e33cba52870c4dcb64f5911891 Author: ChiYuan Huang Date: Wed Dec 14 09:37:11 2022 +0800 regulator: core: Fix resolve supply lookup issue From Marek's log, the previous change modify the parent of rdev. https://lore.kernel.org/all/58b92e75-f373-dae7-7031-8abd465bb874@samsung.com/ In 'regulator_resolve_supply', it uses the parent DT node of rdev as the DT-lookup starting node. But the parent DT node may not exist. This will cause the NULL supply issue. This patch modify the parent of rdev back to the device that provides from 'regulator_config' in 'regulator_register'. Fixes: 8f3cbcd6b440 ("regulator: core: Use different devices for resource allocation and DT lookup") Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/1670981831-12583-1-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown commit 01258b62c62710297dab4e2b72f46e01be392cc6 Author: Lukas Bulwahn Date: Fri Dec 9 10:59:37 2022 +0100 wifi: ti: remove obsolete lines in the Makefile Commit 06463f6e98df ("wifi: wl1251: drop support for platform data") removes TI WiLink platform data, but leaves some dead lines in the Makefile. Remove these obsolete lines in the Makefile. Signed-off-by: Lukas Bulwahn Reviewed-by: Dmitry Torokhov Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221209095937.17773-1-lukas.bulwahn@gmail.com commit 11e47bbd700f31bd1ee9f8863381bc9e741c0e97 Author: Bartosz Golaszewski Date: Mon Dec 12 14:07:48 2022 +0100 gpio: sim: set a limit on the number of GPIOs With the removal of ARCH_NR_GPIOS in commit 7b61212f2a07 ("gpiolib: Get rid of ARCH_NR_GPIOS") the gpiolib core no longer sanitizes the number of GPIOs for us. This causes the gpio-sim selftests to now fail when setting the number of GPIOs to 99999 and expecting the probe() to fail. Set a sane limit of 1024 on the number of simulated GPIOs and bail out of probe if it's exceeded. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202212112236.756f5db9-oliver.sang@intel.com Fixes: 7b61212f2a07 ("gpiolib: Get rid of ARCH_NR_GPIOS") Signed-off-by: Bartosz Golaszewski commit 19331e84c3873256537d446afec1f6c507f8c4ef Author: Nathan Chancellor Date: Tue Dec 13 11:35:29 2022 -0700 modpost: Include '.text.*' in TEXT_SECTIONS Commit 6c730bfc894f ("modpost: handle -ffunction-sections") added ".text.*" to the OTHER_TEXT_SECTIONS macro to fix certain section mismatch warnings. Unfortunately, this makes it impossible for modpost to warn about section mismatches with LTO, which implies '-ffunction-sections', as all functions are put in their own '.text.' sections, which may still reference functions in sections they are not supposed to, such as __init. Fix this by moving ".text.*" into TEXT_SECTIONS, so that configurations with '-ffunction-sections' will see warnings about mismatched sections. Link: https://lore.kernel.org/Y39kI3MOtVI5BAnV@google.com/ Reported-by: Vincent Donnefort Reviewed-and-tested-by: Alexander Lobakin Reviewed-by: Sami Tolvanen Tested-by: Vincent Donnefort Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 0d24f1b7cc65ee73ea8d04e0d10f77a7cb7a83f3 Author: Nathan Chancellor Date: Tue Dec 13 11:35:28 2022 -0700 padata: Mark padata_work_init() as __ref When building arm64 allmodconfig + ThinLTO with clang and a proposed modpost update to account for -ffuncton-sections, the following warning appears: WARNING: modpost: vmlinux.o: section mismatch in reference: padata_work_init (section: .text.padata_work_init) -> padata_mt_helper (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: padata_work_init (section: .text.padata_work_init) -> padata_mt_helper (section: .init.text) LLVM has optimized padata_work_init() to include the address of padata_mt_helper() directly because it inlined the other call to padata_work_init() with padata_parallel_worker(), meaning the remaining uses of padata_work_init() use padata_mt_helper() as the work_fn argument. This optimization causes modpost to complain since padata_work_init() is not __init, whereas padata_mt_helper() is. Since padata_work_init() is only called from __init code when padata_mt_helper() is passed as the work_fn argument, mark padata_work_init() as __ref, which makes it clear to modpost that this scenario is okay. Suggested-by: Daniel Jordan Signed-off-by: Nathan Chancellor Acked-by: Daniel Jordan Signed-off-by: Masahiro Yamada commit 87d599fc3955e59b1ed30f350321a4be5353f945 Author: Masahiro Yamada Date: Tue Dec 13 20:24:20 2022 +0900 kbuild: ensure Make >= 3.82 is used Documentation/process/changes.rst notes the minimal GNU Make version, but it is not checked anywhere. We could check $(MAKE_VERSION), but another simple way is to check $(.FEATURES) since the feature list always grows. GNU Make 3.81 expands $(.FEATURES) to: target-specific order-only second-expansion else-if archives jobserver check-symlink GNU Make 3.82 expands $(.FEATURES) to: target-specific order-only second-expansion else-if shortest-stem undefine archives jobserver check-symlink To ensure Make >= 3.82, you can check either 'shortest-stem' or 'undefine'. This way is not always possible. For example, Make 4.0 through 4.2 have the same set of $(.FEATURES). At that point, we will need to come up with a different approach. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier commit 3d57e1b7b1d42d4040f0d993b66ff06beda02c54 Author: Masahiro Yamada Date: Sun Dec 11 22:04:08 2022 +0900 kbuild: refactor the prerequisites of the modpost rule The prerequisites of modpost are cluttered. The variables *-if-present and *-if-needed are unreadable. It is cleaner to append them into modpost-deps. Signed-off-by: Masahiro Yamada commit f65a486821cfd363833079b2a7b0769250ee21c9 Author: Masahiro Yamada Date: Sun Dec 11 22:04:07 2022 +0900 kbuild: change module.order to list *.o instead of *.ko scripts/Makefile.build replaces the suffix .o with .ko, then scripts/Makefile.modpost calls the sed command to change .ko back to the original .o suffix. Instead of converting the suffixes back-and-forth, store the .o paths in modules.order, and replace it with .ko in 'make modules_install'. This avoids the unneeded sed command. Signed-off-by: Masahiro Yamada Reviewed-by: Luis Chamberlain commit d74f4a3f6d88a2416564bc6bf937e423a4ae8f8e Author: Yang Li Date: Wed Dec 14 10:39:11 2022 +0800 cifs: Remove duplicated include in cifsglob.h ./fs/cifs/cifsglob.h: linux/scatterlist.h is included more than once. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3459 Fixes: f7f291e14dde ("cifs: fix oops during encryption") Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Steve French commit 7ae9888d6e1ce4062d27367a28e46a26270a3e52 Merge: 2d4ee16d969c9 f9645abe4255b Author: Jakub Kicinski Date: Tue Dec 13 19:32:52 2022 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net 1) Fix NAT IPv6 flowtable hardware offload, from Qingfang DENG. 2) Add a safety check to IPVS socket option interface report a warning if unsupported command is seen, this. From Li Qiong. 3) Document SCTP conntrack timeouts, from Sriram Yagnaraman. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: conntrack: document sctp timeouts ipvs: add a 'default' case in do_ip_vs_set_ctl() netfilter: flowtable: really fix NAT IPv6 offload ==================== Link: https://lore.kernel.org/r/20221213140923.154594-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 2d4ee16d969c97996e80e4c9cb6de0acaff22c9f Author: Jiri Slaby (SUSE) Date: Tue Dec 13 15:52:08 2022 -0700 wireguard: timers: cast enum limits members to int in prints Since gcc13, each member of an enum has the same type as the enum. And that is inherited from its members. Provided "REKEY_AFTER_MESSAGES = 1ULL << 60", the named type is unsigned long. This generates warnings with gcc-13: error: format '%d' expects argument of type 'int', but argument 6 has type 'long unsigned int' Cast those particular enum members to int when printing them. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 Cc: Martin Liska Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Jason A. Donenfeld Link: https://lore.kernel.org/all/20221213225208.3343692-2-Jason@zx2c4.com/ Signed-off-by: Jakub Kicinski commit e2ca6ba6ba0152361aa4fcbf6067db71b2c7a770 Merge: 7e68dd7d07a28 c45bc55a99957 Author: Linus Torvalds Date: Tue Dec 13 19:29:45 2022 -0800 Merge tag 'mm-stable-2022-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - More userfaultfs work from Peter Xu - Several convert-to-folios series from Sidhartha Kumar and Huang Ying - Some filemap cleanups from Vishal Moola - David Hildenbrand added the ability to selftest anon memory COW handling - Some cpuset simplifications from Liu Shixin - Addition of vmalloc tracing support by Uladzislau Rezki - Some pagecache folioifications and simplifications from Matthew Wilcox - A pagemap cleanup from Kefeng Wang: we have VM_ACCESS_FLAGS, so use it - Miguel Ojeda contributed some cleanups for our use of the __no_sanitize_thread__ gcc keyword. This series should have been in the non-MM tree, my bad - Naoya Horiguchi improved the interaction between memory poisoning and memory section removal for huge pages - DAMON cleanups and tuneups from SeongJae Park - Tony Luck fixed the handling of COW faults against poisoned pages - Peter Xu utilized the PTE marker code for handling swapin errors - Hugh Dickins reworked compound page mapcount handling, simplifying it and making it more efficient - Removal of the autonuma savedwrite infrastructure from Nadav Amit and David Hildenbrand - zram support for multiple compression streams from Sergey Senozhatsky - David Hildenbrand reworked the GUP code's R/O long-term pinning so that drivers no longer need to use the FOLL_FORCE workaround which didn't work very well anyway - Mel Gorman altered the page allocator so that local IRQs can remnain enabled during per-cpu page allocations - Vishal Moola removed the try_to_release_page() wrapper - Stefan Roesch added some per-BDI sysfs tunables which are used to prevent network block devices from dirtying excessive amounts of pagecache - David Hildenbrand did some cleanup and repair work on KSM COW breaking - Nhat Pham and Johannes Weiner have implemented writeback in zswap's zsmalloc backend - Brian Foster has fixed a longstanding corner-case oddity in file[map]_write_and_wait_range() - sparse-vmemmap changes for MIPS, LoongArch and NIOS2 from Feiyang Chen - Shiyang Ruan has done some work on fsdax, to make its reflink mode work better under xfstests. Better, but still not perfect - Christoph Hellwig has removed the .writepage() method from several filesystems. They only need .writepages() - Yosry Ahmed wrote a series which fixes the memcg reclaim target beancounting - David Hildenbrand has fixed some of our MM selftests for 32-bit machines - Many singleton patches, as usual * tag 'mm-stable-2022-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (313 commits) mm/hugetlb: set head flag before setting compound_order in __prep_compound_gigantic_folio mm: mmu_gather: allow more than one batch of delayed rmaps mm: fix typo in struct pglist_data code comment kmsan: fix memcpy tests mm: add cond_resched() in swapin_walk_pmd_entry() mm: do not show fs mm pc for VM_LOCKONFAULT pages selftests/vm: ksm_functional_tests: fixes for 32bit selftests/vm: cow: fix compile warning on 32bit selftests/vm: madv_populate: fix missing MADV_POPULATE_(READ|WRITE) definitions mm/gup_test: fix PIN_LONGTERM_TEST_READ with highmem mm,thp,rmap: fix races between updates of subpages_mapcount mm: memcg: fix swapcached stat accounting mm: add nodes= arg to memory.reclaim mm: disable top-tier fallback to reclaim on proactive reclaim selftests: cgroup: make sure reclaim target memcg is unprotected selftests: cgroup: refactor proactive reclaim code to reclaim_until() mm: memcg: fix stale protection of reclaim target memcg mm/mmap: properly unaccount memory on mas_preallocate() failure omfs: remove ->writepage jfs: remove ->writepage ... commit de5dc44370fbd6b46bd7f1a1e00369be54a041c8 Author: Tony Nguyen Date: Mon Dec 12 11:00:31 2022 -0800 igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case. Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") Reported-by: Akihiko Odaki Signed-off-by: Tony Nguyen Reviewed-by: Akihiko Odaki Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20221212190031.3983342-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e9ad498696325c6b437e49450661cf2c349e24f5 Merge: da2b5b4342045 1232946cf522b Author: Jakub Kicinski Date: Tue Dec 13 19:24:53 2022 -0800 Merge branch 'misdn-don-t-call-dev_kfree_skb-kfree_skb-under-spin_lock_irqsave' Yang Yingliang says: ==================== mISDN: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. This pachset try to avoid calling dev_kfree_skb/kfree_skb()() under spin_lock_irqsave(). ==================== Link: https://lore.kernel.org/r/20221212084139.3277913-1-yangyingliang@huawei.com Signed-off-by: Jakub Kicinski commit 1232946cf522b8de9e398828bde325d7c41f29dd Author: Yang Yingliang Date: Mon Dec 12 16:41:39 2022 +0800 mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. skb_queue_purge() is called under spin_lock_irqsave() in handle_dmsg() and hfcm_l1callback(), kfree_skb() is called in them, to fix this, use skb_queue_splice_init() to move the dch->squeue to a free queue, also enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock. Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver") Signed-off-by: Yang Yingliang Reviewed-by: Alexander Duyck Signed-off-by: Jakub Kicinski commit f0f596bd75a9d573ca9b587abb39cee0b916bb82 Author: Yang Yingliang Date: Mon Dec 12 16:41:38 2022 +0800 mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. skb_queue_purge() is called under spin_lock_irqsave() in hfcpci_l2l1D(), kfree_skb() is called in it, to fix this, use skb_queue_splice_init() to move the dch->squeue to a free queue, also enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock. Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver") Signed-off-by: Yang Yingliang Reviewed-by: Alexander Duyck Signed-off-by: Jakub Kicinski commit ddc9648db162eee556edd5222d2808fe33730203 Author: Yang Yingliang Date: Mon Dec 12 16:41:37 2022 +0800 mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. skb_queue_purge() is called under spin_lock_irqsave() in hfcusb_l2l1D(), kfree_skb() is called in it, to fix this, use skb_queue_splice_init() to move the dch->squeue to a free queue, also enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock. In tx_iso_complete(), dev_kfree_skb() is called to consume the transmitted SKB, so replace it with dev_consume_skb_irq(). Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") Signed-off-by: Yang Yingliang Reviewed-by: Alexander Duyck Signed-off-by: Jakub Kicinski commit da2b5b43420456beef5d5e1b43582e579ed08ef1 Merge: f3b4a00f0f62d 42a8d4aaea841 Author: Jakub Kicinski Date: Tue Dec 13 19:20:03 2022 -0800 Merge branch 'bonding-fix-high-prio-not-effect-issue' Hangbin Liu says: ==================== Bonding: fix high prio not effect issue When a high prio link up, if there has current link, it will not do failover as we missed the check in link up event. Fix it in this patchset and add a prio option test case. ==================== Link: https://lore.kernel.org/all/20221212035647.1053865-1-liuhangbin@gmail.com/ Signed-off-by: Jakub Kicinski commit 42a8d4aaea8414f60eb2ed2d92df89a6e2db4615 Author: Liang Li Date: Mon Dec 12 11:56:47 2022 +0800 selftests: bonding: add bonding prio option test Add a test for bonding prio option. Here is the test result: ]# ./option_prio.sh TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=arp_ip_target and primary_reselect=0) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=arp_ip_target and primary_reselect=1) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=arp_ip_target and primary_reselect=2) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=miimon and primary_reselect=0) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=miimon and primary_reselect=1) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=1 monitor=miimon and primary_reselect=2) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=5 monitor=miimon and primary_reselect=0) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=5 monitor=miimon and primary_reselect=1) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=5 monitor=miimon and primary_reselect=2) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=6 monitor=miimon and primary_reselect=0) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=6 monitor=miimon and primary_reselect=1) [ OK ] TEST: prio_test (Test bonding option 'prio' with mode=6 monitor=miimon and primary_reselect=2) [ OK ] Signed-off-by: Liang Li Signed-off-by: Hangbin Liu Signed-off-by: Jakub Kicinski commit e95cc44763a41d5c715ef16742bcb1d8e6524a62 Author: Hangbin Liu Date: Mon Dec 12 11:56:46 2022 +0800 bonding: do failover when high prio link up Currently, when a high prio link enslaved, or when current link down, the high prio port could be selected. But when high prio link up, the new active slave reselection is not triggered. Fix it by checking link's prio when getting up. Making the do_failover after looping all slaves as there may be multi high prio slaves up. Reported-by: Liang Li Fixes: 0a2ff7cc8ad4 ("Bonding: add per-port priority for failover re-selection") Signed-off-by: Hangbin Liu Signed-off-by: Jakub Kicinski commit 3d0b738fc5adf9f380702ac1424672e4b32c3781 Author: Hangbin Liu Date: Mon Dec 12 11:56:45 2022 +0800 bonding: add missed __rcu annotation for curr_active_slave There is one direct accesses to bond->curr_active_slave in bond_miimon_commit(). Protected it by rcu_access_pointer() since the later of this function also use this one. Signed-off-by: Hangbin Liu Signed-off-by: Jakub Kicinski commit 1a5665fc8d7a000671ebd3fe69c6f9acf1e0dcd9 Author: Peter Wang Date: Thu Dec 8 15:25:20 2022 +0800 scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery When SSU/enter hibern8 fail in WLUN suspend flow, trigger the error handler and return busy to break the suspend. Otherwise the consumer will get stuck in runtime suspend status. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20221208072520.26210-1-peter.wang@mediatek.com Reviewed-by: Stanley Chu Reviewed-by: Bart Van Assche Reviewed-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit c411a42fb91f452509c312e4dda713699a22a995 Author: John Garry Date: Tue Dec 13 14:21:22 2022 +0000 scsi: scsi_debug: Delete unreachable code in inquiry_vpd_b0() The 2nd return statement in inquiry_vpd_b0() is unreachable, so delete it. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20221213142122.1011886-1-john.g.garry@oracle.com Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit f0a43ba6c66cc0688e2748d986a1459fdd3442ef Author: Shin'ichiro Kawasaki Date: Wed Dec 7 11:36:59 2022 +0900 scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile When Kconfig item CONFIG_SCSI_MPI3MR was introduced for mpi3mr driver, the Makefile of the driver was not modified to refer the Kconfig item. As a result, mpi3mr.ko is built regardless of the Kconfig item value y or m. Also, if 'make localmodconfig' can not find the Kconfig item in the Makefile, then it does not generate CONFIG_SCSI_MPI3MR=m even when mpi3mr.ko is loaded on the system. Refer to the Kconfig item to avoid the issues. Fixes: c4f7ac64616e ("scsi: mpi3mr: Add mpi30 Rev-R headers and Kconfig") Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20221207023659.2411785-1-shinichiro.kawasaki@wdc.com Reviewed-by: Damien Le Moal Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit d0b9025540ef57cc4464ab2fc64ed8ddc49b5658 Author: Hannes Reinecke Date: Tue Dec 6 14:13:45 2022 +0100 scsi: core: scsi_error: Do not queue pointless abort workqueue functions If a host template doesn't implement the .eh_abort_handler() there is no point in queueing the abort workqueue function; all it does is invoking SCSI EH anyway. So return 'FAILED' from scsi_abort_command() if the .eh_abort_handler() is not implemented and save us from having to wait for the abort workqueue function to complete. Cc: Niklas Cassel Cc: Damien Le Moal Cc: John Garry Signed-off-by: Hannes Reinecke [niklas: moved the check to the top of scsi_abort_command()] Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20221206131346.2045375-1-niklas.cassel@wdc.com Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit f3b4a00f0f62da252c598310698dfc82ef2f2e2e Author: Emeel Hakim Date: Sun Dec 11 09:55:32 2022 +0200 net: macsec: fix net device access prior to holding a lock Currently macsec offload selection update routine accesses the net device prior to holding the relevant lock. Fix by holding the lock prior to the device access. Fixes: dcb780fb2795 ("net: macsec: add nla support for changing the offloading selection") Reviewed-by: Raed Salem Signed-off-by: Emeel Hakim Link: https://lore.kernel.org/r/20221211075532.28099-1-ehakim@nvidia.com Signed-off-by: Jakub Kicinski commit 67ff3d0a49f3d445c3922e30a54e03c161da561e Author: Michael Kelley Date: Sun Dec 4 11:52:44 2022 -0800 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force. Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory. Fixes: 743b237c3a7b ("scsi: storvsc: Add Isolation VM support for storvsc driver") Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1670183564-76254-1-git-send-email-mikelley@microsoft.com Tested-by: Dexuan Cui Reviewed-by: Dexuan Cui Reviewed-by: Tianyu Lan Signed-off-by: Martin K. Petersen commit a3be19b91ea7121d388084e8c07f5b1b982eb40c Author: Wenchao Hao Date: Sat Nov 26 09:07:52 2022 +0800 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace It was observed that the kernel would potentially send ISCSI_KEVENT_UNBIND_SESSION multiple times. Introduce 'target_state' in iscsi_cls_session() to make sure session will send only one unbind session event. This introduces a regression wrt. the issue fixed in commit 13e60d3ba287 ("scsi: iscsi: Report unbind session event when the target has been removed"). If iscsid dies for any reason after sending an unbind session to kernel, once iscsid is restarted, the kernel's ISCSI_KEVENT_UNBIND_SESSION event is lost and userspace is then unable to logout. However, the session is actually in invalid state (its target_id is INVALID) so iscsid should not sync this session during restart. Consequently we need to check the session's target state during iscsid restart. If session is in unbound state, do not sync this session and perform session teardown. This is OK because once a session is unbound, we can not recover it any more (mainly because its target id is INVALID). Signed-off-by: Wenchao Hao Link: https://lore.kernel.org/r/20221126010752.231917-1-haowenchao@huawei.com Reviewed-by: Mike Christie Reviewed-by: Wu Bo Signed-off-by: Martin K. Petersen commit 5535f4f70cfc15ef55b6ea7c7e17337b17337cb6 Author: Huacai Chen Date: Sat Dec 10 22:40:21 2022 +0800 LoongArch: Update Loongson-3 default config file 1, Enable suspend (ACPI S3) and hibernation (ACPI S4). 2, Enable some options for FDT-based systems (e.g., SERIAL_OF_PLATFORM). 3, Enable CONFIG_KALLSYMS_ALL and CONFIG_DEBUG_FS to convenient ftrace. 4, Regenerate the whole file to keep the order of options be the same as the latest source code. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 28ac0a9e04d7dfb42220dc9d221164d93f20fb3a Author: Qing Zhang Date: Sat Dec 10 22:40:21 2022 +0800 LoongArch: modules/ftrace: Initialize PLT at load time This patch implements ftrace trampolines through plt entry. Tested by forcing ftrace_make_call() to use the module PLT, and then loading up a module after setting up ftrace with: | echo ":mod:" > set_ftrace_filter; | echo function > current_tracer; | modprobe Since FTRACE_ADDR/FTRACE_REGS_ADDR is only defined when CONFIG_DYNAMIC_ FTRACE is selected, we wrap their usage in module_init_ftrace_plt() with ifdeffery rather than using IS_ENABLED(). Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit a51ac5246d2505b58229242959d2bc73d113ca50 Author: Qing Zhang Date: Sat Dec 10 22:40:21 2022 +0800 LoongArch/ftrace: Add HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support ftrace_graph_ret_addr() can be called by stack unwinding code to convert a found stack return address ('ret') to its original value, in case the function graph tracer has modified it to be 'return_to_handler'. If the hasn't been modified, the unchanged value of 'ret' is returned. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit ac7127e1cc65aeb578998c992a05dbc80fa18f0f Author: Qing Zhang Date: Sat Dec 10 22:40:16 2022 +0800 LoongArch/ftrace: Add HAVE_DYNAMIC_FTRACE_WITH_ARGS support Allow for arguments to be passed in to ftrace_regs by default. If this is set, then arguments and stack can be found from the pt_regs. 1. HAVE_DYNAMIC_FTRACE_WITH_ARGS don't need special hook for graph tracer entry point, but instead we can use graph_ops::func function to install the return_hooker. 2. Livepatch requires this option in the future. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 8778ba2c8a5df11859dc6f2b2205700388b63fd3 Author: Qing Zhang Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch/ftrace: Add HAVE_DYNAMIC_FTRACE_WITH_REGS support This patch implements CONFIG_DYNAMIC_FTRACE_WITH_REGS on LoongArch, which allows a traced function's arguments (and some other registers) to be captured into a struct pt_regs, allowing these to be inspected and modified. Co-developed-by: Jinyang He Signed-off-by: Jinyang He Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 5fcfad3d41cc70f39fb31e7ee314989cc4c5f02c Author: Qing Zhang Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch/ftrace: Add dynamic function graph tracer support Once the function_graph tracer is enabled, a filtered function has the following call sequence: 1) ftracer_caller ==> on/off by ftrace_make_call/ftrace_make_nop 2) ftrace_graph_caller 3) ftrace_graph_call ==> on/off by ftrace_en/disable_ftrace_graph_caller 4) prepare_ftrace_return Considering the following DYNAMIC_FTRACE_WITH_REGS feature, it would be more extendable to have a ftrace_graph_caller function, instead of calling prepare_ftrace_return directly in ftrace_caller. Co-developed-by: Jinyang He Signed-off-by: Jinyang He Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 4733f09d880745953b88c3358b49ad495aecd8e9 Author: Qing Zhang Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch/ftrace: Add dynamic function tracer support The compiler has inserted 2 NOPs before the regular function prologue. T series registers are available and safe because of LoongArch's psABI. At runtime, we can replace nop with bl to enable ftrace call and replace bl with nop to disable ftrace call. The bl instruction requires us to save the original RA value, so it saves RA at t0 here. Details are: | Compiled | Disabled | Enabled | +------------+------------------------+------------------------+ | nop | move t0, ra | move t0, ra | | nop | nop | bl ftrace_caller | | func_body | func_body | func_body | The RA value will be recovered by ftrace_regs_entry, and restored into RA before returning to the regular function prologue. When a function is not being traced, the "move t0, ra" is not harmful. 1) ftrace_make_call, ftrace_make_nop (in kernel/ftrace.c) The two functions turn each recorded call site of filtered functions into a call to ftrace_caller or nops. 2) ftracce_update_ftrace_func (in kernel/ftrace.c) turns the nops at ftrace_call into a call to a generic entry for function tracers. 3) ftrace_caller (in kernel/mcount_dyn.S) The entry where each _mcount call sites calls to once they are filtered to be traced. Co-developed-by: Jinyang He Signed-off-by: Jinyang He Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit a0a458fbd6f2317832e2d74acdbfa2451c3f4b8f Author: Qing Zhang Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch/ftrace: Add recordmcount support Recordmcount utility under scripts is run, after compiling each object, to find out all the locations of calling _mcount() and put them into specific seciton named __mcount_loc. Then the linker collects all such information into a table in the kernel image (between __start_mcount_loc and __stop_mcount_loc) for later use by ftrace. This patch adds LoongArch specific definitions to identify such locations. And on LoongArch, only the C version is used to build the kernel now that CONFIG_HAVE_C_RECORDMCOUNT is on. Acked-by: Steven Rostedt (Google) Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit dbe3ba3018ec1fc53ea0d0adf0f687f5d438039d Author: Qing Zhang Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch/ftrace: Add basic support This patch contains basic ftrace support for LoongArch. Specifically, function tracer (HAVE_FUNCTION_TRACER), function graph tracer (HAVE_ FUNCTION_GRAPH_TRACER) are implemented following the instructions in Documentation/trace/ftrace-design.txt. Use `-pg` makes stub like a child function `void _mcount(void *ra)`. Thus, it can be seen store RA and alloc stack before `call _mcount`. Find `alloc stack` at first, and then find `store RA`. Note that the functions in both inst.c and time.c should not be hooked with the compiler's -pg option: to prevent infinite self-referencing for the former, and to ignore early setup stuff for the latter. Co-developed-by: Jinyang He Signed-off-by: Jinyang He Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 9151dde40356880bb445f719f5ebbb1319054d5f Author: Huacai Chen Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch: module: Use got/plt section indices for relocations Instead of saving a pointer to the .got, .plt and .plt_idx sections to apply {got,plt}-based relocations, save and use their section indices instead. The mod->arch.{core,init}.{got,plt} pointers were problematic for live- patch because they pointed within temporary section headers (provided by the module loader via info->sechdrs) that would be freed after module load. Since livepatch modules may need to apply relocations post-module- load (for example, to patch a module that is loaded later), using section indices to offset into the section headers (instead of accessing them through a saved pointer) allows livepatch modules on LoongArch to pass in their own copy of the section headers to apply_relocate_add() to apply delayed relocations. The method used is same as commit c8ebf64eab743 ("arm64/module: use plt section indices for relocations"). Signed-off-by: Hongchen Zhang Signed-off-by: Huacai Chen commit 09f33601bf940f955c10a6e75a1c1b7bcadee5e2 Author: Huacai Chen Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch: Add basic STACKPROTECTOR support Add basic stack protector support similar to other architectures. A constant canary value is set at boot time, and with help of compiler's -fstack-protector we can detect stack corruption. Signed-off-by: Huacai Chen commit 7db54bfe44a662c8f2c10277bccfa02c2f4c719c Author: Huacai Chen Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch: Add hibernation (ACPI S4) support Add hibernation (Suspend to Disk, aka ACPI S4) support for LoongArch. Signed-off-by: Huacai Chen commit 366bb35a8e48198cefcd3484ac6b2374d1347873 Author: Huacai Chen Date: Sat Dec 10 22:40:15 2022 +0800 LoongArch: Add suspend (ACPI S3) support Add suspend (Suspend To RAM, aka ACPI S3) support for LoongArch. Signed-off-by: Huacai Chen commit 27cab431564edba9919d1a82c2d9636d622a2493 Author: Binbin Zhou Date: Sat Dec 10 22:40:05 2022 +0800 LoongArch: Add processing ISA Node in DeviceTree Similar to commit 6d0068ad15e4f771b3 ("MIPS: Loongson64: Process ISA Node in DeviceTree"), we process ISA node in DeviceTree for FDT-based systems. Previously, we are hardcoding reserved ISA I/O Space in, now we are processing it I/O via DeviceTree directly. The ranges property of ISA node is used to determine the size and address of reserved I/O space. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 88d4d957edc707e037449ef71a58c6530a39d01e Author: Binbin Zhou Date: Sat Dec 10 22:40:05 2022 +0800 LoongArch: Add FDT booting support from efi system table Since commit 40cd01a9c324("efi/loongarch: libstub: remove dependency on flattened DT"), we can parse the FDT from efi system table. And now, LoongArch is coming to support booting with FDT, so we add the relevant booting support as well as parameter parsing. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit a275a82dcd4024c75337db15d59ed039c31e21da Author: Huacai Chen Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: Use alternative to optimize libraries Use the alternative to optimize common libraries according whether CPU has UAL (hardware unaligned access support) feature, including memset(), memcopy(), memmove(), copy_user() and clear_user(). We have tested UnixBench on a Loongson-3A5000 quad-core machine (1.6GHz): 1, One copy, before patch: System Benchmarks Index Values BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 9566582.0 819.8 Double-Precision Whetstone 55.0 2805.3 510.1 Execl Throughput 43.0 2120.0 493.0 File Copy 1024 bufsize 2000 maxblocks 3960.0 209833.0 529.9 File Copy 256 bufsize 500 maxblocks 1655.0 89400.0 540.2 File Copy 4096 bufsize 8000 maxblocks 5800.0 320036.0 551.8 Pipe Throughput 12440.0 340624.0 273.8 Pipe-based Context Switching 4000.0 109939.1 274.8 Process Creation 126.0 4728.7 375.3 Shell Scripts (1 concurrent) 42.4 2223.1 524.3 Shell Scripts (8 concurrent) 6.0 883.1 1471.9 System Call Overhead 15000.0 518639.1 345.8 ======== System Benchmarks Index Score 500.2 2, One copy, after patch: System Benchmarks Index Values BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 9567674.7 819.9 Double-Precision Whetstone 55.0 2805.5 510.1 Execl Throughput 43.0 2392.7 556.4 File Copy 1024 bufsize 2000 maxblocks 3960.0 417804.0 1055.1 File Copy 256 bufsize 500 maxblocks 1655.0 112909.5 682.2 File Copy 4096 bufsize 8000 maxblocks 5800.0 1255207.4 2164.2 Pipe Throughput 12440.0 555712.0 446.7 Pipe-based Context Switching 4000.0 99964.5 249.9 Process Creation 126.0 5192.5 412.1 Shell Scripts (1 concurrent) 42.4 2302.4 543.0 Shell Scripts (8 concurrent) 6.0 919.6 1532.6 System Call Overhead 15000.0 511159.3 340.8 ======== System Benchmarks Index Score 640.1 3, Four copies, before patch: System Benchmarks Index Values BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 38268610.5 3279.2 Double-Precision Whetstone 55.0 11222.2 2040.4 Execl Throughput 43.0 7892.0 1835.3 File Copy 1024 bufsize 2000 maxblocks 3960.0 235149.6 593.8 File Copy 256 bufsize 500 maxblocks 1655.0 74959.6 452.9 File Copy 4096 bufsize 8000 maxblocks 5800.0 545048.5 939.7 Pipe Throughput 12440.0 1337359.0 1075.0 Pipe-based Context Switching 4000.0 473663.9 1184.2 Process Creation 126.0 17491.2 1388.2 Shell Scripts (1 concurrent) 42.4 6865.7 1619.3 Shell Scripts (8 concurrent) 6.0 1015.9 1693.1 System Call Overhead 15000.0 1899535.2 1266.4 ======== System Benchmarks Index Score 1278.3 4, Four copies, after patch: System Benchmarks Index Values BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 38272815.5 3279.6 Double-Precision Whetstone 55.0 11222.8 2040.5 Execl Throughput 43.0 8839.2 2055.6 File Copy 1024 bufsize 2000 maxblocks 3960.0 313912.9 792.7 File Copy 256 bufsize 500 maxblocks 1655.0 80976.1 489.3 File Copy 4096 bufsize 8000 maxblocks 5800.0 1176594.3 2028.6 Pipe Throughput 12440.0 2100941.9 1688.9 Pipe-based Context Switching 4000.0 476696.4 1191.7 Process Creation 126.0 18394.7 1459.9 Shell Scripts (1 concurrent) 42.4 7172.2 1691.6 Shell Scripts (8 concurrent) 6.0 1058.3 1763.9 System Call Overhead 15000.0 1874714.7 1249.8 ======== System Benchmarks Index Score 1488.8 Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit 19e5eb15b00c5841b4b9bd9777af2865a40d2f39 Author: Huacai Chen Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: Add alternative runtime patching mechanism Introduce the "alternative" mechanism from ARM64 and x86 for LoongArch to apply runtime patching. The main purpose of this patch is to provide a framework. In future we can use this mechanism (i.e., the ALTERNATIVE and ALTERNATIVE_2 macros) to optimize hotspot functions according to cpu features. Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit 61a6fccc0bd2e8030b2672a52ef3f6706b2b2ee4 Author: Huacai Chen Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: Add unaligned access support Loongson-2 series (Loongson-2K500, Loongson-2K1000) don't support unaligned access in hardware, while Loongson-3 series (Loongson-3A5000, Loongson-3C5000) are configurable whether support unaligned access in hardware. This patch add unaligned access emulation for those LoongArch processors without hardware support. Signed-off-by: Huacai Chen commit dbcd7f5fafea64dbe588c4ec18bc309fde5d1e1c Author: Youling Tang Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: BPF: Add BPF exception tables Inspired by commit 800834285361("bpf, arm64: Add BPF exception tables"), do similar to LoongArch to add BPF exception tables. When a tracing BPF program attempts to read memory without using the bpf_probe_read() helper, the verifier marks the load instruction with the BPF_PROBE_MEM flag. Since the LoongArch JIT does not currently recognize this flag it falls back to the interpreter. Add support for BPF_PROBE_MEM, by appending an exception table to the BPF program. If the load instruction causes a data abort, the fixup infrastructure finds the exception table and fixes up the fault, by clearing the destination register and jumping over the faulting instruction. To keep the compact exception table entry format, inspect the pc in fixup_exception(). A more generic solution would add a "handler" field to the table entry, like on x86, s390 and arm64, etc. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 912bcfaf36771a2bf7a83799ce5454850d1c3f40 Author: Youling Tang Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: Remove the .fixup section usage Use the `.L_xxx` label to improve fixup code and then remove the .fixup section usage. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 672999cfae3e830a64c4996362a26934fd555ff9 Author: Youling Tang Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: extable: Add a dedicated uaccess handler Inspired by commit 2e77a62cb3a6("arm64: extable: add a dedicated uaccess handler"), do similar to LoongArch to add a dedicated uaccess exception handler to update registers in exception context and subsequently return back into the function which faulted, so we remove the need for fixups specialized to each faulting instruction. Add gpr-num.h here because we need to map the same GPR names to integer constants, so that we can use this to build meta-data for the exception fixups. The compiler treats gpr 0 as zero rather than $r0, so set it separately to .L__gpr_num_zero, otherwise the following assembly error will occurs: {standard input}: Assembler messages: {standard input}:1074: Error: invalid operands (*UND* and *ABS* sections) for `<<' {standard input}:1160: Error: invalid operands (*UND* and *ABS* sections) for `<<' make[1]: *** [scripts/Makefile.build:249: fs/fcntl.o] Error 1 Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 26bc82441250f2e01621f5b26606a4f6926ee3ad Author: Youling Tang Date: Sat Dec 10 22:39:59 2022 +0800 LoongArch: extable: Add `type` and `data` fields This is a LoongArch port of commit d6e2cc564775 ("arm64: extable: add `type` and `data` fields"). Subsequent patches will add specialized handlers for fixups, in addition to the simple PC fixup we have today. In preparation, this patch adds a new `type` field to struct exception_table_entry, and uses this to distinguish the fixup and other cases. A `data` field is also added so that subsequent patches can associate data specific to each exception site (e.g. register numbers). Handlers are named ex_handler_*() for consistency, following the example of x86. At the same time, get_ex_fixup() is split out into a helper so that it can be used by other ex_handler_*() functions in the subsequent patches. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 3d36f4298ba91fbdec6bc56aa7bb0663cba6ab0c Author: Youling Tang Date: Sat Dec 10 22:39:48 2022 +0800 LoongArch: Switch to relative exception tables Similar to other architectures such as arm64, x86, riscv and so on, use offsets relative to the exception table entry values rather than their absolute addresses for both the exception location and the fixup. However, LoongArch label difference because it will actually produce two relocations, a pair of R_LARCH_ADD32 and R_LARCH_SUB32. Take simple code below for example: $ cat test_ex_table.S .section .text 1: nop .section __ex_table,"a" .balign 4 .long (1b - .) .previous $ loongarch64-unknown-linux-gnu-gcc -c test_ex_table.S $ loongarch64-unknown-linux-gnu-readelf -Wr test_ex_table.o Relocation section '.rela__ex_table' at offset 0x100 contains 2 entries: Offset Info Type Symbol's Value Symbol's Name + Addend 0000000000000000 0000000600000032 R_LARCH_ADD32 0000000000000000 .L1^B1 + 0 0000000000000000 0000000500000037 R_LARCH_SUB32 0000000000000000 L0^A + 0 The modpost will complain the R_LARCH_SUB32 relocation, so we need to patch modpost.c to skip this relocation for .rela__ex_table section. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 508f28c67171e276356650f407dd87d42b6913ef Author: Youling Tang Date: Sat Dec 10 22:39:48 2022 +0800 LoongArch: Consolidate __ex_table construction Consolidate all the __ex_table constuction code with a _ASM_EXTABLE or _asm_extable helper. There should be no functional change as a result of this patch. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 70d822cfb782ebed5c41bdad9fa520b5ec1c6923 Merge: 4f2c0a4acffbe 2aa14b1ab2c41 Author: Nick Terrell Date: Tue Dec 13 16:24:40 2022 -0800 Merge branch 'zstd-next' into zstd-linus commit 4f2c0a4acffbec01079c28f839422e64ddeff004 Merge: 88a309465b3f0 830b3c68c1fb1 Author: Nick Terrell Date: Tue Dec 13 16:21:55 2022 -0800 Merge branch 'main' into zstd-linus commit 7e68dd7d07a28faa2e6574dd6b9dbd90cdeaae91 Merge: 1ca06f1c1acec 7c4a6309e27f4 Author: Linus Torvalds Date: Tue Dec 13 15:47:48 2022 -0800 Merge tag 'net-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core: - Allow live renaming when an interface is up - Add retpoline wrappers for tc, improving considerably the performances of complex queue discipline configurations - Add inet drop monitor support - A few GRO performance improvements - Add infrastructure for atomic dev stats, addressing long standing data races - De-duplicate common code between OVS and conntrack offloading infrastructure - A bunch of UBSAN_BOUNDS/FORTIFY_SOURCE improvements - Netfilter: introduce packet parser for tunneled packets - Replace IPVS timer-based estimators with kthreads to scale up the workload with the number of available CPUs - Add the helper support for connection-tracking OVS offload BPF: - Support for user defined BPF objects: the use case is to allocate own objects, build own object hierarchies and use the building blocks to build own data structures flexibly, for example, linked lists in BPF - Make cgroup local storage available to non-cgroup attached BPF programs - Avoid unnecessary deadlock detection and failures wrt BPF task storage helpers - A relevant bunch of BPF verifier fixes and improvements - Veristat tool improvements to support custom filtering, sorting, and replay of results - Add LLVM disassembler as default library for dumping JITed code - Lots of new BPF documentation for various BPF maps - Add bpf_rcu_read_{,un}lock() support for sleepable programs - Add RCU grace period chaining to BPF to wait for the completion of access from both sleepable and non-sleepable BPF programs - Add support storing struct task_struct objects as kptrs in maps - Improve helper UAPI by explicitly defining BPF_FUNC_xxx integer values - Add libbpf *_opts API-variants for bpf_*_get_fd_by_id() functions Protocols: - TCP: implement Protective Load Balancing across switch links - TCP: allow dynamically disabling TCP-MD5 static key, reverting back to fast[er]-path - UDP: Introduce optional per-netns hash lookup table - IPv6: simplify and cleanup sockets disposal - Netlink: support different type policies for each generic netlink operation - MPTCP: add MSG_FASTOPEN and FastOpen listener side support - MPTCP: add netlink notification support for listener sockets events - SCTP: add VRF support, allowing sctp sockets binding to VRF devices - Add bridging MAC Authentication Bypass (MAB) support - Extensions for Ethernet VPN bridging implementation to better support multicast scenarios - More work for Wi-Fi 7 support, comprising conversion of all the existing drivers to internal TX queue usage - IPSec: introduce a new offload type (packet offload) allowing complete header processing and crypto offloading - IPSec: extended ack support for more descriptive XFRM error reporting - RXRPC: increase SACK table size and move processing into a per-local endpoint kernel thread, reducing considerably the required locking - IEEE 802154: synchronous send frame and extended filtering support, initial support for scanning available 15.4 networks - Tun: bump the link speed from 10Mbps to 10Gbps - Tun/VirtioNet: implement UDP segmentation offload support Driver API: - PHY/SFP: improve power level switching between standard level 1 and the higher power levels - New API for netdev <-> devlink_port linkage - PTP: convert existing drivers to new frequency adjustment implementation - DSA: add support for rx offloading - Autoload DSA tagging driver when dynamically changing protocol - Add new PCP and APPTRUST attributes to Data Center Bridging - Add configuration support for 800Gbps link speed - Add devlink port function attribute to enable/disable RoCE and migratable - Extend devlink-rate to support strict prioriry and weighted fair queuing - Add devlink support to directly reading from region memory - New device tree helper to fetch MAC address from nvmem - New big TCP helper to simplify temporary header stripping New hardware / drivers: - Ethernet: - Marvel Octeon CNF95N and CN10KB Ethernet Switches - Marvel Prestera AC5X Ethernet Switch - WangXun 10 Gigabit NIC - Motorcomm yt8521 Gigabit Ethernet - Microchip ksz9563 Gigabit Ethernet Switch - Microsoft Azure Network Adapter - Linux Automation 10Base-T1L adapter - PHY: - Aquantia AQR112 and AQR412 - Motorcomm YT8531S - PTP: - Orolia ART-CARD - WiFi: - MediaTek Wi-Fi 7 (802.11be) devices - RealTek rtw8821cu, rtw8822bu, rtw8822cu and rtw8723du USB devices - Bluetooth: - Broadcom BCM4377/4378/4387 Bluetooth chipsets - Realtek RTL8852BE and RTL8723DS - Cypress.CYW4373A0 WiFi + Bluetooth combo device Drivers: - CAN: - gs_usb: bus error reporting support - kvaser_usb: listen only and bus error reporting support - Ethernet NICs: - Intel (100G): - extend action skbedit to RX queue mapping - implement devlink-rate support - support direct read from memory - nVidia/Mellanox (mlx5): - SW steering improvements, increasing rules update rate - Support for enhanced events compression - extend H/W offload packet manipulation capabilities - implement IPSec packet offload mode - nVidia/Mellanox (mlx4): - better big TCP support - Netronome Ethernet NICs (nfp): - IPsec offload support - add support for multicast filter - Broadcom: - RSS and PTP support improvements - AMD/SolarFlare: - netlink extened ack improvements - add basic flower matches to offload, and related stats - Virtual NICs: - ibmvnic: introduce affinity hint support - small / embedded: - FreeScale fec: add initial XDP support - Marvel mv643xx_eth: support MII/GMII/RGMII modes for Kirkwood - TI am65-cpsw: add suspend/resume support - Mediatek MT7986: add RX wireless wthernet dispatch support - Realtek 8169: enable GRO software interrupt coalescing per default - Ethernet high-speed switches: - Microchip (sparx5): - add support for Sparx5 TC/flower H/W offload via VCAP - Mellanox mlxsw: - add 802.1X and MAC Authentication Bypass offload support - add ip6gre support - Embedded Ethernet switches: - Mediatek (mtk_eth_soc): - improve PCS implementation, add DSA untag support - enable flow offload support - Renesas: - add rswitch R-Car Gen4 gPTP support - Microchip (lan966x): - add full XDP support - add TC H/W offload via VCAP - enable PTP on bridge interfaces - Microchip (ksz8): - add MTU support for KSZ8 series - Qualcomm 802.11ax WiFi (ath11k): - support configuring channel dwell time during scan - MediaTek WiFi (mt76): - enable Wireless Ethernet Dispatch (WED) offload support - add ack signal support - enable coredump support - remain_on_channel support - Intel WiFi (iwlwifi): - enable Wi-Fi 7 Extremely High Throughput (EHT) PHY capabilities - 320 MHz channels support - RealTek WiFi (rtw89): - new dynamic header firmware format support - wake-over-WLAN support" * tag 'net-next-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2002 commits) ipvs: fix type warning in do_div() on 32 bit net: lan966x: Remove a useless test in lan966x_ptp_add_trap() net: ipa: add IPA v4.7 support dt-bindings: net: qcom,ipa: Add SM6350 compatible bnxt: Use generic HBH removal helper in tx path IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver selftests: forwarding: Add bridge MDB test selftests: forwarding: Rename bridge_mdb test bridge: mcast: Support replacement of MDB port group entries bridge: mcast: Allow user space to specify MDB entry routing protocol bridge: mcast: Allow user space to add (*, G) with a source list and filter mode bridge: mcast: Add support for (*, G) with a source list and filter mode bridge: mcast: Avoid arming group timer when (S, G) corresponds to a source bridge: mcast: Add a flag for user installed source entries bridge: mcast: Expose __br_multicast_del_group_src() bridge: mcast: Expose br_multicast_new_group_src() bridge: mcast: Add a centralized error path bridge: mcast: Place netlink policy before validation functions bridge: mcast: Split (*, G) and (S, G) addition into different functions bridge: mcast: Do not derive entry type from its filter mode ... commit 1ca06f1c1acecbe02124f14a37cce347b8c1a90c Merge: 4cb1fc6fffe49 8939c58d68f97 Author: Linus Torvalds Date: Tue Dec 13 15:25:08 2022 -0800 Merge tag 'xtensa-20221213' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - fix kernel build with gcc-13 - various minor fixes * tag 'xtensa-20221213' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: add __umulsidi3 helper xtensa: update config files MAINTAINERS: update the 'T:' entry for xtensa commit 4cb1fc6fffe4910845e183d1a2dfe9509ba1062c Merge: 740afa4d39414 aaa4dd1b47f5f Author: Linus Torvalds Date: Tue Dec 13 15:22:14 2022 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - update unwinder to cope with module PLTs - enable UBSAN on ARM - improve kernel fault message - update UEFI runtime page tables dump - avoid clang's __aeabi_uldivmod generated in NWFPE code - disable FIQs on CPU shutdown paths - update XOR register usage - a number of build updates (using .arch, thread pointer, removal of lazy evaluation in Makefile) - conversion of stacktrace code to stackwalk - findbit assembly updates - hwcap feature updates for ARMv8 CPUs - instruction dump updates for big-endian platforms - support for function error injection * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: (31 commits) ARM: 9279/1: support function error injection ARM: 9277/1: Make the dumped instructions are consistent with the disassembled ones ARM: 9276/1: Refactor dump_instr() ARM: 9275/1: Drop '-mthumb' from AFLAGS_ISA ARM: 9274/1: Add hwcap for Speculative Store Bypassing Safe ARM: 9273/1: Add hwcap for Speculation Barrier(SB) ARM: 9272/1: vfp: Add hwcap for FEAT_AA32I8MM ARM: 9271/1: vfp: Add hwcap for FEAT_AA32BF16 ARM: 9270/1: vfp: Add hwcap for FEAT_FHM ARM: 9269/1: vfp: Add hwcap for FEAT_DotProd ARM: 9268/1: vfp: Add hwcap FPHP and ASIMDHP for FEAT_FP16 ARM: 9267/1: Define Armv8 registers in AArch32 state ARM: findbit: add unwinder information ARM: findbit: operate by words ARM: findbit: convert to macros ARM: findbit: provide more efficient ARMv7 implementation ARM: findbit: document ARMv5 bit offset calculation ARM: 9259/1: stacktrace: Convert stacktrace to generic ARCH_STACKWALK ARM: 9258/1: stacktrace: Make stack walk callback consistent with generic code ARM: 9265/1: pass -march= only to compiler ... commit 740afa4d39414516c36836ad88bed8294c72ba5f Merge: 82c72902c50f8 2874529b3513b Author: Linus Torvalds Date: Tue Dec 13 15:17:55 2022 -0800 Merge tag 'x86_sev_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 sev updates from Borislav Petkov: - Two minor fixes to the sev-guest driver * tag 'x86_sev_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: virt/sev-guest: Add a MODULE_ALIAS virt/sev-guest: Remove unnecessary free in init_crypto() commit 82c72902c50f8b5e28f59c2f2ec1c4ba20dbfa08 Merge: a70210f415661 00e8f7153bcde Author: Linus Torvalds Date: Tue Dec 13 15:09:40 2022 -0800 Merge tag 'x86_paravirt_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 paravirt update from Borislav Petkov: - Simplify paravirt patching machinery by removing the now unused clobber mask * tag 'x86_paravirt_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/paravirt: Remove clobber bitmask from .parainstructions commit a70210f41566131f88d31583f96e36cb7f5d2ad0 Merge: 3ef3ace4e2ecf be1b670f61443 Author: Linus Torvalds Date: Tue Dec 13 15:05:29 2022 -0800 Merge tag 'x86_microcode_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode and IFS updates from Borislav Petkov: "The IFS (In-Field Scan) stuff goes through tip because the IFS driver uses the same structures and similar functionality as the microcode loader and it made sense to route it all through this branch so that there are no conflicts. - Add support for multiple testing sequences to the Intel In-Field Scan driver in order to be able to run multiple different test patterns. Rework things and remove the BROKEN dependency so that the driver can be enabled (Jithu Joseph) - Remove the subsys interface usage in the microcode loader because it is not really needed - A couple of smaller fixes and cleanups" * tag 'x86_microcode_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) x86/microcode/intel: Do not retry microcode reloading on the APs x86/microcode/intel: Do not print microcode revision and processor flags platform/x86/intel/ifs: Add missing kernel-doc entry Revert "platform/x86/intel/ifs: Mark as BROKEN" Documentation/ABI: Update IFS ABI doc platform/x86/intel/ifs: Add current_batch sysfs entry platform/x86/intel/ifs: Remove reload sysfs entry platform/x86/intel/ifs: Add metadata validation platform/x86/intel/ifs: Use generic microcode headers and functions platform/x86/intel/ifs: Add metadata support x86/microcode/intel: Use a reserved field for metasize x86/microcode/intel: Add hdr_type to intel_microcode_sanity_check() x86/microcode/intel: Reuse microcode_sanity_check() x86/microcode/intel: Use appropriate type in microcode_sanity_check() x86/microcode/intel: Reuse find_matching_signature() platform/x86/intel/ifs: Remove memory allocation from load path platform/x86/intel/ifs: Remove image loading during init platform/x86/intel/ifs: Return a more appropriate error code platform/x86/intel/ifs: Remove unused selection x86/microcode: Drop struct ucode_cpu_info.valid ... commit 3ef3ace4e2ecf4aa4c8ddff1d35683671a09b05e Merge: 4eb77fa102ebc 7882b69eb6cdf Author: Linus Torvalds Date: Tue Dec 13 14:56:56 2022 -0800 Merge tag 'x86_cpu_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Borislav Petkov: - Split MTRR and PAT init code to accomodate at least Xen PV and TDX guests which do not get MTRRs exposed but only PAT. (TDX guests do not support the cache disabling dance when setting up MTRRs so they fall under the same category) This is a cleanup work to remove all the ugly workarounds for such guests and init things separately (Juergen Gross) - Add two new Intel CPUs to the list of CPUs with "normal" Energy Performance Bias, leading to power savings - Do not do bus master arbitration in C3 (ARB_DISABLE) on modern Centaur CPUs * tag 'x86_cpu_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits) x86/mtrr: Make message for disabled MTRRs more descriptive x86/pat: Handle TDX guest PAT initialization x86/cpuid: Carve out all CPUID functionality x86/cpu: Switch to cpu_feature_enabled() for X86_FEATURE_XENPV x86/cpu: Remove X86_FEATURE_XENPV usage in setup_cpu_entry_area() x86/cpu: Drop 32-bit Xen PV guest code in update_task_stack() x86/cpu: Remove unneeded 64-bit dependency in arch_enter_from_user_mode() x86/cpufeatures: Add X86_FEATURE_XENPV to disabled-features.h x86/acpi/cstate: Optimize ARB_DISABLE on Centaur CPUs x86/mtrr: Simplify mtrr_ops initialization x86/cacheinfo: Switch cache_ap_init() to hotplug callback x86: Decouple PAT and MTRR handling x86/mtrr: Add a stop_machine() handler calling only cache_cpu_init() x86/mtrr: Let cache_aps_delayed_init replace mtrr_aps_delayed_init x86/mtrr: Get rid of __mtrr_enabled bool x86/mtrr: Simplify mtrr_bp_init() x86/mtrr: Remove set_all callback from struct mtrr_ops x86/mtrr: Disentangle MTRR init from PAT init x86/mtrr: Move cache control code to cacheinfo.c x86/mtrr: Split MTRR-specific handling from cache dis/enabling ... commit 4eb77fa102ebc2a48d61941fd0293b0aeed00fee Merge: 8b9ed79c2d587 60253f100c584 Author: Linus Torvalds Date: Tue Dec 13 14:45:29 2022 -0800 Merge tag 'x86_boot_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Borislav Petkov: "A of early boot cleanups and fixes. - Do some spring cleaning to the compressed boot code by moving the EFI mixed-mode code to a separate compilation unit, the AMD memory encryption early code where it belongs and fixing up build dependencies. Make the deprecated EFI handover protocol optional with the goal of removing it at some point (Ard Biesheuvel) - Skip realmode init code on Xen PV guests as it is not needed there - Remove an old 32-bit PIC code compiler workaround" * tag 'x86_boot_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Remove x86_32 PIC using %ebx workaround x86/boot: Skip realmode init code when running as Xen PV guest x86/efi: Make the deprecated EFI handover protocol optional x86/boot/compressed: Only build mem_encrypt.S if AMD_MEM_ENCRYPT=y x86/boot/compressed: Adhere to calling convention in get_sev_encryption_bit() x86/boot/compressed: Move startup32_check_sev_cbit() out of head_64.S x86/boot/compressed: Move startup32_check_sev_cbit() into .text x86/boot/compressed: Move startup32_load_idt() out of head_64.S x86/boot/compressed: Move startup32_load_idt() into .text section x86/boot/compressed: Pull global variable reference into startup32_load_idt() x86/boot/compressed: Avoid touching ECX in startup32_set_idt_entry() x86/boot/compressed: Simplify IDT/GDT preserve/restore in the EFI thunk x86/boot/compressed, efi: Merge multiple definitions of image_offset into one x86/boot/compressed: Move efi32_pe_entry() out of head_64.S x86/boot/compressed: Move efi32_entry out of head_64.S x86/boot/compressed: Move efi32_pe_entry into .text section x86/boot/compressed: Move bootargs parsing out of 32-bit startup code x86/boot/compressed: Move 32-bit entrypoint code into .text section x86/boot/compressed: Rename efi_thunk_64.S to efi-mixed.S commit 8b9ed79c2d587bec5f603d66801478a5af9af842 Merge: fc4c9f450493d bce5a1e8a3400 Author: Linus Torvalds Date: Tue Dec 13 14:40:54 2022 -0800 Merge tag 'x86_asm_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Borislav Petkov: - Move the 32-bit memmove() asm implementation out-of-line in order to fix a 32-bit full LTO build failure with clang where it would fail at register allocation. Move it to an asm file and clean it up while at it, similar to what has been already done on 64-bit * tag 'x86_asm_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mem: Move memmove to out of line assembler commit fc4c9f450493daef1c996c9d4b3c647ec3121509 Merge: 717e6eb49bdd9 e8dfdf3162eb5 Author: Linus Torvalds Date: Tue Dec 13 14:31:47 2022 -0800 Merge tag 'efi-next-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Another fairly sizable pull request, by EFI subsystem standards. Most of the work was done by me, some of it in collaboration with the distro and bootloader folks (GRUB, systemd-boot), where the main focus has been on removing pointless per-arch differences in the way EFI boots a Linux kernel. - Refactor the zboot code so that it incorporates all the EFI stub logic, rather than calling the decompressed kernel as a EFI app. - Add support for initrd= command line option to x86 mixed mode. - Allow initrd= to be used with arbitrary EFI accessible file systems instead of just the one the kernel itself was loaded from. - Move some x86-only handling and manipulation of the EFI memory map into arch/x86, as it is not used anywhere else. - More flexible handling of any random seeds provided by the boot environment (i.e., systemd-boot) so that it becomes available much earlier during the boot. - Allow improved arch-agnostic EFI support in loaders, by setting a uniform baseline of supported features, and adding a generic magic number to the DOS/PE header. This should allow loaders such as GRUB or systemd-boot to reduce the amount of arch-specific handling substantially. - (arm64) Run EFI runtime services from a dedicated stack, and use it to recover from synchronous exceptions that might occur in the firmware code. - (arm64) Ensure that we don't allocate memory outside of the 48-bit addressable physical range. - Make EFI pstore record size configurable - Add support for decoding CXL specific CPER records" * tag 'efi-next-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (43 commits) arm64: efi: Recover from synchronous exceptions occurring in firmware arm64: efi: Execute runtime services from a dedicated stack arm64: efi: Limit allocations to 48-bit addressable physical region efi: Put Linux specific magic number in the DOS header efi: libstub: Always enable initrd command line loader and bump version efi: stub: use random seed from EFI variable efi: vars: prohibit reading random seed variables efi: random: combine bootloader provided RNG seed with RNG protocol output efi/cper, cxl: Decode CXL Error Log efi/cper, cxl: Decode CXL Protocol Error Section efi: libstub: fix efi_load_initrd_dev_path() kernel-doc comment efi: x86: Move EFI runtime map sysfs code to arch/x86 efi: runtime-maps: Clarify purpose and enable by default for kexec efi: pstore: Add module parameter for setting the record size efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures efi: memmap: Move manipulation routines into x86 arch tree efi: memmap: Move EFI fake memmap support into x86 arch tree efi: libstub: Undeprecate the command line initrd loader efi: libstub: Add mixed mode support to command line initrd loader efi: libstub: Permit mixed mode return types other than efi_status_t ... commit 717e6eb49bdd98357d14c90d60a3409196b33cfc Merge: 8fa37a68359d2 b6018af440a07 Author: Linus Torvalds Date: Tue Dec 13 14:22:50 2022 -0800 Merge tag 'integrity-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Aside from the one cleanup, the other changes are bug fixes: Cleanup: - Include missing iMac Pro 2017 in list of Macs with T2 security chip Bug fixes: - Improper instantiation of "encrypted" keys with user provided data - Not handling delay in updating LSM label based IMA policy rules (-ESTALE) - IMA and integrity memory leaks on error paths - CONFIG_IMA_DEFAULT_HASH_SM3 hash algorithm renamed" * tag 'integrity-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Fix hash dependency to correct algorithm ima: Fix misuse of dereference of pointer in template_desc_init_fields() integrity: Fix memory leakage in keyring allocation error path ima: Fix memory leak in __ima_inode_hash() ima: Handle -ESTALE returned by ima_filter_rule_match() ima: Simplify ima_lsm_copy_rule ima: Fix a potential NULL pointer access in ima_restore_measurement_list efi: Add iMac Pro 2017 to uefi skip cert quirk KEYS: encrypted: fix key instantiation with user-provided data commit 8fa37a68359d2d5dc16deeb5b09d64c9833c0674 Merge: 3ba2c3ff98ea8 0dff89c4488f9 Author: Linus Torvalds Date: Tue Dec 13 14:16:44 2022 -0800 Merge tag 'sysctl-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "Only a small step forward on the sysctl cleanups for this cycle" * tag 'sysctl-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sched: Move numa_balancing sysctls to its own file commit 47ea20762bb7875a62e10433a3cd5d34e9133f47 Author: Shikang Fan Date: Thu Dec 8 19:53:14 2022 +0800 drm/amdgpu: Add an extra evict_resource call during device_suspend. - evict_resource is taking too long causing sriov full access mode timeout. So, add an extra evict_resource in the beginning as an early evict. Signed-off-by: Shikang Fan Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3ba2c3ff98ea8bfb219288dbacf2a23a902c751b Merge: 0015edd6f6617 4f1354d5c6a32 Author: Linus Torvalds Date: Tue Dec 13 14:05:39 2022 -0800 Merge tag 'modules-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules updates from Luis Chamberlain: "Tux gets for xmas an improvement to the average lookup performance of kallsyms_lookup_name() by 715x thanks to the work by Zhen Lei, which upgraded our old implementation from being O(n) to O(log(n)), while also retaining the old implementation support on /proc/kallsyms. The only penalty was increasing the memory footprint by 3 * kallsyms_num_syms. Folks who want to improve this further now also have a dedicated selftest facility through KALLSYMS_SELFTEST. Stephen Boyd added zstd in-kernel decompression support, but the only users of this would be folks using the load-pin LSM because otherwise we do module decompression in userspace. The only other thing with mentioning is a minor boot time optimization by Rasmus Villemoes which deferes param_sysfs_init() to late init. The rest is cleanups and minor fixes" * tag 'modules-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: livepatch: Call klp_match_callback() in klp_find_callback() to avoid code duplication module/decompress: Support zstd in-kernel decompression kallsyms: Remove unneeded semicolon kallsyms: Add self-test facility livepatch: Use kallsyms_on_each_match_symbol() to improve performance kallsyms: Add helper kallsyms_on_each_match_symbol() kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[] kallsyms: Correctly sequence symbols when CONFIG_LTO_CLANG=y kallsyms: Improve the performance of kallsyms_lookup_name() scripts/kallsyms: rename build_initial_tok_table() module: Fix NULL vs IS_ERR checking for module_get_next_page kernel/params.c: defer most of param_sysfs_init() to late_initcall time module: Remove unused macros module_addr_min/max module: remove redundant module_sysfs_initialized variable commit 0015edd6f66172f93aa720192020138ca13ba0a6 Merge: 71946a25f357a 0e2c9884cbbae Author: Linus Torvalds Date: Tue Dec 13 13:46:07 2022 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver updates from Stephen Boyd: "A pile of clk driver updates with a small tracepoint patch to the clk core this time around. The core framework is effectively unchanged, with the majority of the diff going to the Qualcomm clk driver directory because they added two 3k line files that are almost all clk data (Abel Vesa from Linaro tried to shrink the number of lines down, but it doesn't seem to be possible without sacrificing readability). The second big driver this time around is the Rockchip rk3588 clk and reset unit, at _only_ 2.5k lines. Ignoring the big clk drivers from the familiar SoC vendors, there's just a bunch of little clk driver updates and fixes throughout here. It's the usual set of clk data fixups to describe proper parents, or add frequencies to frequency tables, or plug memory leaks when function calls fail. Also, some drivers are converted to use modern clk_hw APIs, which is always nice to see. And data is deduplicated, leading to a smaller kernel Image. Overall this batch has a larger collection of cleanups than it typically does. Maybe that means there are less new SoCs right now that need supporting, and the focus has shifted to quality and reliability. I can dream. New Drivers: - Frequency hopping controller hardware on MediaTek MT8186 - Global clock controller for Qualcomm SM8550 - Display clock controller for Qualcomm SC8280XP - RPMh clock controller for Qualcomm QDU1000 and QRU1000 SoCs - CPU PLL on MStar/SigmaStar SoCs - Support for the clock and reset unit of the Rockchip rk3588 Updates: - Tracepoints for clk_rate_request structures - Debugfs support for fractional divider clk - Make MxL's CGU driver secure compatible - Ingenic JZ4755 SoC clk support - Support audio clks on X1000 SoCs - Remove flags from univ/main/syspll child fixed factor clocks across MediaTek platforms - Fix clock dependency for ADC on MediaTek MT7986 - Fix parent for FlexSPI clock for i.MX93 - Add USB suspend clock on i.MX8MP - Unmap anatop base on error for i.MX93 driver - Change enet clock parent to wakeup_axi_root for i.MX93 - Drop LPIT1, LPIT2, TPM1 and TPM3 clocks for i.MX93 - Mark HSIO bus clock and SYS_CNT clock as critical on i.MX93 - Add 320MHz and 640MHz entries to PLL146x - Add audio shared gate and SAI clocks for i.MX8MP - Fix a possible memory leak in the error path of rockchip PLL creation - Fix header guard for V3S clocks - Add IR module clock for f1c100s - Correct the parent clocks for the (High Speed) Serial Communication Interfaces with FIFO ((H)SCIF) modules and the mixed-up Ethernet Switch clocks on Renesas R-Car S4-8 - Add timer (TMU, CMT) and Cortex-A76 CPU core (Z0) clocks on Renesas R-Car V4H - Two PLL driver fixups for the Amlogic clk driver - Round SD clock rate to improve parent clock selection - Add Ethernet Switch and internal SASYNCPER clocks on Renesas R-Car S4-8 - Add DMA (SYS-DMAC), SPI (MSIOF), external interrupt (INTC-EX) serial (SCIF), PWM (PWM and TPU), SDHI, and HyperFLASH/QSPI (RPC-IF) clocks on Renesas R-Car V4H - Add Multi-Function Timer Pulse Unit (MTU3a) clock and reset on Renesas RZ/G2L - Fix endless loop on Renesas RZ/N1 - Correct the parent clocks for the High Speed Serial Communication Interfaces with FIFO (HSCIF) modules on the Renesas R-Car V4H SoC Note: HSCIF0 is used for the serial console on the White-Hawk development board - Various clk DT binding improvements and conversions to YAML - Qualcomm SM8150/SM8250 display clock controller cleaned up - Some missing clocks for Qualcomm SM8350 added - Qualcomm MSM8974 Global and Multimedia clock controllers transitioned to parent_data and parent_hws - Use parent_data and add network resets for Qualcomm IPQ8074 - Qualcomm Krait clock controller modernized - Fix pm_runtime usage in Qualcomm SC7180 and SC7280 LPASS clock controllers - Enable retention mode on Qualcomm SM8250 USB GDSCs - Cleanup Qualcomm RPM and RPMh clock drivers to avoid duplicating clocks which definition could be shared between platforms - Various NULL pointer checks added for allocations" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (188 commits) clk: nomadik: correct struct name kernel-doc warning clk: lmk04832: fix kernel-doc warnings clk: lmk04832: drop superfluous #include clk: lmk04832: drop unnecessary semicolons clk: lmk04832: declare variables as const when possible clk: socfpga: Fix memory leak in socfpga_gate_init() clk: microchip: enable the MPFS clk driver by default if SOC_MICROCHIP_POLARFIRE clk: st: Fix memory leak in st_of_quadfs_setup() clk: samsung: Fix memory leak in _samsung_clk_register_pll() clk: Add trace events for rate requests clk: Store clk_core for clk_rate_request clk: qcom: rpmh: add support for SM6350 rpmh IPA clock clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: mmcc-msm8974: move clock parent tables down clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: gcc-msm8974: move clock parent tables down clk: qcom: gcc-msm8974: use ARRAY_SIZE instead of specifying num_parents dt-bindings: clocks: qcom,mmcc: define clocks/clock-names for MSM8974 dt-bindings: clock: split qcom,gcc-msm8974,-msm8226 to the separate file ... commit 71946a25f357a51dcce849367501d7fb04c0465b Merge: 90b12f423d3c8 ff874dbc4f868 Author: Linus Torvalds Date: Tue Dec 13 13:41:26 2022 -0800 Merge tag 'mmc-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC and MEMSTICK updates from Ulf Hansson: "MMC core: - A few minor improvements and cleanups MMC host: - Remove some redundant calls to local_irq_{save,restore}() - Replace kmap_atomic() with kmap_local_page() - Take return values from mmc_add_host() into account - dw_mmc-pltfm: Add support to configure clk-phase for socfpga - hsq: Minimize latency by using a fifo to dispatch requests - litex_mmc: Fixup corner case for polling mode - mtk-sd: Add inline crypto engine clock control - mtk-sd: Add support for the mediatek MT7986 variant - renesas_sdhi: Improve reset from HS400 mode - renesas_sdhi: Take DMA end interrupts into account - sdhci: Avoid unnecessary update of clock - sdhci: Fix an SD tuning issue - sdhci-brcmst: Add Kamal Dasu as maintainer for the Broadcom driver - sdhci-esdhc-imx: Improve tuning logic - sdhci-esdhc-imx: Improve support for the imxrt1050 variant - sdhci_f_sdh30: Add support for non-removable media - sdhci_f_sdh30: Add support for the Socionext F_SDH30_E51 variant - sdhci_f_sdh30: Add reset control support - sdhci-msm: Add support for the Qcom SM8550/SM8350/SM6375 variants - sdhci-msm: Add support for the Qcom MSM8976 variant - sdhci-of-arasan: Add support for dynamic configuration - sdhci-of-esdhc: Limit the clock frequency to confirm to spec - sdhci-pci: Enable asynchronous probe - sdhci-sprd: Improve card detection - sdhci-tegra: Improve reset support - sdhci-tegra: Add support to program MC stream ID - sunplus-mmc: Add new mmc driver for the Sunplus SP7021 controller - vub300: Fix warning splat for SDIO irq MEMSTICK core: - memstick: A few minor improvements and cleanups CLK/IOMMU: - clk: socfpga: Drop redundant support for clk-phase for the SD/MMC clk - iommu: Add tegra specific helper to get stream_id" * tag 'mmc-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (108 commits) mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K mmc: sdhci-of-esdhc: Modify mismatched function name memstick/mspro_block: Convert to use sysfs_emit()/sysfs_emit_at() APIs mmc: sdhci-tegra: Issue CMD and DAT resets together mmc: sdhci-tegra: Add support to program MC stream ID mmc: sdhci-tegra: Separate Tegra194 and Tegra234 SoC data mmc: sdhci-tegra: Sort includes alphabetically iommu/tegra: Add tegra_dev_iommu_get_stream_id() helper iommu: Add note about struct iommu_fwspec usage mmc: sdhci-brcmstb: Resolve "unused" warnings with CONFIG_OF=n dt-bindings: mmc: sdhci-msm: allow dma-coherent dt-bindings: mmc: sdhci-msm: drop properties mentioned in common MMC dt-bindings: mmc: sdhci-msm: cleanup style dt-bindings: mmc: sdhci-am654: cleanup style dt-bindings: mmc: sdhci: document sdhci-caps and sdhci-caps-mask mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING MAINTAINERS: Update maintainer for SDHCI Broadcom BRCMSTB driver mmc: sdhci-of-esdhc: limit the SDHC clock frequency mmc: sdhci: Remove unneeded semicolon mmc: core: Normalize the error handling branch in sd_read_ext_regs() ... commit 90b12f423d3c8a89424c7bdde18e1923dfd0941e Merge: 2043f9a37d163 c6f613e5f35b0 Author: Linus Torvalds Date: Tue Dec 13 13:36:39 2022 -0800 Merge tag 'for-linus-6.2-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "This includes a number of small fixes, as usual. It also includes a new driver for doing the i2c (SSIF) interface BMC-side, pretty much completing the BMC side interfaces" * tag 'for-linus-6.2-1' of https://github.com/cminyard/linux-ipmi: ipmi/watchdog: use strscpy() to instead of strncpy() ipmi: ssif_bmc: Convert to i2c's .probe_new() ipmi: fix use after free in _ipmi_destroy_user() ipmi/watchdog: Include when appropriate ipmi:ssif: Increase the message retry time ipmi: Fix some kernel-doc warnings ipmi: ssif_bmc: Use EPOLLIN instead of POLLIN ipmi: fix msg stack when IPMI is disconnected ipmi: fix memleak when unload ipmi driver ipmi: fix long wait in unload when IPMI disconnect ipmi: kcs: Poll OBF briefly to reduce OBE latency bindings: ipmi: Add binding for SSIF BMC driver ipmi: ssif_bmc: Add SSIF BMC driver commit 2043f9a37d163ef4f572992bec7cdcdf54d965de Merge: 86a0b4255e845 f722052c990b6 Author: Linus Torvalds Date: Tue Dec 13 13:32:56 2022 -0800 Merge tag 'for-linus-2022121301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - iio support for the MCP2221 HID driver (Matt Ranostay) - support for more than one hinge sensor in hid-sensor-custom (Yauhen Kharuzhy) - PS DualShock 4 controller support (Roderick Colenbrander) - XP-PEN Deco LW support (José Expósito) - other assorted code cleanups and device ID/quirk addtions * tag 'for-linus-2022121301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (51 commits) HID: logitech HID++: Send SwID in GetProtocolVersion HID: hid-elan: use default remove for hid device HID: hid-alps: use default remove for hid device HID: hid-sensor-custom: set fixed size for custom attributes HID: i2c: let RMI devices decide what constitutes wakeup event HID: playstation: fix DualShock4 bluetooth CRC endian issue. HID: playstation: fix DualShock4 bluetooth memory corruption bug. HID: apple: Swap Control and Command keys on Apple keyboards HID: intel-ish-hid: ishtp: remove variable rb_count HID: uclogic: Standardize test name prefix HID: hid-sensor-custom: Allow more than one hinge angle sensor HID: ft260: fix 'cast to restricted' kernel CI bot warnings HID: ft260: missed NACK from busy device HID: ft260: fix a NULL pointer dereference in ft260_i2c_write HID: ft260: wake up device from power saving mode HID: ft260: missed NACK from big i2c read HID: ft260: remove SMBus Quick command support HID: ft260: skip unexpected HID input reports HID: ft260: do not populate /dev/hidraw device HID: ft260: improve i2c large reads performance ... commit 86a0b4255e84563739d137ad374af6c7215bb3ff Merge: 531d2644f3b10 e291c116f60f3 Author: Linus Torvalds Date: Tue Dec 13 13:20:36 2022 -0800 Merge tag 'input-for-v6.2-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new driver for Cypress Generation 5 touchscreens - a new driver for Hynitron cstxxx touchscreens - a new driver for Himax hx83112b touchscreen - I2C input devices have been converted to use i2c's probe_new() - a large number of input devices are now using DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr() and no longer use __maybe_unused annotations - improvements to msg2638 touchscreen driver to also support msg2138 - conversion of several input deevine bindings to yaml/DT schema - changes to select touch drivers to move handling of wake irqs to the PM core - other assorted fixes and improvements. * tag 'input-for-v6.2-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (165 commits) Input: elants_i2c - delay longer with reset asserted dt-bindings: input: Convert ti,drv260x to DT schema dt-bindings: input: gpio-beeper: Convert to yaml schema Input: pxspad - fix unused data warning when force feedback not enabled Input: lpc32xx - allow building with COMPILE_TEST Input: nomadik-ske-keypad - allow building with COMPILE_TEST Input: pxa27xx-keypad - allow build with COMPILE_TEST Input: spear-keyboard - improve build coverage using COMPILE_TEST Input: tegra-kbc - allow build with COMPILE_TEST Input: tegra-kbc - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: tca6416-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: tc3589x - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: st-keyscan - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: sh-keysc - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: qt1070 - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: pxa27x_keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: pmic8xxx-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: nomadik-ske-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: mcs-touchkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Input: max7359-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() ... commit 531d2644f3b10098dadb25b2c26cf19ec0330f90 Merge: 4d03390b5cb97 580f9896e088b Author: Linus Torvalds Date: Tue Dec 13 13:13:55 2022 -0800 Merge tag 'devicetree-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT Bindings: - Various LED binding conversions and clean-ups. Convert the ir-spi-led, pwm-ir-tx, and gpio-ir-tx LED bindings to schemas. Consistently reference LED common.yaml or multi-led schemas and disallow undefined properties. - Convert IDT 89HPESx, pwm-clock, st,stmipid02, Xilinx PCIe hosts, and fsl,imx-fb bindings to schema - Add ata-generic, Broadcom u-boot environment, and dynamic MTD sub-partitions bindings. - Make all SPI based displays reference spi-peripheral-props.yaml - Fix some schema property regex's which should be fixed strings or were missing start/end anchors - Remove 'status' in examples, again... DT Core: - Fix a possible NULL dereference in overlay functions - Fix kexec reading 32-bit "linux,initrd-{start,end}" values (which never worked) - Add of_address_count() helper to count number of 'reg' entries - Support .dtso extension for DT overlay source files. Rename staging and unittest overlay files. - Update dtc to upstream v1.6.1-63-g55778a03df61" * tag 'devicetree-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (42 commits) dt-bindings: leds: Add missing references to common LED schema dt-bindings: leds: intel,lgm: Add missing 'led-gpios' property of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() dt-bindings: lcdif: Fix constraints for imx8mp media: dt-bindings: atmel,isc: Drop unneeded unevaluatedProperties dt-bindings: Drop Jee Heng Sia dt-bindings: thermal: cooling-devices: Add missing cache related properties dt-bindings: leds: irled: ir-spi-led: convert to DT schema dt-bindings: leds: irled: pwm-ir-tx: convert to DT schema dt-bindings: leds: irled: gpio-ir-tx: convert to DT schema dt-bindings: leds: mt6360: rework to match multi-led dt-bindings: leds: lp55xx: rework to match multi-led dt-bindings: leds: lp55xx: switch to preferred 'gpios' suffix dt-bindings: leds: lp55xx: allow label dt-bindings: leds: use unevaluatedProperties for common.yaml dt-bindings: thermal: tsens: Add SM6115 compatible of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values dt-bindings: display: Convert fsl,imx-fb.txt to dt-schema dt-bindings: Add missing start and/or end of line regex anchors dt-bindings: qcom,pdc: Add missing compatibles ... commit 4d03390b5cb97ea8562fcf324106c4735805d558 Merge: 361c89a0da59c 364ffd2537c44 Author: Linus Torvalds Date: Tue Dec 13 13:09:38 2022 -0800 Merge tag 'hwmon-for-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Driver for OneXPlayer mini AMD sensors - Ampere's Altra smpro-hwmon driver New chip and attribute support in existing drivers: - nct6775: Support for ASUS CROSSHAIR VIII/TUF/ProArt B550M - pmbus/ltc2978: Support for LTC7132 - aquacomputer_d5next: Support for temperature sensor offsets and flow sensor pulses - coretemp: Support for dynamic ttarget and tjmax Improvements: - Use devm_regulator_get_enable() where appropriate - Use sysfs_emit() instead of scnprintf() - Remove some useless #include - Include when appropriate - Use simple i2c probe - it87: Check for a valid chip before using force_id, and new new module parameter to ignore ACPI resource conflicts - jc42: Use regmap, and restore min/max/critical temperatures on resume - Add reporting power good and status to PMBus based regulators Last minute fixes: - emc2305: Fix probing of emc2301/2/3, and fix setting pwm values manually if THERMAL is enabled And various other minor fixes and improvements" * tag 'hwmon-for-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (37 commits) hwmon: (emc2305) fix pwm never being able to set lower hwmon: (emc2305) fix unable to probe emc2301/2/3 hwmon: (dell-smm) Move error message to make probing silent hwmon: use sysfs_emit() to instead of scnprintf() hwmon: (oxp-sensors) Fix pwm reading hwmon: (aquacomputer_d5next) Add support for Quadro flow sensor pulses hwmon: (pmbus/core) Implement regulator get_status hwmon: (oxp-sensors) Add AOK ZOE and Mini PRO hwmon: (gsc-hwmon) Switch to flexible array to simplify code hwmon: (pmbus) Add power good support hwmon: (nct6775) add ASUS CROSSHAIR VIII/TUF/ProArt B550M hwmon: (coretemp) Add support for dynamic ttarget hwmon: (coretemp) Add support for dynamic tjmax hwmon: (coretemp) rearrange tjmax handing code hwmon: Remove some useless #include hwmon: (coretemp) Remove obsolete temp_data->valid hwmon: add OneXPlayer mini AMD sensors driver hwmon: (aquacomputer_d5next) Clear up macros and comments hwmon: (it87) Add DMI table for future extensions hwmon: Include when appropriate ... commit 361c89a0da59c04b1d3d33568965fe426b0f18de Merge: d0f3ad23cf4f4 83e1bcaf8cef2 Author: Linus Torvalds Date: Tue Dec 13 13:03:06 2022 -0800 Merge tag 'pinctrl-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "The two large chunks is the header clean-up from Andy and the Qualcomm DT bindings clean-up from Krzysztof. Each which could give rise to conflicts, but I haven't seen any. The YAML conversions happening around the device tree is the biggest item in the series and is the result of Rob Herrings ambition to autovalidate these trees against strict schemas and it is paying off in lots of bugs found and ever prettier device trees. Sooner or later the transition will be complete, Krzysztof is fixing up all of the Qualcomm stuff, which is pretty voluminous. Core changes: - minor but nice and important documentation clean-ups New drivers: - subdriver for the Qualcomm SDM670 SoC - subdriver for the Intel Moorefield SoC - trivial support for the NXP Freescale i.MXRT1170 SoC Other changes and improvements - major clean-up of the Qualcomm pin control device tree bindings by Krzysztof - major header clean-up by Andy - some immutable irqchip clean-up for the Actions Semiconductor and Nuvoton drivers - GPIO helpers for The Cypress cy8c95x0 driver - bias handling in the Mediatek MT7986 driver - remove the unused pins-are-numbered concept that never flew" * tag 'pinctrl-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (231 commits) pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions() dt-bindings: pinctrl: st,stm32: Deprecate pins-are-numbered dt-bindings: pinctrl: mediatek,mt65xx: Deprecate pins-are-numbered pinctrl: stm32: Remove check for pins-are-numbered pinctrl: mediatek: common: Remove check for pins-are-numbered pinctrl: qcom: remove duplicate included header files pinctrl: sunxi: d1: Add CAN bus pinmuxes pinctrl: loongson2: Fix some const correctness pinctrl: pinconf-generic: add missing of_node_put() pinctrl: intel: Enumerate PWM device when community has a capability pwm: lpss: Rename pwm_lpss_probe() --> devm_pwm_lpss_probe() pwm: lpss: Allow other drivers to enable PWM LPSS pwm: lpss: Include headers we are the direct user of pwm: lpss: Rename MAX_PWMS --> LPSS_MAX_PWMS pwm: Add a stub for devm_pwmchip_add() pinctrl: k210: call of_node_put() pinctrl: starfive: Use existing variable gpio dt-bindings: pinctrl: semtech,sx150xq: fix match patterns for 16 GPIOs matching pinconf-generic: fix style issues in pin_config_param doc pinctrl: pinctrl-loongson2: fix Kconfig dependency ... commit d0f3ad23cf4f4046e88eef92c608d43cad9e4f7e Merge: c5589c436d464 3cf241c3d56ff Author: Linus Torvalds Date: Tue Dec 13 12:54:31 2022 -0800 Merge tag 'spi-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "A busy enough release, but not for the core which has only seen very small updates. The biggest addition is the readdition of support for detailed configuration of the timings around chip selects. That had been removed for lack of use but there's been applications found for it on Atmel systems. Otherwise the updates are mostly feature additions and cleanups to existing drivers. Summary: - Provide a helper for getting device match data in a way that abstracts away which firmware interface is being used. - Re-add the spi_set_cs_timing() API for detailed configuration of the timing around chip select and support it on Atmel. - Support for MediaTek MT7986, Microchip PCI1xxxx, Nuvoton WPCM450 FIU and Socionext F_OSPI" * tag 'spi-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (66 commits) spi: dt-bindings: Convert Synquacer SPI to DT schema spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode spi: spi-mtk-nor: Add recovery mechanism for dma read timeout spi: spi-fsl-lpspi: add num-cs binding for lpspi spi: spi-fsl-lpspi: support multiple cs for lpspi spi: mtk-snfi: Add snfi support for MT7986 IC spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE spi: cadence-quadspi: Add minimum operable clock rate warning to baudrate divisor calculation spi: microchip: pci1xxxx: Add suspend and resume support for PCI1XXXX SPI driver spi: dt-bindings: nuvoton,wpcm450-fiu: Fix warning in example (missing reg property) spi: dt-bindings: nuvoton,wpcm450-fiu: Fix error in example (bogus include) spi: mediatek: Enable irq when pdata is ready spi: spi-mtk-nor: Unify write buffer on/off spi: intel: Add support for SFDP opcode spi: intel: Take possible chip address into account in intel_spi_read/write_reg() spi: intel: Implement adjust_op_size() spi: intel: Use ->replacement_op in intel_spi_hw_cycle() spi: cadence: Drop obsolete dependency on COMPILE_TEST spi: Add Nuvoton WPCM450 Flash Interface Unit (FIU) bindings spi: wpcm-fiu: Add direct map support ... commit c5589c436d4646e0dc23f64264db8e04cf67c88f Merge: b8cc9174ff9e7 8f3cbcd6b4400 Author: Linus Torvalds Date: Tue Dec 13 12:49:59 2022 -0800 Merge tag 'regulator-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "Quite a quiet release for regulator, the diffstat is dominated by the I2C migration to probe_new() and the newly added MT6357 driver. We've just one framework addition and the rest is all new device support, fixes and cleanups. The framework addition is an API for requesting all regulators defined in DT, this isn't great practice but has reasonable applications when there is generic code handling devices on buses where the bus specification doesn't include power. The immediate application is MDIO but I believe there's others, it's another API that'll need an eye keeping on it for undesirable usage. Summary: - An API for requesting all regulators defined in DT - Conversion of lots of drivers to the I2C probe_new() API - Support for Mediatek MT6357, Qualcomm PM8550, PMR735a and Richtek RT6190" * tag 'regulator-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (56 commits) regulator: core: Use different devices for resource allocation and DT lookup dt-bindings: Add missing 'unevaluatedProperties' to regulator nodes regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() regulator: add mt6357 regulator regulator: dt-bindings: Add binding schema for mt6357 regulators regulator: core: fix resource leak in regulator_register() regulator: core: fix module refcount leak in set_supply() regulator: core: fix use_count leakage when handling boot-on regulator: rk808: Use dev_err_probe regulator: rk808: reduce 'struct rk808' usage regulator: Drop obsolete dependencies on COMPILE_TEST regulator: pv88080-regulator: Convert to i2c's .probe_new() regulator: pfuze100-regulator: Convert to i2c's .probe_new() regulator: isl6271a-regulator: Convert to i2c's .probe_new() regulator: fan53555: Convert to i2c's .probe_new() regulator: act8865-regulator: Convert to i2c's .probe_new() regulator: qcom-rpmh: Add support for PM8550 regulators regulator: dt-bindings: qcom,rpmh: Add compatible for PM8550 regulator: tps65023-regulator: Convert to i2c's .probe_new() regulator: tps62360-regulator: Convert to i2c's .probe_new() ... commit fab89a09c86f948adfc7e20a7d608bd9f323bbe1 Author: Steven Rostedt (Google) Date: Mon Dec 12 19:38:14 2022 -0500 tracing: Remove pointer (asterisk) and brackets from cpumask_t field To differentiate between long arrays and cpumasks, the __cpumask() field was created. Part of the TRACE_EVENT() macros test if the type is signed or not by using the is_signed_type() macro. The __cpumask() field used the __dynamic_array() helper but because cpumask_t is a structure, it could not be used in the is_signed_type() macro as that would fail to build, so instead it passed in the pointer to cpumask_t. Unfortunately, that creates in the format file: field:__data_loc cpumask_t *[] mask; offset:36; size:4; signed:0; Which looks like an array of pointers to cpumask_t and not a cpumask_t type, which is misleading to user space parsers. Douglas Raillard pointed out that the "[]" are also misleading, as cpumask_t is not an array. Since cpumask() hasn't been created yet, and the parsers currently fail on it (but will still produce the raw output), make it be: field:__data_loc cpumask_t mask; offset:36; size:4; signed:0; Which is the correct type of the field. Then the parsers can be updated to handle this. Link: https://lore.kernel.org/lkml/6dda5e1d-9416-b55e-88f3-31d148bc925f@arm.com/ Link: https://lore.kernel.org/linux-trace-kernel/20221212193814.0e3f1e43@gandalf.local.home Cc: Masami Hiramatsu Cc: Valentin Schneider Cc: Andrew Morton Fixes: 8230f27b1ccc ("tracing: Add __cpumask to denote a trace event field that is a cpumask_t") Reported-by: Douglas Raillard Signed-off-by: Steven Rostedt (Google) commit a785736d7e587abbfd59df44e9a815d8d109c28c Author: Steven Rostedt (Google) Date: Tue Dec 13 09:56:02 2022 -0500 tracing: Have trigger filter parsing errors show up in error_log It is annoying that the filter parsing of triggers do not show up in the error_log. Trying to figure out what is incorrect in the input is difficult when it fails for a typo. Have the errors of filter parsing show up in error_log as well. Link: https://lore.kernel.org/linux-trace-kernel/20221213095602.083fa9fd@gandalf.local.home Cc: Masami Hiramatsu Cc: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit b8cc9174ff9e7b739c6fa61037759f885748fbf5 Merge: 1e4fa020d5747 22250dbaba99f Author: Linus Torvalds Date: Tue Dec 13 12:44:40 2022 -0800 Merge tag 'regmap-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "A few new APIs here, support for the FSI bus (which is used in some PowerPC systems) plus a couple of new APIs, one allowing abstractions built on top of regmap to tell if the regmap can be used in an atomic context and one providing a callback for an in flight device which can't do interrupt masking very well. There's also a fix that I never got round to sending because it really should be fixed better but that's not happened yet and it does avoid the problem, the fix was in -next for a long time" * tag 'regmap-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-irq: Add handle_mask_sync() callback regmap: Add FSI bus support regmap: add regmap_might_sleep() regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode commit 1e4fa020d574768445fca2d9bbfe473ec8bbd224 Merge: a594533df0f6c a34506e08db7c Author: Linus Torvalds Date: Tue Dec 13 12:32:07 2022 -0800 Merge tag 'mtd/for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "MTD core changes: - Fix refcount error in del_mtd_device() - Fix possible resource leak in init_mtd() - Set ROOT_DEV for partitions marked as rootfs in DT - Describe marking rootfs partitions in the bindings - Fix device name leak when register device fails in add_mtd_device() - Try to find OF node for every MTD partition - simplify (a bit) code find partition-matching dynamic OF node MTD driver changes: - pxa2xx-flash maps: fix memory leak in probe - BCM parser: refer to ARCH_BCMBCA instead of ARCH_BCM4908 - lpddr2_nvm: Fix possible null-ptr-deref - inftlcore: fix repeated words in comments - lart: remove driver - tplink: - Add TP-Link SafeLoader partitions table parser and bindings - Describe TP-Link SafeLoader parser - Describe TP-Link SafeLoader dynamic subpartitions - mtdoops: - Panic caused mtdoops to call mtdoops_erase function immediately - Add mtdoops_erase function and move mtdoops_inc_counter after it - Change printk() to counterpart pr_ functions MTD binding cleanup: - Fixed-partitions: Fix 'sercomm,scpart-id' schema - Standardize the style in the examples - Drop object types when referencing other files - Argue in favor of keeping additionalProperties set to true - NVMEM-cells: - Inherit from MTD partitions - Drop range property from example - Partitions: - Change qcom,smem-part partition type - Constrain the list of parsers - Physmap: Reuse the generic definitions - SPI-NOR: Drop common properties - Sunxi-nand: Add an example to validate the bindings - Onenand: Mention the expected node name - Ingenic: Mark partitions in the controller node as deprecated - NAND: - Standardize the child node name - Drop common properties already defined in generic files - nand-chip.yaml should reference mtd.yaml - Remove useless file about partitions - Clarify all partition subnodes SPI NOR core changes: - Add support for flash reset using the dt reset-gpios property. - Update hwcaps.mask to include 8D-8D-8D read and page program ops when xSPI profile 1.0 table is defined. - Bypass zero erase size in spi_nor_find_best_erase_type(). - Fix select_uniform_erase to skip 0 erase size - Add generic flash driver. If a flash is not found in the flash_info array, fall back to the generic flash driver which is described solely by the flash's SFDP tables. - Fix the number of bytes for the dummy cycles in spi_nor_spimem_check_readop(). - Introduce SPI_NOR_QUAD_PP flag, as PP_1_1_4 is not SFDP discoverable. SPI NOR manufacturer drivers changes: - Spansion: - use PARSE_SFDP for s28hs512t, - add support for s28hl512t, s28hl01gt, and s28hs01gt. - Gigadevice: Replace default_init() with post_bfpt() for gd25q256. - Micron - ST: Enable locking for mt25qu256a. - Winbond: Add support for W25Q512NW-IQ. - ISSI: Use PARSE_SFDP and SPI_NOR_QUAD_PP. Raw NAND core changes: - Drop obsolete dependencies on COMPILE_TEST - MAINTAINERS: rectify entry for MESON NAND controller bindings - Drop EXPORT_SYMBOL_GPL for nanddev_erase() Raw NAND driver changes: - marvell: Enable NFC/DEVBUS arbiter - gpmi: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync - mpc5121: Replace NO_IRQ by 0 - lpc32xx_{slc,mlc}: - Switch to using pm_ptr() - Switch to using gpiod API - lpc32xx_mlc: Switch to using pm_ptr() - cadence: Support 64-bit slave dma interface - rockchip: Describe rk3128-nfc in the bindings - brcmnand: Update interrupts description in the bindings SPI-NAND driver changes: - winbond: - Add Winbond W25N02KV flash support - Fix flash identification" * tag 'mtd/for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (76 commits) mtd: rawnand: Drop obsolete dependencies on COMPILE_TEST mtd: maps: pxa2xx-flash: fix memory leak in probe mtd: core: Fix refcount error in del_mtd_device() mtd: spi-nor: add SFDP fixups for Quad Page Program mtd: spi-nor: issi: is25wp256: Init flash based on SFDP mtd: spi-nor: winbond: add support for W25Q512NW-IQ mtd: spi-nor: micron-st: Enable locking for mt25qu256a mtd: spi-nor: Fix the number of bytes for the dummy cycles mtd: spi-nor: gigadevice: gd25q256: replace gd25q256_default_init with gd25q256_post_bfpt mtd: spi-nor: Fix formatting in spi_nor_read_raw() kerneldoc comment mtd: spi-nor: sysfs: print JEDEC ID for generic flash driver mtd: spi-nor: add generic flash driver mtd: spi-nor: fix select_uniform_erase to skip 0 erase size mtd: spi-nor: move function declaration out of sfdp.h mtd: spi-nor: remember full JEDEC flash ID mtd: spi-nor: sysfs: hide manufacturer if it is not set mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() mtd: rawnand: marvell: Enable NFC/DEVBUS arbiter mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908 ... commit a594533df0f6ca391da003f43d53b336a2d23ffa Merge: cdb9d35377119 66efff515a650 Author: Linus Torvalds Date: Tue Dec 13 11:59:58 2022 -0800 Merge tag 'drm-next-2022-12-13' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "The biggest highlight is that the accel subsystem framework is merged. Hopefully for 6.3 we will be able to line up a driver to use it. In drivers land, i915 enables DG2 support by default now, and nouveau has a big stability refactoring and initial ampere support, AMD includes new hw IP support and should build on ARM again. There is also an ofdrm driver to take over offb on platforms it's used. Stuff outside my tree, the dma-buf patches hit a few places, the vc4 firmware changes also do, and i915 has some interactions with MEI for discrete GPUs. I think all of those should have been acked/reviewed by relevant parties. New driver: - ofdrm - replacement for offb fbdev: - add support for nomodeset fourcc: - add Vivante tiled modifier core: - atomic-helpers: CRTC primary plane test fixes, fb access hooks - connector: TV API consistency, cmdline parser improvements - send connector hotplug on cleanup - sort makefile objects tests: - sort kunit tests - improve DP-MST tests - add kunit helpers to create a device sched: - module param for scheduling policy - refcounting fix buddy: - add back random seed log ttm: - convert ttm_resource to size_t - optimize pool allocations edid: - HFVSDB parsing support fixes - logging/debug improvements - DSC quirks dma-buf: - Add unlocked vmap and attachment mapping - move drivers to common locking convention - locking improvements firmware: - new API for rPI firmware and vc4 xilinx: - zynqmp: displayport bridge support - dpsub fix bridge: - adv7533: Remove dynamic lane switching - it6505: Runtime PM support, sync improvements - ps8640: Handle AUX defer messages - tc358775: Drop soft-reset over I2C panel: - panel-edp: Add INX N116BGE-EA2 C2 and C4 support. - Jadard JD9365DA-H3 - NewVision NV3051D amdgpu: - DCN support on ARM - DCN 2.1 secure display - Sienna Cichlid mode2 reset fixes - new GC 11.x firmware versions - drop AMD specific DSC workarounds in favour of drm code - clang warning fixes - scheduler rework - SR-IOV fixes - GPUVM locking fixes - fix memory leak in CS IOCTL error path - flexible array updates - enable new GC/PSP/SMU/NBIO IP - GFX preemption support for gfx9 amdkfd: - cache size fixes - userptr fixes - enable cooperative launch on gfx 10.3 - enable GC 11.0.4 KFD support radeon: - replace kmap with kmap_local_page - ACPI ref count fix - HDA audio notifier support i915: - DG2 enabled by default - MTL enablement work - hotplug refactoring - VBT improvements - Display and watermark refactoring - ADL-P workaround - temp disable runtime_pm for discrete- - fix for A380 as a secondary GPU - Wa_18017747507 for DG2 - CS timestamp support fixes for gen5 and earlier - never purge busy TTM objects - use i915_sg_dma_sizes for all backends - demote GuC kernel contexts to normal priority - gvt: refactor for new MDEV interface - enable DC power states on eDP ports - fix gen 2/3 workarounds nouveau: - fix page fault handling - Ampere acceleration support - driver stability improvements - nva3 backlight support msm: - MSM_INFO_GET_FLAGS support - DPU: XR30 and P010 image formats - Qualcomm SM6115 support - DSI PHY support for QCM2290 - HDMI: refactored dev init path - remove exclusive-fence hack - fix speed-bin detection - enable clamp to idle on 7c3 - improved hangcheck detection vmwgfx: - fb and cursor refactoring - convert to generic hashtable - cursor improvements etnaviv: - hw workarounds - softpin MMU fixes ast: - atomic gamma LUT support - convert to SHMEM lcdif: - support YUV planes - Increase DMA burst size - FIFO threshold tuning meson: - fix return type of cvbs mode_valid mgag200: - fix PLL setup on some revisions sun4i: - A100 and D1 support udl: - modesetting improvements - hot unplug support vc4: - support PAL-M - fix regression preventing 4K @ 60Hz - fix NULL ptr deref v3d: - switch to drm managed resources renesas: - RZ/G2L DSI support - DU Kconfig cleanup mediatek: - fixup dpi and hdmi - MT8188 dpi support - MT8195 AFBC support tegra: - NVDEC hardware on Tegra234 SoC hdlcd: - switch to drm managed resources ingenic: - fix registration error path hisilicon: - convert to drm_mode_init maildp: - use managed resources mtk: - use drm_mode_init rockchip: - use drm_mode_copy" * tag 'drm-next-2022-12-13' of git://anongit.freedesktop.org/drm/drm: (1397 commits) drm/amdgpu: fix mmhub register base coding error drm/amdgpu: add tmz support for GC IP v11.0.4 drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4 drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4 drm/amdgpu: enable GFX IP v11.0.4 CG support drm/amdgpu: Make amdgpu_ring_mux functions as static drm/amdgpu: generally allow over-commit during BO allocation drm/amd/display: fix array index out of bound error in DCN32 DML drm/amd/display: 3.2.215 drm/amd/display: set optimized required for comp buf changes drm/amd/display: Add debug option to skip PSR CRTC disable drm/amd/display: correct DML calc error of UrgentLatency drm/amd/display: correct static_screen_event_mask drm/amd/display: Ensure commit_streams returns the DC return code drm/amd/display: read invalid ddc pin status cause engine busy drm/amd/display: Bypass DET swath fill check for max clocks drm/amd/display: Disable uclk pstate for subvp pipes drm/amd/display: Fix DCN2.1 default DSC clocks drm/amd/display: Enable dp_hdmi21_pcon support drm/amd/display: prevent seamless boot on displays that don't have the preferred dig ... commit cdb9d3537711939e4d8fd0de2889c966f88346eb Merge: 102f9d3d45587 3178804c64ef7 Author: Linus Torvalds Date: Tue Dec 13 11:36:58 2022 -0800 Merge tag 'media/v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - DVB core changes to avoid refcount troubles and UAF - DVB API/core has gained support for DVB-C2 and DVB-S2X - New sensor drivers: ov08x40, ov4689.c, st-vgxy61 and tc358746.c - Removal of an unused sensor driver: s5k4ecgx - Move microchip_csi2dc to a new directory, named after the manufacturer - Add media controller support to Microship drivers - Old Atmel/Microship drivers that don't use media controler got moved to staging - New drivers added for Renesas RZ/G2L CRU and MIPI CSI-2 support - Allwinner A31 camera sensor driver code was now split into a bridge and a separate processor driver - Added a virtual stateless decoder driver in order to test core support for stateless drivers and test userspace apps using it - removed platform-based support for ov9650, as this is not used anymore - atomisp now uses videobuf2 and supports normal mmap mode - the imx7-media-csi driver got promoted from staging - rcar-vin driver has gained support for gen3 UDS (Up Down Scaler) - most i2c drivers now use I2C .probe_new() kAPI - lots of drivers fixes, cleanups and improvements * tag 'media/v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (544 commits) media: s5c73m3: Switch to GPIO descriptors media: i2c: s5k5baf: switch to using gpiod API media: i2c: s5k6a3: switch to using gpiod API media: imx: remove code for non-existing config IMX_GPT_ICAP media: si470x: Fix use-after-free in si470x_int_in_callback() media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies media: coda: Add check for kmalloc media: coda: Add check for dcoda_iram_alloc dt-bindings: media: s5c73m3: Fix reset-gpio descriptor media: dt-bindings: allwinner: h6-vpu-g2: Add IOMMU reference property media: s5k4ecgx: Delete driver media: s5k4ecgx: Switch to GPIO descriptors media: Switch to use dev_err_probe() helper headers: Remove some left-over license text in include/uapi/linux/v4l2-* headers: Remove some left-over license text in include/uapi/linux/dvb/ media: usb: pwc-uncompress: Use flex array destination for memcpy() media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 media: imx: Use get_mbus_config instead of parsing upstream DT endpoints ... commit 102f9d3d455870844c47b82322c2dfc0a35eb745 Merge: 8715c6d3100fc 8ec2d95f50c06 Author: Linus Torvalds Date: Tue Dec 13 11:27:26 2022 -0800 Merge tag 'sound-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "This looks like a relatively calm development cycle; there have been only few changes in ALSA and ASoC core sides while we get lots of device-specific fixes and updates as usual. Most of commits are about ASoC, including Intel SOF/AVS and many device tree updates. Below are some highlights: Core: - Improvement in memalloc helper for fallback allocations - More cleanups of ASoC DAPM code ASoC: - Factoring out of mapping hw_params onto SoundWire configuration - The ever ongoing overhauls of the Intel DSP code continue, including support for loading libraries and probes with IPC4 on SOF. - Support for more sample formats on JZ4740 - Lots of device tree conversions and fixups - Support for Allwinner D1, a range of AMD and Intel systems, Mediatek systems with multiple DMICs, Nuvoton NAU8318, NXP fsl_rpmsg and i.MX93, Qualcomm AudioReach Enable, MFC and SAL, RealTek RT1318 and Rockchip RK3588 ALSA: - Addition of PCM kselftest; still minimalistic but can be extended in future - Fixes for corner-case XRUNs with USB-audio implicit feedback mode - Usual device-specific quirk updates for USB- and HD-audio - FireWire DICE updates This also contains a few cross-tree updates: - Some OMAP board file updates for removal of relevant OMAP platforms - A new I2C API update for I2C probe API adaption - A DRM update for the further hdmi-codec updates" * tag 'sound-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (417 commits) ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock. ASoC: dt-bindings: Correct Alexandre Belloni email ASoC: dt-bindings: maxim,max98504: Convert to DT schema ASoC: dt-bindings: maxim,max98357a: Convert to DT schema ASoC: dt-bindings: Reference common DAI properties ASoC: dt-bindings: Extend name-prefix.yaml into common DAI properties ASoC: rt715: Make read-only arrays capture_reg_H and capture_reg_L static const ASoC: uniphier: aio-core: Make some read-only arrays static const ASoC: wcd938x: Make read-only array minCode_param static const ASoC: qcom: lpass-sc7280: Add maybe_unused tag for system PM ops ASoC : SOF: amd: Add support for IPC and DSP dumps ASoC: SOF: amd: Use poll function instead to read ACP_SHA_DSP_FW_QUALIFIER ALSA: usb-audio: Workaround for XRUN at prepare ALSA: pcm: Handle XRUN at trigger START ALSA: pcm: Set missing stop_operating flag at undoing trigger start drm: tda99x: Don't advertise non-existent capture support ASoC: hdmi-codec: Allow playback and capture to be disabled kselftest/alsa: Add more coverage of sample rates and channel counts ... commit 8715c6d3100fc7c6edddf29af4a399a1c12d028c Merge: 8ecd28b7a3a4c 7991dbff6849f Author: Linus Torvalds Date: Tue Dec 13 10:58:09 2022 -0800 Merge tag 'for-6.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Fix use-after-free races due to missing resource cleanup during DM target destruction in DM targets: thin-pool, cache, integrity and clone. - Fix ABBA deadlocks in DM thin-pool and cache targets due to their use of a bufio client (that has a shrinker whose locking can cause the incorrect locking order). - Fix DM cache target to set its needs_check flag after first aborting the metadata (whereby using reset persistent-data objects to update the superblock with, otherwise the superblock update could be dropped due to aborting metadata). This was found with code-inspection when comparing with the equivalent in DM thinp code. - Fix DM thin-pool's presume to continue resuming the device even if the pool in is fail mode -- otherwise bios may never be failed up the IO stack (which will prevent resetting the thin-pool target via table reload) - Fix DM thin-pool's metadata to use proper btree root (from previous transaction) if metadata commit failed. - Add 'waitfor' module param to DM module (dm_mod) to allow dm-init to wait for the specified device before continuing with its DM target initialization. * tag 'for-6.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm thin: Use last transaction's pmd->root when commit failed dm init: add dm-mod.waitfor to wait for asynchronously probed block devices dm ioctl: fix a couple ioctl codes dm ioctl: a small code cleanup in list_version_get_info dm thin: resume even if in FAIL mode dm cache: set needs_check flag after aborting metadata dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm integrity: Fix UAF in dm_integrity_dtr() dm cache: Fix UAF in destroy() dm clone: Fix UAF in clone_dtr() dm thin: Fix UAF in run_timer_softirq() commit 8ecd28b7a3a4c43a875a8840851f72468a2ca1d7 Merge: ce8a79d5601aa f07788079f515 Author: Linus Torvalds Date: Tue Dec 13 10:54:19 2022 -0800 Merge tag 'ata-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata updates from Damien Le Moal: "The ususal set of driver fixes and improvements as well as several patches improving libata core in preparation of the introduction of the support for the command duration limits feature. In more details: - Define the missing COMPLETED sense key in scsi header (me) - Several patches to improve libata handling of the status of completed commands and the retry and sense data reported to the scsi layer for failed commands. In particular, this widen the support for NCQ autosense to all drives that support this feature instead of restricting this feature use to ZAC drives only (Niklas) - Cleanup of the pata_mpc52xx and sata_dwc_460ex drivers to remove the use of the deprecated NO_IRQ macro (Christophe) - Fix build dedependency on OF vs use of the of_match_ptr() macro to avoid build errors with the sata_gemini and pata_ftide010 drivers (me) - Some libata cleanups using the new helper function ata_port_is_frozen() (Niklas) - Improve internal command handling by not retrying commands that failed with a timeout (Niklas) - Remove code for several unused libata helper functions (from Niklas) - Remove the palmchip pata_bk3710 driver. A couple of other driver removal should come in through the arm tree pull request (from Arnd) - Remove unused variable and function in the sata_dwc_460ex driver and libata-sff code (Colin and Sergey) - Minor cleanup of the pata_ep93xx driver platform code (from Minghao) - Remove the unnecessary linux/msi.h include from the ahci driver (Thomas) - Changes to libata enum constants definitions to avoid warnings with gcc-13 (Arnd)" * tag 'ata-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: (24 commits) ata: ahci: fix enum constants for gcc-13 ata: libata: fix commands incorrectly not getting retried during NCQ error ata: ahci: Remove linux/msi.h include ata: sata_dwc_460ex: Check !irq instead of irq == NO_IRQ ata: pata_ep93xx: use devm_platform_get_and_ioremap_resource() ata: libata-sff: kill unused ata_sff_busy_sleep() ata: sata_dwc_460ex: remove variable num_processed ata: remove palmchip pata_bk3710 driver ata: remove unused helper ata_id_flush_ext_enabled() ata: remove unused helper ata_id_flush_enabled() ata: remove unused helper ata_id_lba48_enabled() ata: libata-core: do not retry reading the log on timeout scsi: libsas: make use of ata_port_is_frozen() helper ata: make use of ata_port_is_frozen() helper ata: add ata_port_is_frozen() helper ata: pata_ftide010: Remove build dependency on OF ata: sata_gemini: Remove dependency on OF for compile tests ata: pata_mpc52xx: Replace NO_IRQ with 0 ata: libahci: read correct status and error field for NCQ commands ata: libata: fetch sense data for ATA devices supporting sense reporting ... commit ce8a79d5601aab94c02ed4539c48e8605422ac94 Merge: 96f7e448b9f45 f596da3efaf41 Author: Linus Torvalds Date: Tue Dec 13 10:43:59 2022 -0800 Merge tag 'for-6.2/block-2022-12-08' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - NVMe pull requests via Christoph: - Support some passthrough commands without CAP_SYS_ADMIN (Kanchan Joshi) - Refactor PCIe probing and reset (Christoph Hellwig) - Various fabrics authentication fixes and improvements (Sagi Grimberg) - Avoid fallback to sequential scan due to transient issues (Uday Shankar) - Implement support for the DEAC bit in Write Zeroes (Christoph Hellwig) - Allow overriding the IEEE OUI and firmware revision in configfs for nvmet (Aleksandr Miloserdov) - Force reconnect when number of queue changes in nvmet (Daniel Wagner) - Minor fixes and improvements (Uros Bizjak, Joel Granados, Sagi Grimberg, Christoph Hellwig, Christophe JAILLET) - Fix and cleanup nvme-fc req allocation (Chaitanya Kulkarni) - Use the common tagset helpers in nvme-pci driver (Christoph Hellwig) - Cleanup the nvme-pci removal path (Christoph Hellwig) - Use kstrtobool() instead of strtobool (Christophe JAILLET) - Allow unprivileged passthrough of Identify Controller (Joel Granados) - Support io stats on the mpath device (Sagi Grimberg) - Minor nvmet cleanup (Sagi Grimberg) - MD pull requests via Song: - Code cleanups (Christoph) - Various fixes - Floppy pull request from Denis: - Fix a memory leak in the init error path (Yuan) - Series fixing some batch wakeup issues with sbitmap (Gabriel) - Removal of the pktcdvd driver that was deprecated more than 5 years ago, and subsequent removal of the devnode callback in struct block_device_operations as no users are now left (Greg) - Fix for partition read on an exclusively opened bdev (Jan) - Series of elevator API cleanups (Jinlong, Christoph) - Series of fixes and cleanups for blk-iocost (Kemeng) - Series of fixes and cleanups for blk-throttle (Kemeng) - Series adding concurrent support for sync queues in BFQ (Yu) - Series bringing drbd a bit closer to the out-of-tree maintained version (Christian, Joel, Lars, Philipp) - Misc drbd fixes (Wang) - blk-wbt fixes and tweaks for enable/disable (Yu) - Fixes for mq-deadline for zoned devices (Damien) - Add support for read-only and offline zones for null_blk (Shin'ichiro) - Series fixing the delayed holder tracking, as used by DM (Yu, Christoph) - Series enabling bio alloc caching for IRQ based IO (Pavel) - Series enabling userspace peer-to-peer DMA (Logan) - BFQ waker fixes (Khazhismel) - Series fixing elevator refcount issues (Christoph, Jinlong) - Series cleaning up references around queue destruction (Christoph) - Series doing quiesce by tagset, enabling cleanups in drivers (Christoph, Chao) - Series untangling the queue kobject and queue references (Christoph) - Misc fixes and cleanups (Bart, David, Dawei, Jinlong, Kemeng, Ye, Yang, Waiman, Shin'ichiro, Randy, Pankaj, Christoph) * tag 'for-6.2/block-2022-12-08' of git://git.kernel.dk/linux: (247 commits) blktrace: Fix output non-blktrace event when blk_classic option enabled block: sed-opal: Don't include sed-opal: allow using IOC_OPAL_SAVE for locking too blk-cgroup: Fix typo in comment block: remove bio_set_op_attrs nvmet: don't open-code NVME_NS_ATTR_RO enumeration nvme-pci: use the tagset alloc/free helpers nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers nvme: consolidate setting the tagset flags nvme: pass nr_maps explicitly to nvme_alloc_io_tag_set block: bio_copy_data_iter nvme-pci: split out a nvme_pci_ctrl_is_dead helper nvme-pci: return early on ctrl state mismatch in nvme_reset_work nvme-pci: rename nvme_disable_io_queues nvme-pci: cleanup nvme_suspend_queue nvme-pci: remove nvme_pci_disable nvme-pci: remove nvme_disable_admin_queue nvme: merge nvme_shutdown_ctrl into nvme_disable_ctrl nvme: use nvme_wait_ready in nvme_shutdown_ctrl ... commit 96f7e448b9f4546ffd0356ffceb2b9586777f316 Merge: 54e60e505d614 761c61c15903d Author: Linus Torvalds Date: Tue Dec 13 10:40:31 2022 -0800 Merge tag 'for-6.2/io_uring-next-2022-12-08' of git://git.kernel.dk/linux Pull io_uring updates part two from Jens Axboe: - Misc fixes (me, Lin) - Series from Pavel extending the single task exclusive ring mode, yielding nice improvements for the common case of having a single ring per thread (Pavel) - Cleanup for MSG_RING, removing our IOPOLL hack (Pavel) - Further poll cleanups and fixes (Pavel) - Misc cleanups and fixes (Pavel) * tag 'for-6.2/io_uring-next-2022-12-08' of git://git.kernel.dk/linux: (22 commits) io_uring/msg_ring: flag target ring as having task_work, if needed io_uring: skip spinlocking for ->task_complete io_uring: do msg_ring in target task via tw io_uring: extract a io_msg_install_complete helper io_uring: get rid of double locking io_uring: never run tw and fallback in parallel io_uring: use tw for putting rsrc io_uring: force multishot CQEs into task context io_uring: complete all requests in task context io_uring: don't check overflow flush failures io_uring: skip overflow CQE posting for dying ring io_uring: improve io_double_lock_ctx fail handling io_uring: dont remove file from msg_ring reqs io_uring: reshuffle issue_flags io_uring: don't reinstall quiesce node for each tw io_uring: improve rsrc quiesce refs checks io_uring: don't raw spin unlock to match cq_lock io_uring: combine poll tw handlers io_uring: improve poll warning handling io_uring: remove ctx variable in io_poll_check_events ... commit 54e60e505d6144a22c787b5be1fdce996a27be1b Merge: d523ec4c6af43 5d772916855f5 Author: Linus Torvalds Date: Tue Dec 13 10:33:08 2022 -0800 Merge tag 'for-6.2/io_uring-2022-12-08' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: - Always ensure proper ordering in case of CQ ring overflow, which then means we can remove some work-arounds for that (Dylan) - Support completion batching for multishot, greatly increasing the efficiency for those (Dylan) - Flag epoll/eventfd wakeups done from io_uring, so that we can easily tell if we're recursing into io_uring again. Previously, this would have resulted in repeated multishot notifications if we had a dependency there. That could happen if an eventfd was registered as the ring eventfd, and we multishot polled for events on it. Or if an io_uring fd was added to epoll, and io_uring had a multishot request for the epoll fd. Test cases here: https://git.kernel.dk/cgit/liburing/commit/?id=919755a7d0096fda08fb6d65ac54ad8d0fe027cd Previously these got terminated when the CQ ring eventually overflowed, now it's handled gracefully (me). - Tightening of the IOPOLL based completions (Pavel) - Optimizations of the networking zero-copy paths (Pavel) - Various tweaks and fixes (Dylan, Pavel) * tag 'for-6.2/io_uring-2022-12-08' of git://git.kernel.dk/linux: (41 commits) io_uring: keep unlock_post inlined in hot path io_uring: don't use complete_post in kbuf io_uring: spelling fix io_uring: remove io_req_complete_post_tw io_uring: allow multishot polled reqs to defer completion io_uring: remove overflow param from io_post_aux_cqe io_uring: add lockdep assertion in io_fill_cqe_aux io_uring: make io_fill_cqe_aux static io_uring: add io_aux_cqe which allows deferred completion io_uring: allow defer completion for aux posted cqes io_uring: defer all io_req_complete_failed io_uring: always lock in io_apoll_task_func io_uring: remove iopoll spinlock io_uring: iopoll protect complete_post io_uring: inline __io_req_complete_put() io_uring: remove io_req_tw_post_queue io_uring: use io_req_task_complete() in timeout io_uring: hold locks for io_req_complete_failed io_uring: add completion locking for iopoll io_uring: kill io_cqring_ev_posted() and __io_cq_unlock_post() ... commit d523ec4c6af4314575d6ab8b52629ae3e2039a50 Merge: a45a7db9bc7b9 f1bd37a473528 Author: Linus Torvalds Date: Tue Dec 13 10:29:22 2022 -0800 Merge tag 'iomap-6.2-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap update from Darrick Wong: - Minor code cleanup to eliminate unnecessary bit shifting * tag 'iomap-6.2-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: directly use logical block size commit a45a7db9bc7b9e36f213330dcb13356b86a5633a Merge: 02bf43c7b7f7a a79168a0c00d7 Author: Linus Torvalds Date: Tue Dec 13 10:26:38 2022 -0800 Merge tag 'vfs-6.2-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull vfs remap_range update from Darrick Wong: - Make some minor adjustments to the remap range preparation function to skip file updates when the request length is adjusted downwards to zero. * tag 'vfs-6.2-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: fs/remap_range: avoid spurious writeback on zero length request commit 31a2e6cbe8a4eb0d1650fff4b77872b744e14a62 Author: Chris Wilson Date: Fri Dec 2 12:28:42 2022 +0000 drm/i915/migrate: Account for the reserved_space If the ring is nearly full when calling into emit_pte(), we might incorrectly trample the reserved_space when constructing the packet to emit the PTEs. This then triggers the GEM_BUG_ON(rq->reserved_space > ring->space) when later submitting the request, since the request itself doesn't have enough space left in the ring to emit things like workarounds, breadcrumbs etc. v2: Fix the whitespace errors Testcase: igt@i915_selftests@live_emit_pte_full_ring Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7535 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6889 Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") Signed-off-by: Chris Wilson Signed-off-by: Matthew Auld Cc: Andrzej Hajda Cc: Andi Shyti Cc: Nirmoy Das Cc: # v5.15+ Tested-by: Nirmoy Das Reviewed-by: Nirmoy Das Reviewed-by: Andrzej Hajda Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20221202122844.428006-1-matthew.auld@intel.com (cherry picked from commit 35168a6c4ed53db4f786858bac23b1474fd7d0dc) Signed-off-by: Rodrigo Vivi commit 3153eebb7a76e663ac76d6670dc113296de96622 Author: Khaled Almahallawy Date: Wed Nov 23 14:09:26 2022 -0800 drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern Bspecs has updated recently to remove the restriction to disable DDI/Transcoder before setting PHY test pattern. This update is to address PHY compliance test failures observed on a port with LTTPR. The issue is that when Transc. is disabled, the main link signals fed to LTTPR will be dropped invalidating link training, which will affect the quality of the phy test pattern when the transcoder is enabled again. v2: Update commit message (Clint) v3: Add missing Signed-off in v2 v4: Update Bspec and commit message for pre-gen12 (Jani) Bspec: 50482, 7555 Fixes: 8cdf72711928 ("drm/i915/dp: Program vswing, pre-emphasis, test-pattern") Cc: Imre Deak Cc: Clint Taylor CC: Jani Nikula Tested-by: Khaled Almahallawy Reviewed-by: Clint Taylor Signed-off-by: Khaled Almahallawy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20221123220926.170034-1-khaled.almahallawy@intel.com (cherry picked from commit be4a847652056b067d6dc6fe0fc024a9e2e987ca) Signed-off-by: Rodrigo Vivi commit b2e9e6a9cb87ce4a82fb106ae16c94639835fd47 Author: Ville Syrjälä Date: Thu Dec 8 00:52:19 2022 +0200 drm/i915: Fix VLV/CHV HDMI/DP audio enable Despite what I claimed in commit c3c5dc1d9224 ("drm/i915/audio: Do the vblank waits") the vblank interrupts are in fact not enabled yet when we do the audio enable sequence on VLV/CHV (all other platforms are fine). Reorder the enable sequence on VLV/CHV to match that of the other platforms so that the audio enable happens after the pipe has been enabled. Fixes: c3c5dc1d9224 ("drm/i915/audio: Do the vblank waits") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20221207225219.29060-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit a467a243554a64b418c14d7531a3b18c03d53bff) Signed-off-by: Rodrigo Vivi commit 7bd220f2ba9014b78f0304178103393554b8c4fe Author: YC Hung Date: Tue Dec 13 19:56:17 2022 +0800 ASoC: SOF: mediatek: initialize panic_info to zero Coverity spotted that panic_info is not initialized to zero in mtk_adsp_dump. Using uninitialized value panic_info.linenum when calling snd_sof_get_status. Fix this coverity by initializing panic_info struct as zero. Signed-off-by: YC Hung Reviewed-by: Curtis Malainey Link: https://lore.kernel.org/r/20221213115617.25086-1-yc.hung@mediatek.com Signed-off-by: Mark Brown commit 6c900dcc3f7331a67ed29739d74524e428d137fb Author: Hans de Goede Date: Tue Dec 13 13:33:19 2022 +0100 ASoC: rt5670: Remove unbalanced pm_runtime_put() For some reason rt5670_i2c_probe() does a pm_runtime_put() at the end of a successful probe. But it has never done a pm_runtime_get() leading to the following error being logged into dmesg: rt5670 i2c-10EC5640:00: Runtime PM usage count underflow! Fix this by removing the unnecessary pm_runtime_put(). Fixes: 64e89e5f5548 ("ASoC: rt5670: Add runtime PM support") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221213123319.11285-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit a1dec9d70b6ad97087b60b81d2492134a84208c6 Author: Hans de Goede Date: Tue Dec 13 13:32:46 2022 +0100 ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet The Advantech MICA-071 tablet deviates from the defaults for a non CR Bay Trail based tablet in several ways: 1. It uses an analog MIC on IN3 rather then using DMIC1 2. It only has 1 speaker 3. It needs the OVCD current threshold to be set to 1500uA instead of the default 2000uA to reliable differentiate between headphones vs headsets Add a quirk with these settings for this tablet. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221213123246.11226-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 02bf43c7b7f7a19aa59a75f5244f0a3408bace1a Merge: c76ff350bd576 3b4c7bc01727e Author: Linus Torvalds Date: Tue Dec 13 10:08:36 2022 -0800 Merge tag 'fs.xattr.simple.rework.rbtree.rwlock.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull simple-xattr updates from Christian Brauner: "This ports the simple xattr infrastucture to rely on a simple rbtree protected by a read-write lock instead of a linked list protected by a spinlock. A while ago we received reports about scaling issues for filesystems using the simple xattr infrastructure that also support setting a larger number of xattrs. Specifically, cgroups and tmpfs. Both cgroupfs and tmpfs can be mounted by unprivileged users in unprivileged containers and root in an unprivileged container can set an unrestricted number of security.* xattrs and privileged users can also set unlimited trusted.* xattrs. A few more words on further that below. Other xattrs such as user.* are restricted for kernfs-based instances to a fairly limited number. As there are apparently users that have a fairly large number of xattrs we should scale a bit better. Using a simple linked list protected by a spinlock used for set, get, and list operations doesn't scale well if users use a lot of xattrs even if it's not a crazy number. Let's switch to a simple rbtree protected by a rwlock. It scales way better and gets rid of the perf issues some people reported. We originally had fancier solutions even using an rcu+seqlock protected rbtree but we had concerns about being to clever and also that deletion from an rbtree with rcu+seqlock isn't entirely safe. The rbtree plus rwlock is perfectly fine. By far the most common operation is getting an xattr. While setting an xattr is not and should be comparatively rare. And listxattr() often only happens when copying xattrs between files or together with the contents to a new file. Holding a lock across listxattr() is unproblematic because it doesn't list the values of xattrs. It can only be used to list the names of all xattrs set on a file. And the number of xattr names that can be listed with listxattr() is limited to XATTR_LIST_MAX aka 65536 bytes. If a larger buffer is passed then vfs_listxattr() caps it to XATTR_LIST_MAX and if more xattr names are found it will return -E2BIG. In short, the maximum amount of memory that can be retrieved via listxattr() is limited and thus listxattr() bounded. Of course, the API is broken as documented on xattr(7) already. While I have no idea how the xattr api ended up in this state we should probably try to come up with something here at some point. An iterator pattern similar to readdir() as an alternative to listxattr() or something else. Right now it is extremly strange that users can set millions of xattrs but then can't use listxattr() to know which xattrs are actually set. And it's really trivial to do: for i in {1..1000000}; do setfattr -n security.$i -v $i ./file1; done And around 5000 xattrs it's impossible to use listxattr() to figure out which xattrs are actually set. So I have suggested that we try to limit the number of xattrs for simple xattrs at least. But that's a future patch and I don't consider it very urgent. A bonus of this port to rbtree+rwlock is that we shrink the memory consumption for users of the simple xattr infrastructure. This also adds kernel documentation to all the functions" * tag 'fs.xattr.simple.rework.rbtree.rwlock.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: xattr: use rbtree for simple_xattrs commit c76ff350bd57682ae12bea6383dd8baf4824ac96 Merge: 57888f7b952d3 577cc1434e4cc Author: Linus Torvalds Date: Tue Dec 13 09:47:48 2022 -0800 Merge tag 'lsm-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Improve the error handling in the device cgroup such that memory allocation failures when updating the access policy do not potentially alter the policy. - Some minor fixes to reiserfs to ensure that it properly releases LSM-related xattr values. - Update the security_socket_getpeersec_stream() LSM hook to take sockptr_t values. Previously the net/BPF folks updated the getsockopt code in the network stack to leverage the sockptr_t type to make it easier to pass both kernel and __user pointers, but unfortunately when they did so they didn't convert the LSM hook. While there was/is no immediate risk by not converting the LSM hook, it seems like this is a mistake waiting to happen so this patch proactively does the LSM hook conversion. - Convert vfs_getxattr_alloc() to return an int instead of a ssize_t and cleanup the callers. Internally the function was never going to return anything larger than an int and the callers were doing some very odd things casting the return value; this patch fixes all that and helps bring a bit of sanity to vfs_getxattr_alloc() and its callers. - More verbose, and helpful, LSM debug output when the system is booted with "lsm.debug" on the command line. There are examples in the commit description, but the quick summary is that this patch provides better information about which LSMs are enabled and the ordering in which they are processed. - General comment and kernel-doc fixes and cleanups. * tag 'lsm-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: Fix description of fs_context_parse_param lsm: Add/fix return values in lsm_hooks.h and fix formatting lsm: Clarify documentation of vm_enough_memory hook reiserfs: Add missing calls to reiserfs_security_free() lsm,fs: fix vfs_getxattr_alloc() return type and caller error paths device_cgroup: Roll back to original exceptions after copy failure LSM: Better reporting of actual LSMs at boot lsm: make security_socket_getpeersec_stream() sockptr_t safe audit: Fix some kernel-doc warnings lsm: remove obsoleted comments for security hooks fs: edit a comment made in bad taste commit 6e66e96e31b81fb08075d18a3e2c201f1e2171da Merge: c528ef0888b75 a39c636506cb9 Author: Palmer Dabbelt Date: Tue Dec 13 09:21:48 2022 -0800 Merge patch series "Documentation: RISC-V: patch-acceptance changes" Palmer Dabbelt says: We've had a patch acceptance policy that doesn't match reality, this changes the policy and also makes some more minor cleanups as well. * b4-shazam-merge: Documentation: RISC-V: patch-acceptance: s/implementor/implementer Documentation: RISC-V: Mention the UEFI Standards Documentation: RISC-V: Allow patches for non-standard behavior Documentation: RISC-V: Fix a typo in patch-acceptance Link: https://lore.kernel.org/r/20221207020815.16214-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit a39c636506cb90b9ba25cbb0a78bbcc3725ea227 Author: Palmer Dabbelt Date: Tue Dec 6 18:08:15 2022 -0800 Documentation: RISC-V: patch-acceptance: s/implementor/implementer Implementor does appear to be a word, but it's not very common. Suggested-by: Conor Dooley Reviewed-by: Anup Patel Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20221207020815.16214-5-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 68eabc72023f2c1cdbf7932fde57a7811c65b414 Author: Palmer Dabbelt Date: Tue Dec 6 18:08:14 2022 -0800 Documentation: RISC-V: Mention the UEFI Standards The current patch acceptance policy requires that specifications are approved by the RISC-V foundation, but we rely on external specifications as well. This explicitly calls out the UEFI specifications that we're starting to depend on. Reviewed-by: Conor Dooley Reviewed-by: Atish Patra Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20221207020815.16214-4-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 936100d4507f2e9f0be4621b0c698180d65e8264 Author: Palmer Dabbelt Date: Tue Dec 6 18:08:13 2022 -0800 Documentation: RISC-V: Allow patches for non-standard behavior The patch acceptance policy forbids accepting support for non-standard behavior. This policy was written in order to both steer implementers towards the standards and to avoid coupling the upstream kernel too tightly to vendor-specific features. Those were good goals, but in practice the policy just isn't working: every RISC-V system we have needs vendor-specific behavior in the kernel and we end up taking that support which violates the policy. That's confusing for contributors, which is the main reason we have a written policy in the first place. So let's just start taking code for vendor-defined behavior. Reviewed-by: Conor Dooley Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley Link: https://lore.kernel.org/all/alpine.DEB.2.21.999.2211181027590.4480@utopia.booyaka.com/ [Palmer: merge in Paul's suggestions] Link: https://lore.kernel.org/r/20221207020815.16214-3-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 57888f7b952d3f2696f82a701f1b3d9de7e346d3 Merge: bbdf4d54618ca 048be156491ff Author: Linus Torvalds Date: Tue Dec 13 09:32:05 2022 -0800 Merge tag 'selinux-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "Two SELinux patches: one increases the sleep time on deprecated functionality, and one removes the indirect calls in the sidtab context conversion code" * tag 'selinux-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: remove the sidtab context conversion indirect calls selinux: increase the deprecation sleep for checkreqprot and runtime disable commit 37f0ab1477994a0d0dc3c1e0de030fae07d37965 Author: Palmer Dabbelt Date: Tue Dec 6 18:08:12 2022 -0800 Documentation: RISC-V: Fix a typo in patch-acceptance I just stumbled on this when modifying the docs. Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20221207020815.16214-2-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit bbdf4d54618ca1d4af304eab6631d68fd2d6ce39 Merge: 299e2b1967578 50979953c0c41 Author: Linus Torvalds Date: Tue Dec 13 09:20:06 2022 -0800 Merge tag 'audit-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "Two performance oriented patches for the audit subsystem: one consolidates similar code to gain some caching advantages, while the other stores a value in a stack variable to avoid repeated lookups in a loop. The commit descriptions have more information, including some before/after performance measurements" * tag 'audit-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: unify audit_filter_{uring(), inode_name(), syscall()} audit: cache ctx->major in audit_filter_syscall() commit 299e2b1967578b1442128ba8b3e86ed3427d3651 Merge: e529d3507a93d f6e53fb2d7bd7 Author: Linus Torvalds Date: Tue Dec 13 09:14:50 2022 -0800 Merge tag 'landlock-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "This adds file truncation support to Landlock, contributed by Günther Noack. As described by Günther [1], the goal of these patches is to work towards a more complete coverage of file system operations that are restrictable with Landlock. The known set of currently unsupported file system operations in Landlock is described at [2]. Out of the operations listed there, truncate is the only one that modifies file contents, so these patches should make it possible to prevent the direct modification of file contents with Landlock. The new LANDLOCK_ACCESS_FS_TRUNCATE access right covers both the truncate(2) and ftruncate(2) families of syscalls, as well as open(2) with the O_TRUNC flag. This includes usages of creat() in the case where existing regular files are overwritten. Additionally, this introduces a new Landlock security blob associated with opened files, to track the available Landlock access rights at the time of opening the file. This is in line with Unix's general approach of checking the read and write permissions during open(), and associating this previously checked authorization with the opened file. An ongoing patch documents this use case [3]. In order to treat truncate(2) and ftruncate(2) calls differently in an LSM hook, we split apart the existing security_path_truncate hook into security_path_truncate (for truncation by path) and security_file_truncate (for truncation of previously opened files)" Link: https://lore.kernel.org/r/20221018182216.301684-1-gnoack3000@gmail.com [1] Link: https://www.kernel.org/doc/html/v6.1/userspace-api/landlock.html#filesystem-flags [2] Link: https://lore.kernel.org/r/20221209193813.972012-1-mic@digikod.net [3] * tag 'landlock-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: samples/landlock: Document best-effort approach for LANDLOCK_ACCESS_FS_REFER landlock: Document Landlock's file truncation support samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE selftests/landlock: Test ftruncate on FDs created by memfd_create(2) selftests/landlock: Test FD passing from restricted to unrestricted processes selftests/landlock: Locally define __maybe_unused selftests/landlock: Test open() and ftruncate() in multiple scenarios selftests/landlock: Test file truncation support landlock: Support file truncation landlock: Document init_layer_masks() helper landlock: Refactor check_access_path_dual() into is_access_to_paths_allowed() security: Create file_truncate hook from path_truncate hook commit e529d3507a93d3c9528580081bbaf931a50de154 Merge: 6a24711d5c0bc ffcb754584603 Author: Linus Torvalds Date: Tue Dec 13 09:05:19 2022 -0800 Merge tag 'dma-mapping-6.2-2022-12-13' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - reduce the swiotlb buffer size on allocation failure (Alexey Kardashevskiy) - clean up passing of bogus GFP flags to the dma-coherent allocator (Christoph Hellwig) * tag 'dma-mapping-6.2-2022-12-13' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: reject __GFP_COMP in dma_alloc_attrs ALSA: memalloc: don't pass bogus GFP_ flags to dma_alloc_* s390/ism: don't pass bogus GFP_ flags to dma_alloc_coherent cnic: don't pass bogus GFP_ flags to dma_alloc_coherent RDMA/qib: don't pass bogus GFP_ flags to dma_alloc_coherent RDMA/hfi1: don't pass bogus GFP_ flags to dma_alloc_coherent media: videobuf-dma-contig: use dma_mmap_coherent swiotlb: reduce the swiotlb buffer size on allocation failure commit 6a24711d5c0bc8fb0fc49def433ab89ecbedf095 Merge: a044dab5e6e5f 77992f896745c Author: Linus Torvalds Date: Tue Dec 13 08:51:13 2022 -0800 Merge tag 'configfs-6.2-2022-12-13' of git://git.infradead.org/users/hch/configfs Pull configfs updates from Christoph Hellwig: - fix a memory leak in configfs_create_dir (Chen Zhongjin) - remove mentions of committable items that were implemented (Bartosz Golaszewski) * tag 'configfs-6.2-2022-12-13' of git://git.infradead.org/users/hch/configfs: configfs: remove mentions of committable items configfs: fix possible memory leak in configfs_create_dir() commit a044dab5e6e5f0c382a6a4af37d537fb2d8bacb7 Merge: 764822972d64e 7fd461c47c6cf Author: Linus Torvalds Date: Tue Dec 13 08:44:41 2022 -0800 Merge tag 'nfs-for-6.2-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust "Bugfixes: - Fix NULL pointer dereference in the mount parser - Fix memory stomp in decode_attr_security_label - Fix credential leak in _nfs4_discover_trunking() - Fix buffer leak in rpcrdma_req_create() - Fix leaked socket in rpc_sockname() - Fix deadlock between nfs4_open_recover_helper() and delegreturn - Fix an Oops in nfs_d_automount() - Fix potential race in nfs_call_unlink() - Multiple fixes for the open context mode - NFSv4.2 READ_PLUS fixes - Fix a regression in which small rsize/wsize values are being forbidden - Fail client initialisation if the NFSv4.x state manager thread can't run - Avoid spurious warning of lost lock that is being unlocked. - Ensure the initialisation of struct nfs4_label Features and cleanups: - Trigger the "ls -l" readdir heuristic sooner - Clear the file access cache upon login to ensure supplementary group info is in sync between the client and server - pnfs: Fix up the logging of layout stateids - NFSv4.2: Change the default KConfig value for READ_PLUS - Use sysfs_emit() instead of scnprintf() where appropriate" * tag 'nfs-for-6.2-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (24 commits) NFSv4.2: Change the default KConfig value for READ_PLUS NFSv4.x: Fail client initialisation if state manager thread can't run fs: nfs: sysfs: use sysfs_emit() to instead of scnprintf() NFS: use sysfs_emit() to instead of scnprintf() NFS: Allow very small rsize & wsize again NFSv4.2: Fix up READ_PLUS alignment NFSv4.2: Set the correct size scratch buffer for decoding READ_PLUS SUNRPC: Fix missing release socket in rpc_sockname() xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() NFS: avoid spurious warning of lost lock that is being unlocked. nfs: fix possible null-ptr-deref when parsing param NFSv4: check FMODE_EXEC from open context mode in nfs4_opendata_access() NFS: make sure open context mode have FMODE_EXEC when file open for exec NFS4.x/pnfs: Fix up logging of layout stateids NFS: Fix a race in nfs_call_unlink() NFS: Fix an Oops in nfs_d_automount() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFS: Trigger the "ls -l" readdir heuristic sooner NFSv4.2: Fix initialisation of struct nfs4_label ... commit c528ef0888b75f673f7d48022de8d31d5b451e8c Author: Guo Ren Date: Wed Dec 7 04:11:12 2022 -0500 riscv: Fixup compile error with !MMU Current nommu_virt_defconfig can't compile: In file included from arch/riscv/kernel/crash_core.c:3: arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo': arch/riscv/kernel/crash_core.c:8:27: error: 'VA_BITS' undeclared (first use in this function) 8 | VMCOREINFO_NUMBER(VA_BITS); | ^~~~~~~ Add MMU dependency for KEXEC_FILE. Fixes: 6261586e0c91 ("RISC-V: Add kexec_file support") Reported-by: Conor Dooley Reported-by: kernel test robot Signed-off-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20221207091112.2258674-1-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit f722052c990b6a67d0dc0a13862b32ddbf567b95 Merge: ab6847b91190b 05086f3db530b Author: Jiri Kosina Date: Tue Dec 13 14:42:44 2022 +0100 Merge branch 'for-6.2/wiimote' into for-linus - support for DJ Hero turntable (Joshua Jun) commit ab6847b91190b980203af86cf4ec35c64674872b Merge: 4e6ff447739fa af89dfde2a5f8 Author: Jiri Kosina Date: Tue Dec 13 14:42:10 2022 +0100 Merge branch 'for-6.2/uclogic' into for-linus - XP-PEN Deco LW support (José Expósito) commit 4e6ff447739fad286f2334f48dca20bc8a133171 Merge: 6cd132b4f3d09 da03e502bb22e Author: Jiri Kosina Date: Tue Dec 13 14:41:13 2022 +0100 Merge branch 'for-6.2/sony' into for-linus - PS DualShock 4 controller support (Roderick Colenbrander) commit 6cd132b4f3d09b320ee81feec4c9758cd7e516ba Merge: 54dcc80e7d7cf 9d013910df22d Author: Jiri Kosina Date: Tue Dec 13 14:40:18 2022 +0100 Merge branch 'for-6.2/sensor' into for-linus - support for more than one hinge sensor in hid-sensor-custom (Yauhen Kharuzhy) commit 54dcc80e7d7cf012f7e9f0801430890fe0ecc72a Merge: 9a6f62b54a129 9984fbf55b9bd Author: Jiri Kosina Date: Tue Dec 13 14:37:43 2022 +0100 Merge branch 'for-6.2/rmi' into for-linus - wakeup event handling fix for RMI driver (Dmitry Torokhov) commit 9a6f62b54a129e6970f09bc6827db17e2919d96e Merge: 3daac75d283f4 3d74c9eca1a2b Author: Jiri Kosina Date: Tue Dec 13 14:36:17 2022 +0100 Merge branch 'for-6.2/mcp2221' into for-linus - iio support for the MCP2221 HID driver (Matt Ranostay) commit 3daac75d283f47f9e605792cb8337e306f00f4d1 Merge: 57383f3c048d4 8b7e58409b181 Author: Jiri Kosina Date: Tue Dec 13 14:35:07 2022 +0100 Merge branch 'for-6.2/logitech' into for-linus - always send SwID in GetProtocolVersion for Logitech HID++ (Andreas Bergmeier) commit 57383f3c048d421e6dcc73aba43eef1c73142203 Merge: 060e4b066e53a 6df849caeb49e Author: Jiri Kosina Date: Tue Dec 13 14:34:43 2022 +0100 Merge branch 'for-6.2/intel-ish' into for-linus commit 060e4b066e53a5e988252bf9a3bebc5c5362ca93 Merge: 91e9b0218580d baf34f3bbe6de Author: Jiri Kosina Date: Tue Dec 13 14:33:13 2022 +0100 Merge branch 'for-6.2/i2c' into for-linus - conversion of I2C HID drivers to use new simplified I2C probing (Stephen Kitt) commit 91e9b0218580dec68d286b3ea337afc5f8ba2298 Merge: 8d437f11ee7dd 6a4628997cfcc Author: Jiri Kosina Date: Tue Dec 13 14:32:07 2022 +0100 Merge branch 'for-6.2/hyperv' into for-linus - functionally equivalent code cleanups for hyperv driver (Paulo Miguel Almeida) commit 8d437f11ee7ddf2841913b36e4f7600a12a45630 Merge: ab970ae1d6382 fb5d783b3c66a Author: Jiri Kosina Date: Tue Dec 13 14:30:33 2022 +0100 Merge branch 'for-6.2/ft260' into for-linus - fixes and performance improvements to the hid-ft260 driver (Michael Zaidman) commit 875ef1a57f32fcb91010dc9bc8bd1166956a579e Author: Masahiro Yamada Date: Sun Dec 11 12:10:59 2022 +0900 kbuild: use .NOTINTERMEDIATE for future GNU Make versions In Kbuild, some files are generated by chains of pattern/implicit rules. For example, *.dtb.o files in drivers/of/unittest-data/Makefile are generated by the chain of 3 pattern rules, like this: %.dts -> %.dtb -> %.dtb.S -> %.dtb.o Here, %.dts is the real source, %.dtb.o is the final target. %.dtb and %.dtb.S are called "intermediate files". As GNU Make manual [1] says, intermediate files are treated differently in two ways: (a) The first difference is what happens if the intermediate file does not exist. If an ordinary file 'b' does not exist, and make considers a target that depends on 'b', it invariably creates 'b' and then updates the target from 'b'. But if 'b' is an intermediate file, then make can leave well enough alone: it won't create 'b' unless one of its prerequisites is out of date. This means the target depending on 'b' won't be rebuilt either, unless there is some other reason to update that target: for example the target doesn't exist or a different prerequisite is newer than the target. (b) The second difference is that if make does create 'b' in order to update something else, it deletes 'b' later on after it is no longer needed. Therefore, an intermediate file which did not exist before make also does not exist after make. make reports the deletion to you by printing a 'rm' command showing which file it is deleting. The combination of these is problematic for Kbuild because most of the build rules depend on FORCE and the if_changed* macros really determine if the target should be updated. So, all missing files, whether they are intermediate or not, are always rebuilt. To see the problem, delete ".SECONDARY:" from scripts/Kbuild.include, and repeat this command: $ make allmodconfig drivers/of/unittest-data/ The intermediate files will be deleted, which results in rebuilding intermediate and final objects in the next run of make. In the old days, people suppressed (b) in inconsistent ways. As commit 54a702f70589 ("kbuild: mark $(targets) as .SECONDARY and remove .PRECIOUS markers") noted, you should not use .PRECIOUS because .PRECIOUS has the following behavior (c), which is not likely what you want. (c) If make is killed or interrupted during the execution of their recipes, the target is not deleted. Also, the target is not deleted on error even if .DELETE_ON_ERROR is specified. .SECONDARY is a much better way to disable (b), but a small problem is that .SECONDARY enables (a), which gives a side-effect to $?; prerequisites marked as .SECONDARY do not appear in $?. This is a drawback for Kbuild. I thought it was a bug and opened a bug report. As Paul, the GNU Make maintainer, concluded in [2], this is not a bug. A good news is that, GNU Make 4.4 added the perfect solution, .NOTINTERMEDIATE, which cancels both (a) and (b). For clarificaton, my understanding of .INTERMEDIATE, .SECONDARY, .PRECIOUS and .NOTINTERMEDIATE are as follows: (a) (b) (c) .INTERMEDIATE enable enable disable .SECONDARY enable disable disable .PRECIOUS disable disable enable .NOTINTERMEDIATE disable disable disable However, GNU Make 4.4 has a bug for the global .NOTINTERMEDIATE. [3] It was fixed by commit 6164608900ad ("[SV 63417] Ensure global .NOTINTERMEDIATE disables all intermediates"), and will be available in the next release of GNU Make. The following is the gain for .NOTINTERMEDIATE: [Current Make] $ make allnoconfig vmlinux [ full build ] $ rm include/linux/device.h $ make vmlinux CALL scripts/checksyscalls.sh Make does not notice the removal of . [Future Make] $ make-latest allnoconfig vmlinux [ full build ] $ rm include/linux/device.h $ make-latest vmlinux CC arch/x86/kernel/asm-offsets.s In file included from ./include/linux/writeback.h:13, from ./include/linux/memcontrol.h:22, from ./include/linux/swap.h:9, from ./include/linux/suspend.h:5, from arch/x86/kernel/asm-offsets.c:13: ./include/linux/blk_types.h:11:10: fatal error: linux/device.h: No such file or directory 11 | #include | ^~~~~~~~~~~~~~~~ compilation terminated. make-latest[1]: *** [scripts/Makefile.build:114: arch/x86/kernel/asm-offsets.s] Error 1 make-latest: *** [Makefile:1282: prepare0] Error 2 Make notices the removal of , and rebuilds objects that depended on . There exists a source file that includes , and it raises an error. To see detailed background information, refer to commit 2d3b1b8f0da7 ("kbuild: drop $(wildcard $^) check in if_changed* for faster rebuild"). [1]: https://www.gnu.org/software/make/manual/make.html#Chained-Rules [2]: https://savannah.gnu.org/bugs/?55532 [3]: https://savannah.gnu.org/bugs/?63417 Signed-off-by: Masahiro Yamada commit 3122c84409d578a5df8bcb1953547e0b871ac4c2 Author: Masahiro Yamada Date: Sun Dec 11 11:54:48 2022 +0900 kconfig: refactor Makefile to reduce process forks Refactor Makefile and use read-file macro. For Make >= 4.2, it can read out a file by using the built-in function. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 6768fa4bcb6c1618248f135d04b9287ba2724ae0 Author: Masahiro Yamada Date: Sun Dec 11 11:54:47 2022 +0900 kbuild: add read-file macro Since GNU Make 4.2, $(file ...) supports the read operater '<', which is useful to read a file without forking a new process. No warning is shown even if the input file is missing. For older Make versions, it falls back to the cat command. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Reviewed-by: Alexander Lobakin Tested-by: Alexander Lobakin commit a5db80c65dbf9144de155f8a0f08becc9c307db0 Author: Masahiro Yamada Date: Sun Dec 11 18:49:18 2022 +0900 kbuild: do not sort after reading modules.order modules.order lists modules in the deterministic order (that is why "modules order"), and there is no duplication in the list. $(sort ) is pointless. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit ab970ae1d63822228bdc84b9c1514efbd2f66da7 Merge: cfd1f6c16f7de 163a7fbff7a78 Author: Jiri Kosina Date: Tue Dec 13 14:28:47 2022 +0100 Merge branch 'for-6.2/default-remove-cleanup' into for-linus - removal of superfluous hid_hw_stop() calls for drivers with default .remove callback (Marcus Folkesson) commit cfd1f6c16f7deadfe5269a76c1516405c4466481 Merge: a9d9e46c755a1 fd7b68b763c4d Author: Jiri Kosina Date: Tue Dec 13 14:27:16 2022 +0100 Merge branch 'for-6.2/apple' into for-linus - new quirks for select Apple keyboards (Kerem Karabay, Aditya Garg) commit fccb3d3eda8d19b893e1fd18e8c70b78784b2a72 Author: Masahiro Yamada Date: Sun Dec 11 11:46:47 2022 +0900 kbuild: add test-{ge,gt,le,lt} macros GNU Make 4.4 introduced $(intcmp ...), which is useful to compare two integers without forking a new process. Add test-{ge,gt,le,lt} macros, which work more efficiently with GNU Make >= 4.4. For older Make versions, they fall back to the 'test' shell command. The first two parameters to $(intcmp ...) must not be empty. To avoid the syntax error, I appended '0' to them. Fortunately, '00' is treated as '0'. This is needed because CONFIG options may expand to an empty string when the kernel configuration is not included. Signed-off-by: Masahiro Yamada Acked-by: Palmer Dabbelt # RISC-V Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier commit e4412739472b743e18860ad8d979a7ceb3071652 Author: Masahiro Yamada Date: Thu Oct 13 03:18:41 2022 +0900 Documentation: raise minimum supported version of binutils to 2.25 Binutils 2.23 was released in 2012. Almost 10 years old. We already require GCC 5.1, released in 2015. Bump the binutils version to 2.25, which was released some months before GCC 5.1. With this applied, some subsystems can start to clean up code. Examples: arch/arm/Kconfig.assembler arch/mips/vdso/Kconfig arch/powerpc/Makefile arch/x86/Kconfig.assembler Signed-off-by: Masahiro Yamada Acked-by: Linus Torvalds Reviewed-by: Nick Desaulniers commit 2c05bf3aa0741f4f3c72432db7801371dbbcf289 Author: Christian Brauner Date: Tue Dec 13 12:28:51 2022 +0100 mnt_idmapping: move ima-only helpers to ima The vfs{g,u}id_{gt,lt}_* helpers are currently not needed outside of ima and we shouldn't incentivize people to use them by placing them into the header. Let's just define them locally in the one file in ima where they are used. Suggested-by: Linus Torvalds Signed-off-by: Christian Brauner (Microsoft) commit f9645abe4255bd79e4c63799634c996dd53db321 Author: Sriram Yagnaraman Date: Mon Dec 12 11:07:05 2022 +0100 netfilter: conntrack: document sctp timeouts Exposed through sysctl, update documentation to describe sctp states and their default timeouts. Signed-off-by: Sriram Yagnaraman Signed-off-by: Pablo Neira Ayuso commit ba57ee0944ff0085652cf8df91f9c571883debe6 Author: Li Qiong Date: Mon Dec 12 15:43:51 2022 +0800 ipvs: add a 'default' case in do_ip_vs_set_ctl() It is better to return the default switch case with '-EINVAL', in case new commands are added. otherwise, return a uninitialized value of ret. Signed-off-by: Li Qiong Reviewed-by: Simon Horman Acked-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit 1a34e7f2fcbaaeb3c88858d2e4655bc93038ec9b Merge: 830b3c68c1fb1 bee74dcbd3908 6132a490f9c81 Author: Huacai Chen Date: Tue Dec 13 19:19:41 2022 +0800 Merge tags 'acpi-6.2-rc1' and 'irq-core-2022-12-10' into loongarch-next LoongArch architecture changes for 6.2 depend on the acpi and irqchip changes to work, so merge them to create a base. commit 36955d368dc101be885ad2c71618e3c3a93cd8ee Author: Yuezhang Mo Date: Thu Nov 17 11:31:30 2022 +0800 exfat: reuse exfat_find_location() to simplify exfat_get_dentry_set() In exfat_get_dentry_set(), part of the code is the same as exfat_find_location(), reuse exfat_find_location() to simplify exfat_get_dentry_set(). Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 40306b4d1ba25970dafd53432e8daa5d591ebd99 Author: Yuezhang Mo Date: Tue Dec 13 09:40:32 2022 +0800 exfat: fix overflow in sector and cluster conversion According to the exFAT specification, there are at most 2^32-11 clusters in a volume. so using 'int' is not enough for cluster index, the return value type of exfat_sector_to_cluster() should be 'unsigned int'. Signed-off-by: Yuezhang Mo Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 7c4a6309e27f411743817fe74a832ec2d2798a4b Author: Jakub Kicinski Date: Mon Dec 12 19:20:37 2022 -0800 ipvs: fix type warning in do_div() on 32 bit 32 bit platforms without 64bit div generate the following warning: net/netfilter/ipvs/ip_vs_est.c: In function 'ip_vs_est_calc_limits': include/asm-generic/div64.h:222:35: warning: comparison of distinct pointer types lacks a cast 222 | (void)(((typeof((n)) *)0) == ((uint64_t *)0)); \ | ^~ net/netfilter/ipvs/ip_vs_est.c:694:17: note: in expansion of macro 'do_div' 694 | do_div(val, loops); | ^~~~~~ include/asm-generic/div64.h:222:35: warning: comparison of distinct pointer types lacks a cast 222 | (void)(((typeof((n)) *)0) == ((uint64_t *)0)); \ | ^~ net/netfilter/ipvs/ip_vs_est.c:700:33: note: in expansion of macro 'do_div' 700 | do_div(val, min_est); | ^~~~~~ first argument of do_div() should be unsigned. We can't just cast as do_div() updates it as well, so we need an lval. Make val unsigned in the first place, all paths check that the value they assign to this variables are non-negative already. Fixes: 705dd3444081 ("ipvs: use kthreads for stats estimation") Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20221213032037.844517-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit b11919e1bb7f6f6273f5a33947b8496da2769eb8 Merge: d1c722867f802 e095493091e85 Author: Paolo Abeni Date: Tue Dec 13 09:24:49 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in the left-over fixes before the net-next pull-request. net/mptcp/subflow.c d3295fee3c75 ("mptcp: use proper req destructor for IPv6") 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()") Signed-off-by: Paolo Abeni commit f728a5ea27c92133893590e731ce10f6561ced87 Author: Christian König Date: Tue Dec 6 14:07:49 2022 +0100 dma-buf: fix dma_buf_export init order v2 The init order and resulting error handling in dma_buf_export was pretty messy. Subordinate objects like the file and the sysfs kernel objects were initializing and wiring itself up with the object in the wrong order resulting not only in complicating and partially incorrect error handling, but also in publishing only halve initialized DMA-buf objects. Clean this up thoughtfully by allocating the file independent of the DMA-buf object. Then allocate and initialize the DMA-buf object itself, before publishing it through sysfs. If everything works as expected the file is then connected with the DMA-buf object and publish it through debugfs. Also adds the missing dma_resv_fini() into the error handling. v2: add some missing changes to dma_bug_getfile() and a missing NULL check in dma_buf_file_release() Signed-off-by: Christian König Reviewed-by: Michael J. Ruhl Reviewed-by: T.J. Mercier Acked-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/msgid/20221209071535.933698-1-christian.koenig@amd.com commit 71fc3621efc38ace9640ee6a0db3300900689592 Author: Alexandre Ghiti Date: Thu Dec 1 14:51:28 2022 +0100 riscv: Fix P4D_SHIFT definition for 3-level page table mode RISC-V kernels support 3,4,5-level page tables at runtime by folding upper levels. In case of a 3-level page table, PGDIR is folded into P4D which in turn is folded into PUD: PGDIR_SHIFT value is correctly set to the same value as PUD_SHIFT, but P4D_SHIFT is not, then any use of P4D_SHIFT will access invalid address bits (all set to 1). Fix this by dynamically defining P4D_SHIFT value, like we already do for PGDIR_SHIFT. Fixes: d10efa21a937 ("riscv: mm: Control p4d's folding by pgtable_l5_enabled") Signed-off-by: Alexandre Ghiti Reviewed-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20221201135128.1482189-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit e923f4625ed3ad7656c3f9f086c898798bafbbc5 Author: Andrew Jones Date: Thu Dec 1 12:37:50 2022 +0100 riscv: Apply a static assert to riscv_isa_ext_id Add a static assert to ensure a RISCV_ISA_EXT_* enum is never created with a value >= RISCV_ISA_EXT_MAX. We can do this by putting RISCV_ISA_EXT_ID_MAX to more work. Before it was redundant with RISCV_ISA_EXT_MAX and hence only used to document the limit. Now it grows with the enum and is used to check the limit. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20221201113750.18021-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 764822972d64e7f3e6792278ecc7a3b3c81087cd Merge: 149c51f876322 e78e274eb22d9 Author: Linus Torvalds Date: Mon Dec 12 20:54:39 2022 -0800 Merge tag 'nfsd-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "This release introduces support for the CB_RECALL_ANY operation. NFSD can send this operation to request that clients return any delegations they choose. The server uses this operation to handle low memory scenarios or indicate to a client when that client has reached the maximum number of delegations the server supports. The NFSv4.2 READ_PLUS operation has been simplified temporarily whilst support for sparse files in local filesystems and the VFS is improved. Two major data structure fixes appear in this release: - The nfs4_file hash table is replaced with a resizable hash table to reduce the latency of NFSv4 OPEN operations. - Reference counting in the NFSD filecache has been hardened against races. In furtherance of removing support for NFSv2 in a subsequent kernel release, a new Kconfig option enables server-side support for NFSv2 to be left out of a kernel build. MAINTAINERS has been updated to indicate that changes to fs/exportfs should go through the NFSD tree" * tag 'nfsd-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (49 commits) NFSD: Avoid clashing function prototypes SUNRPC: Fix crasher in unwrap_integ_data() SUNRPC: Make the svc_authenticate tracepoint conditional NFSD: Use only RQ_DROPME to signal the need to drop a reply SUNRPC: Clean up xdr_write_pages() SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails NFSD: add CB_RECALL_ANY tracepoints NFSD: add delegation reaper to react to low memory condition NFSD: add support for sending CB_RECALL_ANY NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker trace: Relocate event helper files NFSD: pass range end to vfs_fsync_range() instead of count lockd: fix file selection in nlmsvc_cancel_blocked lockd: ensure we use the correct file descriptor when unlocking lockd: set missing fl_flags field when retrieving args NFSD: Use struct_size() helper in alloc_session() nfsd: return error if nfs4_setacl fails lockd: set other missing fields when unlocking files NFSD: Add an nfsd_file_fsync tracepoint sunrpc: svc: Remove an unused static function svc_ungetu32() ... commit 149c51f876322d9bfbd5e2d6ffae7aff3d794384 Merge: 97971df811b88 b7af0635c87ff Author: Linus Torvalds Date: Mon Dec 12 20:47:51 2022 -0800 Merge tag 'for-6.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "This round there are a lot of cleanups and moved code so the diffstat looks huge, otherwise there are some nice performance improvements and an update to raid56 reliability. User visible features: - raid56 reliability vs performance trade off: - fix destructive RMW for raid5 data (raid6 still needs work): do full checksum verification for all data during RMW cycle, this should prevent rewriting potentially corrupted data without notice - stripes are cached in memory which should reduce the performance impact but still can hurt some workloads - checksums are verified after repair again - this is the last option without introducing additional features (write intent bitmap, journal, another tree), the extra checksum read/verification was supposed to be avoided by the original implementation exactly for performance reasons but that caused all the reliability problems - discard=async by default for devices that support it - implement emergency flush reserve to avoid almost all unnecessary transaction aborts due to ENOSPC in cases where there are too many delayed refs or delayed allocation - skip block group synchronization if there's no change in used bytes, can reduce transaction commit count for some workloads Performance improvements: - fiemap and lseek: - overall speedup due to skipping unnecessary or duplicate searches (-40% run time) - cache some data structures and sharedness of extents (-30% run time) - send: - faster backref resolution when finding clones - cached leaf to root mapping for faster backref walking - improved clone/sharing detection - overall run time improvements (-70%) Core: - module initialization converted to a table of function pointers run in a sequence - preparation for fscrypt, extend passing file names across calls, dir item can store encryption status - raid56 updates: - more accurate error tracking of sectors within stripe - simplify recovery path and remove dedicated endio worker kthread - simplify scrub call paths - refactoring to support the extra data checksum verification during RMW cycle - tree block parentness checks consolidated and done at metadata read time - improved error handling - cleanups: - move a lot of code for better synchronization between kernel and user space sources, split big files - enum cleanups - GFP flag cleanups - header file cleanups, prototypes, dependencies - redundant parameter cleanups - inline extent handling simplifications - inode parameter conversion - data structure cleanups, reductions, renames, merges" * tag 'for-6.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (249 commits) btrfs: print transaction aborted messages with an error level btrfs: sync some cleanups from progs into uapi/btrfs.h btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range btrfs: fix extent map use-after-free when handling missing device in read_one_chunk btrfs: remove outdated logic from overwrite_item() and add assertion btrfs: unify overwrite_item() and do_overwrite_item() btrfs: replace strncpy() with strscpy() btrfs: fix uninitialized variable in find_first_clear_extent_bit btrfs: fix uninitialized parent in insert_state btrfs: add might_sleep() annotations btrfs: add stack helpers for a few btrfs items btrfs: add nr_global_roots to the super block definition btrfs: remove BTRFS_LEAF_DATA_OFFSET btrfs: add helpers for manipulating leaf items and data btrfs: add eb to btrfs_node_key_ptr_offset btrfs: pass the extent buffer for the btrfs_item_nr helpers btrfs: move the csum helpers into ctree.h btrfs: move eb offset helpers into extent_io.h btrfs: move file_extent_item helpers into file-item.h btrfs: move leaf_data_end into ctree.c ... commit 97971df811b8854882c0f6c6631e23ab8cdcc44f Merge: 56c003e4db4ad 7a5e9f1f83e32 Author: Linus Torvalds Date: Mon Dec 12 20:41:50 2022 -0800 Merge tag 'dlm-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "These patches include the usual cleanups and minor fixes, the removal of code that is no longer needed due to recent improvements, and improvements to processing large volumes of messages during heavy locking activity. Summary: - Misc code cleanup - Fix a couple of socket handling bugs: a double release on an error path and a data-ready race in an accept loop - Remove code for resending dir-remove messages. This code is no longer needed since the midcomms layer now ensures the messages are resent if needed - Add tracepoints for dlm messages - Improve callback queueing by replacing the fixed array with a list - Simplify the handling of a remove message followed by a lookup message by sending both without releasing a spinlock in between - Improve the concurrency of sending and receiving messages by holding locks for a shorter time, and changing how workqueues are used - Remove old code for shutting down sockets, which is no longer needed with the reliable connection handling that was recently added" * tag 'dlm-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: (37 commits) fs: dlm: fix building without lockdep fs: dlm: parallelize lowcomms socket handling fs: dlm: don't init error value fs: dlm: use saved sk_error_report() fs: dlm: use sock2con without checking null fs: dlm: remove dlm_node_addrs lookup list fs: dlm: don't put dlm_local_addrs on heap fs: dlm: cleanup listen sock handling fs: dlm: remove socket shutdown handling fs: dlm: use listen sock as dlm running indicator fs: dlm: use list_first_entry_or_null fs: dlm: remove twice INIT_WORK fs: dlm: add midcomms init/start functions fs: dlm: add dst nodeid for msg tracing fs: dlm: rename seq to h_seq for msg tracing fs: dlm: rename DLM_IFL_NEED_SCHED to DLM_IFL_CB_PENDING fs: dlm: ast do WARN_ON_ONCE() on hotpath fs: dlm: drop lkb ref in bug case fs: dlm: avoid false-positive checker warning fs: dlm: use WARN_ON_ONCE() instead of WARN_ON() ... commit 56c003e4db4adb1d57e599fb4c7d39f9130f9db1 Merge: cda6a60acc95c a60dca73a1a80 Author: Linus Torvalds Date: Mon Dec 12 20:38:28 2022 -0800 Merge tag 'jfs-6.2' of https://github.com/kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "Assorted JFS fixes for 6.2" * tag 'jfs-6.2' of https://github.com/kleikamp/linux-shaggy: jfs: makes diUnmount/diMount in jfs_mount_rw atomic jfs: Fix a typo in function jfs_umount fs: jfs: fix shift-out-of-bounds in dbDiscardAG jfs: Fix fortify moan in symlink jfs: remove redundant assignments to ipaimap and ipaimap2 jfs: remove unused declarations for jfs fs/jfs/jfs_xattr.h: Fix spelling typo in comment MAINTAINERS: git://github -> https://github.com for kleikamp fs/jfs: replace ternary operator with min_t() fs: jfs: fix shift-out-of-bounds in dbAllocAG commit cda6a60acc95cba93e9c17352ed485555adc661f Merge: 07d7a4d6961a2 1f3868f06855c Author: Linus Torvalds Date: Mon Dec 12 20:32:50 2022 -0800 Merge tag 'fixes_for_v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf and ext2 fixes from Jan Kara: - a couple of smaller cleanups and fixes for ext2 - fixes of a data corruption issues in udf when handling holes and preallocation extents - fixes and cleanups of several smaller issues in udf - add maintainer entry for isofs * tag 'fixes_for_v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix extending file within last block udf: Discard preallocation before extending file with a hole udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix preallocation discarding at indirect extent boundary udf: Increase UDF_MAX_READ_VERSION to 0x0260 fs/ext2: Fix code indentation ext2: unbugger ext2_empty_dir() udf: remove ->writepage ext2: remove ->writepage ext2: Don't flush page immediately for DIRSYNC directories ext2: Fix some kernel-doc warnings maintainers: Add ISOFS entry udf: Avoid double brelse() in udf_rename() fs: udf: Optimize udf_free_in_core_inode and udf_find_fileset function commit 07d7a4d6961a221af7023d08c89da8ed12fa7dda Merge: 6e8948a0630f9 e7eda157c4071 Author: Linus Torvalds Date: Mon Dec 12 20:29:45 2022 -0800 Merge tag 'fs.xattr.simple.noaudit.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull xattr audit fix from Seth Forshee: "This is a single patch to remove auditing of the capability check in simple_xattr_list(). This check is done to check whether trusted xattrs should be included by listxattr(2). SELinux will normally log a denial when capable() is called and the task's SELinux context doesn't have the corresponding capability permission allowed, which can end up spamming the log. Since a failed check here cannot be used to infer malicious intent, auditing is of no real value, and it makes sense to stop auditing the capability check" * tag 'fs.xattr.simple.noaudit.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: don't audit the capability check in simple_xattr_list() commit 6e8948a0630f9ee46cf03dbf65949c1f4b6f6dd2 Merge: 043930b1c8895 42da66ac7bcb1 Author: Linus Torvalds Date: Mon Dec 12 20:24:51 2022 -0800 Merge tag 'fs.idmapped.squashfs.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull squashfs update from Seth Forshee: "This is a simple patch to enable idmapped mounts for squashfs. All functionality squashfs needs to support idmapped mounts is already implemented in generic VFS code, so all that is needed is to set FS_ALLOW_IDMAP in fs_flags" * tag 'fs.idmapped.squashfs.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: squashfs: enable idmapped mounts commit 043930b1c8895d626d340decfe9e418f7233edb8 Merge: 6df7cc2268745 b138777786f78 Author: Linus Torvalds Date: Mon Dec 12 20:22:09 2022 -0800 Merge tag 'fuse-update-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse update from Miklos Szeredi: - Allow some write requests to proceed in parallel - Fix a performance problem with allow_sys_admin_access - Add a special kind of invalidation that doesn't immediately purge submounts - On revalidation treat the target of rename(RENAME_NOREPLACE) the same as open(O_EXCL) - Use type safe helpers for some mnt_userns transformations * tag 'fuse-update-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: Rearrange fuse_allow_current_process checks fuse: allow non-extending parallel direct writes on the same file fuse: remove the unneeded result variable fuse: port to vfs{g,u}id_t and associated helpers fuse: Remove user_ns check for FUSE_DEV_IOC_CLONE fuse: always revalidate rename target dentry fuse: add "expire only" mode to FUSE_NOTIFY_INVAL_ENTRY fs/fuse: Replace kmap() with kmap_local_page() commit 6df7cc2268745e91d090830c58689aa7fcbde6f9 Merge: 4a6bff1187409 637d13b57d853 Author: Linus Torvalds Date: Mon Dec 12 20:18:26 2022 -0800 Merge tag 'ovl-update-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs update from Miklos Szeredi: - Fix a couple of bugs found by syzbot - Don't ingore some open flags set by fcntl(F_SETFL) - Fix failure to create a hard link in certain cases - Use type safe helpers for some mnt_userns transformations - Improve performance of mount - Misc cleanups * tag 'ovl-update-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: Kconfig: Fix spelling mistake "undelying" -> "underlying" ovl: use inode instead of dentry where possible ovl: Add comment on upperredirect reassignment ovl: use plain list filler in indexdir and workdir cleanup ovl: do not reconnect upper index records in ovl_indexdir_cleanup() ovl: fix comment typos ovl: port to vfs{g,u}id_t and associated helpers ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ovl: Use "buf" flexible array for memcpy() destination ovl: update ->f_iocb_flags when ovl_change_flags() modifies ->f_flags ovl: fix use inode directly in rcu-walk mode commit 4a6bff1187409f2c2ba1b17234541d314f0680fc Merge: ad0d9da164cb5 c505feba4c0d7 Author: Linus Torvalds Date: Mon Dec 12 20:14:04 2022 -0800 Merge tag 'erofs-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "In this cycle, large folios are now enabled in the iomap/fscache mode for uncompressed files first. In order to do that, we've also cleaned up better interfaces between erofs and fscache, which are acked by fscache/netfs folks and included in this pull request. Other than that, there are random fixes around erofs over fscache and crafted images by syzbot, minor cleanups and documentation updates. Summary: - Enable large folios for iomap/fscache mode - Avoid sysfs warning due to mounting twice with the same fsid and domain_id in fscache mode - Refine fscache interface among erofs, fscache, and cachefiles - Use kmap_local_page() only for metabuf - Fixes around crafted images found by syzbot - Minor cleanups and documentation updates" * tag 'erofs-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: validate the extent length for uncompressed pclusters erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails erofs: Fix pcluster memleak when its block address is zero erofs: use kmap_local_page() only for erofs_bread() erofs: enable large folios for fscache mode erofs: support large folios for fscache mode erofs: switch to prepare_ondemand_read() in fscache mode fscache,cachefiles: add prepare_ondemand_read() callback erofs: clean up cached I/O strategies erofs: update documentation erofs: check the uniqueness of fsid in shared domain in advance erofs: enable large folios for iomap mode commit ad0d9da164cb52e62637e427517b2060dc956a2d Merge: 8129bac60f309 a4bbf53d88c72 Author: Linus Torvalds Date: Mon Dec 12 20:06:35 2022 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity updates from Eric Biggers: "The main change this cycle is to stop using the PG_error flag to track verity failures, and instead just track failures at the bio level. This follows a similar fscrypt change that went into 6.1, and it is a step towards freeing up PG_error for other uses. There's also one other small cleanup" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fsverity: simplify fsverity_get_digest() fsverity: stop using PG_error to track error status commit 8129bac60f30936d2339535841db5b66d0520a67 Merge: deb9acc12250b 41952551acb40 Author: Linus Torvalds Date: Mon Dec 12 20:03:50 2022 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: "This release adds SM4 encryption support, contributed by Tianjia Zhang. SM4 is a Chinese block cipher that is an alternative to AES. I recommend against using SM4, but (according to Tianjia) some people are being required to use it. Since SM4 has been turning up in many other places (crypto API, wireless, TLS, OpenSSL, ARMv8 CPUs, etc.), it hasn't been very controversial, and some people have to use it, I don't think it would be fair for me to reject this optional feature. Besides the above, there are a couple cleanups" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fscrypt: add additional documentation for SM4 support fscrypt: remove unused Speck definitions fscrypt: Add SM4 XTS/CTS symmetric algorithm support blk-crypto: Add support for SM4-XTS blk crypto mode fscrypt: add comment for fscrypt_valid_enc_modes_v1() fscrypt: pass super_block to fscrypt_put_master_key_activeref() commit 1a4f69ef15ec29b213e2b086b2502644e8ef76ee Author: Dominique Martinet Date: Mon Dec 5 21:39:01 2022 +0900 9p/client: fix data race on req->status KCSAN reported a race between writing req->status in p9_client_cb and accessing it in p9_client_rpc's wait_event. Accesses to req itself is protected by the data barrier (writing req fields, write barrier, writing status // reading status, read barrier, reading other req fields), but status accesses themselves apparently also must be annotated properly with WRITE_ONCE/READ_ONCE when we access it without locks. Follows: - error paths writing status in various threads all can notify p9_client_rpc, so these all also need WRITE_ONCE - there's a similar read loop in trans_virtio for zc case that also needs READ_ONCE - other reads in trans_fd should be protected by the trans_fd lock and lists state machine, as corresponding writers all are within trans_fd and should be under the same lock. If KCSAN complains on them we likely will have something else to fix as well, so it's better to leave them unmarked and look again if required. Link: https://lkml.kernel.org/r/20221205124756.426350-1-asmadeus@codewreck.org Reported-by: Naresh Kamboju Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit deb9acc12250b13e40f7133f189d8a0891da53f3 Merge: 9b93f5069fd95 1da18e38cb97e Author: Linus Torvalds Date: Mon Dec 12 19:56:37 2022 -0800 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "A large number of cleanups and bug fixes, with many of the bug fixes found by Syzbot and fuzzing. (Many of the bug fixes involve less-used ext4 features such as fast_commit, inline_data and bigalloc) In addition, remove the writepage function for ext4, since the medium-term plan is to remove ->writepage() entirely. (The VM doesn't need or want writepage() for writeback, since it is fine with ->writepages() so long as ->migrate_folio() is implemented)" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (58 commits) ext4: fix reserved cluster accounting in __es_remove_extent() ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: allocate extended attribute value in vmalloc area ext4: avoid unaccounted block allocation when expanding inode ext4: initialize quota before expanding inode in setproject ioctl ext4: stop providing .writepage hook mm: export buffer_migrate_folio_norefs() ext4: switch to using write_cache_pages() for data=journal writeout jbd2: switch jbd2_submit_inode_data() to use fs-provided hook for data writeout ext4: switch to using ext4_do_writepages() for ordered data writeout ext4: move percpu_rwsem protection into ext4_writepages() ext4: provide ext4_do_writepages() ext4: add support for writepages calls that cannot map blocks ext4: drop pointless IO submission from ext4_bio_write_page() ext4: remove nr_submitted from ext4_bio_write_page() ext4: move keep_towrite handling to ext4_bio_write_page() ext4: handle redirtying in ext4_bio_write_page() ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ext4: make ext4_mb_initialize_context return void ext4: fix deadlock due to mbcache entry corruption ... commit d1c722867f8022a27182b9a1d84e9bca75486c9a Author: Christophe JAILLET Date: Mon Dec 12 20:37:16 2022 +0100 net: lan966x: Remove a useless test in lan966x_ptp_add_trap() vcap_alloc_rule() can't return NULL. So remove some dead-code Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/27992ffcee47fc865ce87274d6dfcffe7a1e69e0.1670873784.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 9b93f5069fd95cea7915aab321fd74d2548ba75c Merge: e1212e9b6f060 5a6f52d20ce3c Author: Linus Torvalds Date: Mon Dec 12 19:30:18 2022 -0800 Merge tag 'fs.idmapped.mnt_idmap.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull idmapping updates from Christian Brauner: "Last cycle we've already made the interaction with idmapped mounts more robust and type safe by introducing the vfs{g,u}id_t type. This cycle we concluded the conversion and removed the legacy helpers. Currently we still pass around the plain namespace that was attached to a mount. This is in general pretty convenient but it makes it easy to conflate namespaces that are relevant on the filesystem - with namespaces that are relevent on the mount level. Especially for filesystem developers without detailed knowledge in this area this can be a potential source for bugs. Instead of passing the plain namespace we introduce a dedicated type struct mnt_idmap and replace the pointer with a pointer to a struct mnt_idmap. There are no semantic or size changes for the mount struct caused by this. We then start converting all places aware of idmapped mounts to rely on struct mnt_idmap. Once the conversion is done all helpers down to the really low-level make_vfs{g,u}id() and from_vfs{g,u}id() will take a struct mnt_idmap argument instead of two namespace arguments. This way it becomes impossible to conflate the two removing and thus eliminating the possibility of any bugs. Fwiw, I fixed some issues in that area a while ago in ntfs3 and ksmbd in the past. Afterwards only low-level code can ultimately use the associated namespace for any permission checks. Even most of the vfs can be completely obivious about this ultimately and filesystems will never interact with it in any form in the future. A struct mnt_idmap currently encompasses a simple refcount and pointer to the relevant namespace the mount is idmapped to. If a mount isn't idmapped then it will point to a static nop_mnt_idmap and if it doesn't that it is idmapped. As usual there are no allocations or anything happening for non-idmapped mounts. Everthing is carefully written to be a nop for non-idmapped mounts as has always been the case. If an idmapped mount is created a struct mnt_idmap is allocated and a reference taken on the relevant namespace. Each mount that gets idmapped or inherits the idmap simply bumps the reference count on struct mnt_idmap. Just a reminder that we only allow a mount to change it's idmapping a single time and only if it hasn't already been attached to the filesystems and has no active writers. The actual changes are fairly straightforward but this will have huge benefits for maintenance and security in the long run even if it causes some churn. Note that this also makes it possible to extend struct mount_idmap in the future. For example, it would be possible to place the namespace pointer in an anonymous union together with an idmapping struct. This would allow us to expose an api to userspace that would let it specify idmappings directly instead of having to go through the detour of setting up namespaces at all" * tag 'fs.idmapped.mnt_idmap.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: acl: conver higher-level helpers to rely on mnt_idmap fs: introduce dedicated idmap type for mounts commit e1212e9b6f06016c62b1ee6fe7772293b90e695a Merge: cf619f891971b eb7718cdb73c6 Author: Linus Torvalds Date: Mon Dec 12 19:20:05 2022 -0800 Merge tag 'fs.vfsuid.conversion.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfsuid updates from Christian Brauner: "Last cycle we introduced the vfs{g,u}id_t types and associated helpers to gain type safety when dealing with idmapped mounts. That initial work already converted a lot of places over but there were still some left, This converts all remaining places that still make use of non-type safe idmapping helpers to rely on the new type safe vfs{g,u}id based helpers. Afterwards it removes all the old non-type safe helpers" * tag 'fs.vfsuid.conversion.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: remove unused idmapping helpers ovl: port to vfs{g,u}id_t and associated helpers fuse: port to vfs{g,u}id_t and associated helpers ima: use type safe idmapping helpers apparmor: use type safe idmapping helpers caps: use type safe idmapping helpers fs: use type safe idmapping helpers mnt_idmapping: add missing helpers commit cf619f891971bfac659ac64968f8c35db605c884 Merge: 6a518afcc2066 8d84e39d76bd8 Author: Linus Torvalds Date: Mon Dec 12 19:03:10 2022 -0800 Merge tag 'fs.ovl.setgid.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull setgid inheritance updates from Christian Brauner: "This contains the work to make setgid inheritance consistent between modifying a file and when changing ownership or mode as this has been a repeated source of very subtle bugs. The gist is that we perform the same permission checks in the write path as we do in the ownership and mode changing paths after this series where we're currently doing different things. We've already made setgid inheritance a lot more consistent and reliable in the last releases by moving setgid stripping from the individual filesystems up into the vfs. This aims to make the logic even more consistent and easier to understand and also to fix long-standing overlayfs setgid inheritance bugs. Miklos was nice enough to just let me carry the trivial overlayfs patches from Amir too. Below is a more detailed explanation how the current difference in setgid handling lead to very subtle bugs exemplified via overlayfs which is a victim of the current rules. I hope this explains why I think taking the regression risk here is worth it. A long while ago I found a few setgid inheritance bugs in overlayfs in the write path in certain conditions. Amir recently picked this back up in [1] and I jumped on board to fix this more generally. On the surface all that overlayfs would need to fix setgid inheritance would be to call file_remove_privs() or file_modified() but actually that isn't enough because the setgid inheritance api is wildly inconsistent in that area. Before this pr setgid stripping in file_remove_privs()'s old should_remove_suid() helper was inconsistent with other parts of the vfs. Specifically, it only raises ATTR_KILL_SGID if the inode is S_ISGID and S_IXGRP but not if the inode isn't in the caller's groups and the caller isn't privileged over the inode although we require this already in setattr_prepare() and setattr_copy() and so all filesystem implement this requirement implicitly because they have to use setattr_{prepare,copy}() anyway. But the inconsistency shows up in setgid stripping bugs for overlayfs in xfstests (e.g., generic/673, generic/683, generic/685, generic/686, generic/687). For example, we test whether suid and setgid stripping works correctly when performing various write-like operations as an unprivileged user (fallocate, reflink, write, etc.): echo "Test 1 - qa_user, non-exec file $verb" setup_testfile chmod a+rws $junk_file commit_and_check "$qa_user" "$verb" 64k 64k The test basically creates a file with 6666 permissions. While the file has the S_ISUID and S_ISGID bits set it does not have the S_IXGRP set. On a regular filesystem like xfs what will happen is: sys_fallocate() -> vfs_fallocate() -> xfs_file_fallocate() -> file_modified() -> __file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = ATTR_FORCE | kill; -> notify_change() -> setattr_copy() In should_remove_suid() we can see that ATTR_KILL_SUID is raised unconditionally because the file in the test has S_ISUID set. But we also see that ATTR_KILL_SGID won't be set because while the file is S_ISGID it is not S_IXGRP (see above) which is a condition for ATTR_KILL_SGID being raised. So by the time we call notify_change() we have attr->ia_valid set to ATTR_KILL_SUID | ATTR_FORCE. Now notify_change() sees that ATTR_KILL_SUID is set and does: ia_valid = attr->ia_valid |= ATTR_MODE attr->ia_mode = (inode->i_mode & ~S_ISUID); which means that when we call setattr_copy() later we will definitely update inode->i_mode. Note that attr->ia_mode still contains S_ISGID. Now we call into the filesystem's ->setattr() inode operation which will end up calling setattr_copy(). Since ATTR_MODE is set we will hit: if (ia_valid & ATTR_MODE) { umode_t mode = attr->ia_mode; vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode); if (!vfsgid_in_group_p(vfsgid) && !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID)) mode &= ~S_ISGID; inode->i_mode = mode; } and since the caller in the test is neither capable nor in the group of the inode the S_ISGID bit is stripped. But assume the file isn't suid then ATTR_KILL_SUID won't be raised which has the consequence that neither the setgid nor the suid bits are stripped even though it should be stripped because the inode isn't in the caller's groups and the caller isn't privileged over the inode. If overlayfs is in the mix things become a bit more complicated and the bug shows up more clearly. When e.g., ovl_setattr() is hit from ovl_fallocate()'s call to file_remove_privs() then ATTR_KILL_SUID and ATTR_KILL_SGID might be raised but because the check in notify_change() is questioning the ATTR_KILL_SGID flag again by requiring S_IXGRP for it to be stripped the S_ISGID bit isn't removed even though it should be stripped: sys_fallocate() -> vfs_fallocate() -> ovl_fallocate() -> file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = ATTR_FORCE | kill; -> notify_change() -> ovl_setattr() /* TAKE ON MOUNTER'S CREDS */ -> ovl_do_notify_change() -> notify_change() /* GIVE UP MOUNTER'S CREDS */ /* TAKE ON MOUNTER'S CREDS */ -> vfs_fallocate() -> xfs_file_fallocate() -> file_modified() -> __file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = attr_force | kill; -> notify_change() The fix for all of this is to make file_remove_privs()'s should_remove_suid() helper perform the same checks as we already require in setattr_prepare() and setattr_copy() and have notify_change() not pointlessly requiring S_IXGRP again. It doesn't make any sense in the first place because the caller must calculate the flags via should_remove_suid() anyway which would raise ATTR_KILL_SGID Note that some xfstests will now fail as these patches will cause the setgid bit to be lost in certain conditions for unprivileged users modifying a setgid file when they would've been kept otherwise. I think this risk is worth taking and I explained and mentioned this multiple times on the list [2]. Enforcing the rules consistently across write operations and chmod/chown will lead to losing the setgid bit in cases were it might've been retained before. While I've mentioned this a few times but it's worth repeating just to make sure that this is understood. For the sake of maintainability, consistency, and security this is a risk worth taking. If we really see regressions for workloads the fix is to have special setgid handling in the write path again with different semantics from chmod/chown and possibly additional duct tape for overlayfs. I'll update the relevant xfstests with if you should decide to merge this second setgid cleanup. Before that people should be aware that there might be failures for fstests where unprivileged users modify a setgid file" Link: https://lore.kernel.org/linux-fsdevel/20221003123040.900827-1-amir73il@gmail.com [1] Link: https://lore.kernel.org/linux-fsdevel/20221122142010.zchf2jz2oymx55qi@wittgenstein [2] * tag 'fs.ovl.setgid.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: use consistent setgid checks in is_sxid() ovl: remove privs in ovl_fallocate() ovl: remove privs in ovl_copyfile() attr: use consistent sgid stripping checks attr: add setattr_should_drop_sgid() fs: move should_remove_suid() attr: add in_group_or_capable() commit 6a518afcc2066732e6c5c24281ce017bbbd85506 Merge: bd90741318ee0 d6fdf29f7b998 Author: Linus Torvalds Date: Mon Dec 12 18:46:39 2022 -0800 Merge tag 'fs.acl.rework.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull VFS acl updates from Christian Brauner: "This contains the work that builds a dedicated vfs posix acl api. The origins of this work trace back to v5.19 but it took quite a while to understand the various filesystem specific implementations in sufficient detail and also come up with an acceptable solution. As we discussed and seen multiple times the current state of how posix acls are handled isn't nice and comes with a lot of problems: The current way of handling posix acls via the generic xattr api is error prone, hard to maintain, and type unsafe for the vfs until we call into the filesystem's dedicated get and set inode operations. It is already the case that posix acls are special-cased to death all the way through the vfs. There are an uncounted number of hacks that operate on the uapi posix acl struct instead of the dedicated vfs struct posix_acl. And the vfs must be involved in order to interpret and fixup posix acls before storing them to the backing store, caching them, reporting them to userspace, or for permission checking. Currently a range of hacks and duct tape exist to make this work. As with most things this is really no ones fault it's just something that happened over time. But the code is hard to understand and difficult to maintain and one is constantly at risk of introducing bugs and regressions when having to touch it. Instead of continuing to hack posix acls through the xattr handlers this series builds a dedicated posix acl api solely around the get and set inode operations. Going forward, the vfs_get_acl(), vfs_remove_acl(), and vfs_set_acl() helpers must be used in order to interact with posix acls. They operate directly on the vfs internal struct posix_acl instead of abusing the uapi posix acl struct as we currently do. In the end this removes all of the hackiness, makes the codepaths easier to maintain, and gets us type safety. This series passes the LTP and xfstests suites without any regressions. For xfstests the following combinations were tested: - xfs - ext4 - btrfs - overlayfs - overlayfs on top of idmapped mounts - orangefs - (limited) cifs There's more simplifications for posix acls that we can make in the future if the basic api has made it. A few implementation details: - The series makes sure to retain exactly the same security and integrity module permission checks. Especially for the integrity modules this api is a win because right now they convert the uapi posix acl struct passed to them via a void pointer into the vfs struct posix_acl format to perform permission checking on the mode. There's a new dedicated security hook for setting posix acls which passes the vfs struct posix_acl not a void pointer. Basing checking on the posix acl stored in the uapi format is really unreliable. The vfs currently hacks around directly in the uapi struct storing values that frankly the security and integrity modules can't correctly interpret as evidenced by bugs we reported and fixed in this area. It's not necessarily even their fault it's just that the format we provide to them is sub optimal. - Some filesystems like 9p and cifs need access to the dentry in order to get and set posix acls which is why they either only partially or not even at all implement get and set inode operations. For example, cifs allows setxattr() and getxattr() operations but doesn't allow permission checking based on posix acls because it can't implement a get acl inode operation. Thus, this patch series updates the set acl inode operation to take a dentry instead of an inode argument. However, for the get acl inode operation we can't do this as the old get acl method is called in e.g., generic_permission() and inode_permission(). These helpers in turn are called in various filesystem's permission inode operation. So passing a dentry argument to the old get acl inode operation would amount to passing a dentry to the permission inode operation which we shouldn't and probably can't do. So instead of extending the existing inode operation Christoph suggested to add a new one. He also requested to ensure that the get and set acl inode operation taking a dentry are consistently named. So for this version the old get acl operation is renamed to ->get_inode_acl() and a new ->get_acl() inode operation taking a dentry is added. With this we can give both 9p and cifs get and set acl inode operations and in turn remove their complex custom posix xattr handlers. In the future I hope to get rid of the inode method duplication but it isn't like we have never had this situation. Readdir is just one example. And frankly, the overall gain in type safety and the more pleasant api wise are simply too big of a benefit to not accept this duplication for a while. - We've done a full audit of every codepaths using variant of the current generic xattr api to get and set posix acls and surprisingly it isn't that many places. There's of course always a chance that we might have missed some and if so I'm sure we'll find them soon enough. The crucial codepaths to be converted are obviously stacking filesystems such as ecryptfs and overlayfs. For a list of all callers currently using generic xattr api helpers see [2] including comments whether they support posix acls or not. - The old vfs generic posix acl infrastructure doesn't obey the create and replace semantics promised on the setxattr(2) manpage. This patch series doesn't address this. It really is something we should revisit later though. The patches are roughly organized as follows: (1) Change existing set acl inode operation to take a dentry argument (Intended to be a non-functional change) (2) Rename existing get acl method (Intended to be a non-functional change) (3) Implement get and set acl inode operations for filesystems that couldn't implement one before because of the missing dentry. That's mostly 9p and cifs (Intended to be a non-functional change) (4) Build posix acl api, i.e., add vfs_get_acl(), vfs_remove_acl(), and vfs_set_acl() including security and integrity hooks (Intended to be a non-functional change) (5) Implement get and set acl inode operations for stacking filesystems (Intended to be a non-functional change) (6) Switch posix acl handling in stacking filesystems to new posix acl api now that all filesystems it can stack upon support it. (7) Switch vfs to new posix acl api (semantical change) (8) Remove all now unused helpers (9) Additional regression fixes reported after we merged this into linux-next Thanks to Seth for a lot of good discussion around this and encouragement and input from Christoph" * tag 'fs.acl.rework.v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: (36 commits) posix_acl: Fix the type of sentinel in get_acl orangefs: fix mode handling ovl: call posix_acl_release() after error checking evm: remove dead code in evm_inode_set_acl() cifs: check whether acl is valid early acl: make vfs_posix_acl_to_xattr() static acl: remove a slew of now unused helpers 9p: use stub posix acl handlers cifs: use stub posix acl handlers ovl: use stub posix acl handlers ecryptfs: use stub posix acl handlers evm: remove evm_xattr_acl_change() xattr: use posix acl api ovl: use posix acl api ovl: implement set acl method ovl: implement get acl method ecryptfs: implement set acl method ecryptfs: implement get acl method ksmbd: use vfs_remove_acl() acl: add vfs_remove_acl() ... commit bd90741318ee0a48244e8e4b9364023d730a80a9 Merge: 13c574fec815f e0c49bd2b4d3c Author: Linus Torvalds Date: Mon Dec 12 18:38:47 2022 -0800 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "misc pile" * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: sysv: Fix sysv_nblocks() returns wrong value get rid of INT_LIMIT, use type_max() instead btrfs: replace INT_LIMIT(loff_t) with OFFSET_MAX fs: simplify vfs_get_super fs: drop useless condition from inode_needs_update_time commit 13c574fec815f449fa812df60844bbb4b1548d19 Merge: 75f4d9af8b67d 61d8e42667716 Author: Linus Torvalds Date: Mon Dec 12 18:36:12 2022 -0800 Merge tag 'pull-namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull namespace fix from Al Viro: "Fix weird corner case in copy_mnt_ns()" * tag 'pull-namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: copy_mnt_ns(): handle a corner case (overmounted mntns bindings) saner commit 4f1354d5c6a3264c91238962d1597eef40c40419 Author: Zhen Lei Date: Wed Dec 7 11:23:04 2022 +0800 livepatch: Call klp_match_callback() in klp_find_callback() to avoid code duplication The implementation of function klp_match_callback() is identical to the partial implementation of function klp_find_callback(). So call function klp_match_callback() in function klp_find_callback() instead of the duplicated code. Signed-off-by: Zhen Lei Acked-by: Song Liu Reviewed-by: Petr Mladek Suggested-by: Petr Mladek Signed-off-by: Luis Chamberlain commit 75f4d9af8b67d7415afe50afcb4e96fd0bbd3ae2 Merge: 268369b171ff1 de4eda9de2d95 Author: Linus Torvalds Date: Mon Dec 12 18:29:54 2022 -0800 Merge tag 'pull-iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull iov_iter updates from Al Viro: "iov_iter work; most of that is about getting rid of direction misannotations and (hopefully) preventing more of the same for the future" * tag 'pull-iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: use less confusing names for iov_iter direction initializers iov_iter: saner checks for attempt to copy to/from iterator [xen] fix "direction" argument of iov_iter_kvec() [vhost] fix 'direction' argument of iov_iter_{init,bvec}() [target] fix iov_iter_bvec() "direction" argument [s390] memcpy_real(): WRITE is "data source", not destination... [s390] zcore: WRITE is "data source", not destination... [infiniband] READ is "data destination", not source... [fsi] WRITE is "data source", not destination... [s390] copy_oldmem_kernel() - WRITE is "data source", not destination csum_and_copy_to_iter(): handle ITER_DISCARD get rid of unlikely() on page_copy_sane() calls commit 268369b171ff1be6a68ae8f33d0602c6bea48d2e Merge: 405b2fc66333c fa6a3bf7ff373 Author: Linus Torvalds Date: Mon Dec 12 18:27:06 2022 -0800 Merge tag 'pull-alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull alpha updates from Al Viro: "Alpha architecture cleanups and fixes. One thing *not* included is lazy FPU switching stuff - this pile is just the straightforward stuff" * tag 'pull-alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: alpha: ret_from_fork can go straight to ret_to_user alpha: syscall exit cleanup alpha: fix handling of a3 on straced syscalls alpha: fix syscall entry in !AUDUT_SYSCALL case alpha: _TIF_ALLWORK_MASK is unused alpha: fix TIF_NOTIFY_SIGNAL handling commit 405b2fc66333cf12e613634d49de301658e26426 Merge: 8702f2c611bf1 38ba2f11d9ce0 Author: Linus Torvalds Date: Mon Dec 12 18:18:34 2022 -0800 Merge tag 'pull-elfcore' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull elf coredumping updates from Al Viro: "Unification of regset and non-regset sides of ELF coredump handling. Collecting per-thread register values is the only thing that needs to be ifdefed there..." * tag 'pull-elfcore' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: [elf] get rid of get_note_info_size() [elf] unify regset and non-regset cases [elf][non-regset] use elf_core_copy_task_regs() for dumper as well [elf][non-regset] uninline elf_core_copy_task_fpregs() (and lose pt_regs argument) elf_core_copy_task_regs(): task_pt_regs is defined everywhere [elf][regset] simplify thread list handling in fill_note_info() [elf][regset] clean fill_note_info() a bit kill extern of vsyscall32_sysctl kill coredump_params->regs kill signal_pt_regs() commit 8702f2c611bf124c48b21b5c57bfc156cd11f4ca Merge: a7cacfb0688e3 12b677f2c697d Author: Linus Torvalds Date: Mon Dec 12 17:28:58 2022 -0800 Merge tag 'mm-nonmm-stable-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - A ptrace API cleanup series from Sergey Shtylyov - Fixes and cleanups for kexec from ye xingchen - nilfs2 updates from Ryusuke Konishi - squashfs feature work from Xiaoming Ni: permit configuration of the filesystem's compression concurrency from the mount command line - A series from Akinobu Mita which addresses bound checking errors when writing to debugfs files - A series from Yang Yingliang to address rapidio memory leaks - A series from Zheng Yejian to address possible overflow errors in encode_comp_t() - And a whole shower of singleton patches all over the place * tag 'mm-nonmm-stable-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (79 commits) ipc: fix memory leak in init_mqueue_fs() hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount rapidio: devices: fix missing put_device in mport_cdev_open kcov: fix spelling typos in comments hfs: Fix OOB Write in hfs_asc2mac hfs: fix OOB Read in __hfs_brec_find relay: fix type mismatch when allocating memory in relay_create_buf() ocfs2: always read both high and low parts of dinode link count io-mapping: move some code within the include guarded section kernel: kcsan: kcsan_test: build without structleak plugin mailmap: update email for Iskren Chernev eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD rapidio: fix possible UAF when kfifo_alloc() fails relay: use strscpy() is more robust and safer cpumask: limit visibility of FORCE_NR_CPUS acct: fix potential integer overflow in encode_comp_t() acct: fix accuracy loss for input value of encode_comp_t() linux/init.h: include and rapidio: rio: fix possible name leak in rio_register_mport() rapidio: fix possible name leaks when rio_add_device() fails ... commit a7cacfb0688e3988660e90fad7017cc9a18ab390 Merge: 96f4263568473 cc8c418b4fc09 Author: Linus Torvalds Date: Mon Dec 12 17:18:50 2022 -0800 Merge tag 'docs-6.2' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "This was a not-too-busy cycle for documentation; highlights include: - The beginnings of a set of translations into Spanish, headed up by Carlos Bilbao - More Chinese translations - A change to the Sphinx "alabaster" theme by default for HTML generation. Unlike the previous default (Read the Docs), alabaster is shipped with Sphinx by default, reducing the number of other dependencies that need to be installed. It also (IMO) produces a cleaner and more readable result. - The ability to render the documentation into the texinfo format (something Sphinx could always do, we just never wired it up until now) Plus the usual collection of typo fixes, build-warning fixes, and minor updates" * tag 'docs-6.2' of git://git.lwn.net/linux: (67 commits) Documentation/features: Use loongarch instead of loong Documentation/features-refresh.sh: Only sed the beginning "arch" of ARCH_DIR docs/zh_CN: Fix '.. only::' directive's expression docs/sp_SP: Add memory-barriers.txt Spanish translation docs/zh_CN/LoongArch: Update links of LoongArch ISA Vol1 and ELF psABI docs/LoongArch: Update links of LoongArch ISA Vol1 and ELF psABI Documentation/features: Update feature lists for 6.1 Documentation: Fixed a typo in bootconfig.rst docs/sp_SP: Add process coding-style translation docs/sp_SP: Add kernel-docs.rst Spanish translation docs: Create translations/sp_SP/process/, move submitting-patches.rst docs: Add book to process/kernel-docs.rst docs: Retire old resources from kernel-docs.rst docs: Update maintainer of kernel-docs.rst Documentation: riscv: Document the sv57 VM layout Documentation: USB: correct possessive "its" usage math64: fix kernel-doc return value warnings math64: add kernel-doc for DIV64_U64_ROUND_UP math64: favor kernel-doc from header files doc: add texinfodocs and infodocs targets ... commit 96f42635684739cb563aa48d92d0d16b8dc9bda8 Merge: eb4511538191a b9ecf9b9ac596 Author: Linus Torvalds Date: Mon Dec 12 16:59:00 2022 -0800 Merge tag 'rust-6.2' of https://github.com/Rust-for-Linux/linux Pull rust updates from Miguel Ojeda: "The first set of changes after the merge, the major ones being: - String and formatting: new types 'CString', 'CStr', 'BStr' and 'Formatter'; new macros 'c_str!', 'b_str!' and 'fmt!'. - Errors: the rest of the error codes from 'errno-base.h', as well as some 'From' trait implementations for the 'Error' type. - Printing: the rest of the 'pr_*!' levels and the continuation one 'pr_cont!', as well as a new sample. - 'alloc' crate: new constructors 'try_with_capacity()' and 'try_with_capacity_in()' for 'RawVec' and 'Vec'. - Procedural macros: new macros '#[vtable]' and 'concat_idents!', as well as better ergonomics for 'module!' users. - Asserting: new macros 'static_assert!', 'build_error!' and 'build_assert!', as well as a new crate 'build_error' to support them. - Vocabulary types: new types 'Opaque' and 'Either'. - Debugging: new macro 'dbg!'" * tag 'rust-6.2' of https://github.com/Rust-for-Linux/linux: (28 commits) rust: types: add `Opaque` type rust: types: add `Either` type rust: build_assert: add `build_{error,assert}!` macros rust: add `build_error` crate rust: static_assert: add `static_assert!` macro rust: std_vendor: add `dbg!` macro based on `std`'s one rust: str: add `fmt!` macro rust: str: add `CString` type rust: str: add `Formatter` type rust: str: add `c_str!` macro rust: str: add `CStr` unit tests rust: str: implement several traits for `CStr` rust: str: add `CStr` type rust: str: add `b_str!` macro rust: str: add `BStr` type rust: alloc: add `Vec::try_with_capacity{,_in}()` constructors rust: alloc: add `RawVec::try_with_capacity_in()` constructor rust: prelude: add `error::code::*` constant items rust: error: add `From` implementations for `Error` rust: error: add codes from `errno-base.h` ... commit eb4511538191ac758faa0735fe06c5ce8202ae04 Merge: 535ea85de3dab afc70ccb96286 Author: Linus Torvalds Date: Mon Dec 12 16:48:48 2022 -0800 Merge tag 'trace-tools-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: - New tool "rv" for starting and stopping runtime verification. Example: ./rv mon wip -r printk -v Enables the wake-in-preempt monitor and the printk reactor in verbose mode - Fix exit status of rtla usage() calls * tag 'trace-tools-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: Documentation/rv: Add verification/rv man pages tools/rv: Add in-kernel monitor interface rv: Add rv tool rtla: Fix exit status when returning from calls to usage() commit c45bc55a99957b20e4e0333bcd42e12d1833a7f5 Author: Sidhartha Kumar Date: Mon Dec 12 14:55:29 2022 -0800 mm/hugetlb: set head flag before setting compound_order in __prep_compound_gigantic_folio folio_set_compound_order() checks if the passed in folio is a large folio. A large folio is indicated by the PG_head flag. Call __folio_set_head() before setting the order. Link: https://lkml.kernel.org/r/20221212225529.22493-1-sidhartha.kumar@oracle.com Fixes: d1c6095572d0 ("mm/hugetlb: convert hugetlb prep functions to folios") Signed-off-by: Sidhartha Kumar Reported-by: David Hildenbrand Signed-off-by: Andrew Morton commit 535ea85de3dabf8c04e88b6e968ff793b7e58da9 Merge: e2ed78d5d9ca0 88a51b4f2e65c Author: Linus Torvalds Date: Mon Dec 12 16:46:08 2022 -0800 Merge tag 'ktest-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Fix minconfig test to unset the config and not relying on olddefconfig to do it, as some configs are set to default y - Fix reading grub2 menus for handling submenus - Add new ${shell } to execute shell commands that will be useful for setting variables like: HOSTNAME := ${shell hostname} * tag 'ktest-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest.pl: Add shell commands to variables kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them commit e2ed78d5d9ca07a2b9d158ebac366170a2d3083d Merge: 23a68d14def82 054be257f28ca Author: Linus Torvalds Date: Mon Dec 12 16:42:57 2022 -0800 Merge tag 'linux-kselftest-kunit-next-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: "Several enhancements, fixes, clean-ups, documentation updates, improvements to logging and KTAP compliance of KUnit test output: - log numbers in decimal and hex - parse KTAP compliant test output - allow conditionally exposing static symbols to tests when KUNIT is enabled - make static symbols visible during kunit testing - clean-ups to remove unused structure definition" * tag 'linux-kselftest-kunit-next-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (29 commits) Documentation: dev-tools: Clarify requirements for result description apparmor: test: make static symbols visible during kunit testing kunit: add macro to allow conditionally exposing static symbols to tests kunit: tool: make parser preserve whitespace when printing test log Documentation: kunit: Fix "How Do I Use This" / "Next Steps" sections kunit: tool: don't include KTAP headers and the like in the test log kunit: improve KTAP compliance of KUnit test output kunit: tool: parse KTAP compliant test output mm: slub: test: Use the kunit_get_current_test() function kunit: Use the static key when retrieving the current test kunit: Provide a static key to check if KUnit is actively running tests kunit: tool: make --json do nothing if --raw_ouput is set kunit: tool: tweak error message when no KTAP found kunit: remove KUNIT_INIT_MEM_ASSERTION macro Documentation: kunit: Remove redundant 'tips.rst' page Documentation: KUnit: reword description of assertions Documentation: KUnit: make usage.rst a superset of tips.rst, remove duplication kunit: eliminate KUNIT_INIT_*_ASSERT_STRUCT macros kunit: tool: remove redundant file.close() call in unit test kunit: tool: unit tests all check parser errors, standardize formatting a bit ... commit 23a68d14def8247735b66a14b370b42d8fcedb47 Merge: 268325bda5299 d5ba85d6d8be7 Author: Linus Torvalds Date: Mon Dec 12 16:39:38 2022 -0800 Merge tag 'linux-kselftest-next-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: "Several fixes and enhancements to existing tests and a few new tests: - add new amd-pstate tests and fix and enhance existing ones - add new watchdog tests and enhance existing ones to improve coverage - fixes to ftrace, splice_read, rtc, and efivars tests - fixes to handle egrep obsolescence in the latest grep release - miscellaneous spelling and SPDX fixes" * tag 'linux-kselftest-next-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (24 commits) selftests/ftrace: Use long for synthetic event probe test selftests/tpm2: Split async tests call to separate shell script runner selftests: splice_read: Fix sysfs read cases selftests: ftrace: Use "grep -E" instead of "egrep" selftests: gpio: Use "grep -E" instead of "egrep" selftests: kselftest_deps: Use "grep -E" instead of "egrep" selftests/efivarfs: Add checking of the test return value cpufreq: amd-pstate: fix spdxcheck warnings for amd-pstate-ut.c selftests: rtc: skip when RTC is not present selftests/ftrace: event_triggers: wait longer for test_event_enable selftests/vDSO: Add riscv getcpu & gettimeofday test Documentation: amd-pstate: Add tbench and gitsource test introduction selftests: amd-pstate: Trigger gitsource benchmark and test cpus selftests: amd-pstate: Trigger tbench benchmark and test cpus selftests: amd-pstate: Split basic.sh into run.sh and basic.sh. selftests: amd-pstate: Rename amd-pstate-ut.sh to basic.sh. selftests/ftrace: Convert tracer tests to use 'requires' to specify program dependency selftests/ftrace: Add check for ping command for trigger tests selftests/watchdog: Fix spelling mistake "Temeprature" -> "Temperature" selftests/watchdog: add test for WDIOC_GETTEMP ... commit 268325bda5299836a6ad4c3952474a2be125da5f Merge: ca1443c7e75a2 3e6743e28b9b4 Author: Linus Torvalds Date: Mon Dec 12 16:22:22 2022 -0800 Merge tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator updates from Jason Donenfeld: - Replace prandom_u32_max() and various open-coded variants of it, there is now a new family of functions that uses fast rejection sampling to choose properly uniformly random numbers within an interval: get_random_u32_below(ceil) - [0, ceil) get_random_u32_above(floor) - (floor, U32_MAX] get_random_u32_inclusive(floor, ceil) - [floor, ceil] Coccinelle was used to convert all current users of prandom_u32_max(), as well as many open-coded patterns, resulting in improvements throughout the tree. I'll have a "late" 6.1-rc1 pull for you that removes the now unused prandom_u32_max() function, just in case any other trees add a new use case of it that needs to converted. According to linux-next, there may be two trivial cases of prandom_u32_max() reintroductions that are fixable with a 's/.../.../'. So I'll have for you a final conversion patch doing that alongside the removal patch during the second week. This is a treewide change that touches many files throughout. - More consistent use of get_random_canary(). - Updates to comments, documentation, tests, headers, and simplification in configuration. - The arch_get_random*_early() abstraction was only used by arm64 and wasn't entirely useful, so this has been replaced by code that works in all relevant contexts. - The kernel will use and manage random seeds in non-volatile EFI variables, refreshing a variable with a fresh seed when the RNG is initialized. The RNG GUID namespace is then hidden from efivarfs to prevent accidental leakage. These changes are split into random.c infrastructure code used in the EFI subsystem, in this pull request, and related support inside of EFISTUB, in Ard's EFI tree. These are co-dependent for full functionality, but the order of merging doesn't matter. - Part of the infrastructure added for the EFI support is also used for an improvement to the way vsprintf initializes its siphash key, replacing an sleep loop wart. - The hardware RNG framework now always calls its correct random.c input function, add_hwgenerator_randomness(), rather than sometimes going through helpers better suited for other cases. - The add_latent_entropy() function has long been called from the fork handler, but is a no-op when the latent entropy gcc plugin isn't used, which is fine for the purposes of latent entropy. But it was missing out on the cycle counter that was also being mixed in beside the latent entropy variable. So now, if the latent entropy gcc plugin isn't enabled, add_latent_entropy() will expand to a call to add_device_randomness(NULL, 0), which adds a cycle counter, without the absent latent entropy variable. - The RNG is now reseeded from a delayed worker, rather than on demand when used. Always running from a worker allows it to make use of the CPU RNG on platforms like S390x, whose instructions are too slow to do so from interrupts. It also has the effect of adding in new inputs more frequently with more regularity, amounting to a long term transcript of random values. Plus, it helps a bit with the upcoming vDSO implementation (which isn't yet ready for 6.2). - The jitter entropy algorithm now tries to execute on many different CPUs, round-robining, in hopes of hitting even more memory latencies and other unpredictable effects. It also will mix in a cycle counter when the entropy timer fires, in addition to being mixed in from the main loop, to account more explicitly for fluctuations in that timer firing. And the state it touches is now kept within the same cache line, so that it's assured that the different execution contexts will cause latencies. * tag 'random-6.2-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: (23 commits) random: include in the right header random: align entropy_timer_state to cache line random: mix in cycle counter when jitter timer fires random: spread out jitter callback to different CPUs random: remove extraneous period and add a missing one in comments efi: random: refresh non-volatile random seed when RNG is initialized vsprintf: initialize siphash key using notifier random: add back async readiness notifier random: reseed in delayed work rather than on-demand random: always mix cycle counter in add_latent_entropy() hw_random: use add_hwgenerator_randomness() for early entropy random: modernize documentation comment on get_random_bytes() random: adjust comment to account for removed function random: remove early archrandom abstraction random: use random.trust_{bootloader,cpu} command line option only stackprotector: actually use get_random_canary() stackprotector: move get_random_canary() into stackprotector.h treewide: use get_random_u32_inclusive() when possible treewide: use get_random_u32_{above,below}() instead of manual loop treewide: use get_random_u32_below() instead of deprecated function ... commit ca1443c7e75a28c6fde5c67cb1904b624cf43c36 Merge: e1a1ccef7a4f3 d667c94962c1c Author: Linus Torvalds Date: Mon Dec 12 16:07:04 2022 -0800 Merge branch 'for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu updates from Dennis Zhou: "Baoquan was nice enough to run some clean ups for percpu" * 'for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: mm/percpu: remove unused PERCPU_DYNAMIC_EARLY_SLOTS mm/percpu.c: remove the lcm code since block size is fixed at page size mm/percpu: replace the goto with break mm/percpu: add comment to state the empty populated pages accounting mm/percpu: Update the code comment when creating new chunk mm/percpu: use list_first_entry_or_null in pcpu_reclaim_populated() mm/percpu: remove unused pcpu_map_extend_chunks commit e1a1ccef7a4f3a3058cd6c039a56b4c2c98479f1 Merge: a312a8cc3c7fe 53910ef7ba04f Author: Linus Torvalds Date: Mon Dec 12 16:01:02 2022 -0800 Merge tag 'livepatching-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek: - code cleanup * tag 'livepatching-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Move the result-invariant calculation out of the loop commit c4b7a297217a22e4b36afd6d298ae9c7583ae7f9 Merge: b6488b161ab29 b310de784bacd Author: Jakub Kicinski Date: Mon Dec 12 15:55:08 2022 -0800 Merge branch 'net-ipa-enable-ipa-v4-7-support' Alex Elder says: ==================== net: ipa: enable IPA v4.7 support The first patch in this series adds "qcom,sm6350-ipa" as a possible IPA compatible string, for the Qualcomm SM6350 SoC. That SoC uses IPA v4.7 The second patch in this series adds code that enables support for IPA v4.7. DTS updates that make use of these will be merged later. ==================== Link: https://lore.kernel.org/r/20221208211529.757669-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit b310de784bacd20f5217a81b725de979ef24848e Author: Alex Elder Date: Thu Dec 8 15:15:29 2022 -0600 net: ipa: add IPA v4.7 support Add the necessary register and data definitions needed for IPA v4.7, which is found on the SM6350 SoC. Co-developed-by: Luca Weiss Signed-off-by: Luca Weiss Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 5071429f828140e96d9973991e024dfa97ed42f5 Author: Luca Weiss Date: Thu Dec 8 15:15:28 2022 -0600 dt-bindings: net: qcom,ipa: Add SM6350 compatible Add support for SM6350, which uses IPA v4.7. Signed-off-by: Luca Weiss Signed-off-by: Alex Elder Acked-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit a312a8cc3c7fe96f5e54e69c676f5bd12995f44e Merge: bf57ae2165bad 674b745e22b3c Author: Linus Torvalds Date: Mon Dec 12 15:48:36 2022 -0800 Merge tag 'cgroup-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Nothing too interesting: - Add CONFIG_DEBUG_GROUP_REF which makes cgroup refcnt operations kprobable - A couple cpuset optimizations - Other misc changes including doc and test updates" * tag 'cgroup-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: remove rcu_read_lock()/rcu_read_unlock() in critical section of spin_lock_irq() cgroup/cpuset: Improve cpuset_css_alloc() description kselftest/cgroup: Add cleanup() to test_cpuset_prs.sh cgroup/cpuset: Optimize cpuset_attach() on v2 cgroup/cpuset: Skip spread flags update on v2 kselftest/cgroup: Fix gathering number of CPUs cgroup: cgroup refcnt functions should be exported when CONFIG_DEBUG_CGROUP_REF cgroup: Implement DEBUG_CGROUP_REF commit b6488b161ab2972a0b4f45490ea3aecef2b23256 Author: Coco Li Date: Sat Dec 10 04:16:46 2022 +0000 bnxt: Use generic HBH removal helper in tx path Eric Dumazet implemented Big TCP that allowed bigger TSO/GRO packet sizes for IPv6 traffic. See patch series: 'commit 89527be8d8d6 ("net: add IFLA_TSO_{MAX_SIZE|SEGS} attributes")' This reduces the number of packets traversing the networking stack and should usually improves performance. However, it also inserts a temporary Hop-by-hop IPv6 extension header. Using the HBH header removal method in the previous patch, the extra header be removed in bnxt drivers to allow it to send big TCP packets (bigger TSO packets) as well. Tested: Compiled locally To further test functional correctness, update the GSO/GRO limit on the physical NIC: ip link set eth0 gso_max_size 181000 ip link set eth0 gro_max_size 181000 Note that if there are bonding or ipvan devices on top of the physical NIC, their GSO sizes need to be updated as well. Then, IPv6/TCP packets with sizes larger than 64k can be observed. Signed-off-by: Coco Li Reviewed-by: Michael Chan Tested-by: Michael Chan Link: https://lore.kernel.org/r/20221210041646.3587757-2-lixiaoyan@google.com Signed-off-by: Jakub Kicinski commit 89300468e2b2ec216c7827ba04ac45c129794403 Author: Coco Li Date: Sat Dec 10 04:16:45 2022 +0000 IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver IPv6/TCP and GRO stacks can build big TCP packets with an added temporary Hop By Hop header. Is GSO is not involved, then the temporary header needs to be removed in the driver. This patch provides a generic helper for drivers that need to modify their headers in place. Tested: Compiled and ran with ethtool -K eth1 tso off Could send Big TCP packets Signed-off-by: Coco Li Link: https://lore.kernel.org/r/20221210041646.3587757-1-lixiaoyan@google.com Signed-off-by: Jakub Kicinski commit bf57ae2165bad1cb273095a5c09708ab503cd874 Merge: add7695957573 d6962c4fe8f96 Author: Linus Torvalds Date: Mon Dec 12 15:33:42 2022 -0800 Merge tag 'sched-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Implement persistent user-requested affinity: introduce affinity_context::user_mask and unconditionally preserve the user-requested CPU affinity masks, for long-lived tasks to better interact with cpusets & CPU hotplug events over longer timespans, without destroying the original affinity intent if the underlying topology changes. - Uclamp updates: fix relationship between uclamp and fits_capacity() - PSI fixes - Misc fixes & updates * tag 'sched-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Clear ttwu_pending after enqueue_task() sched/psi: Use task->psi_flags to clear in CPU migration sched/psi: Stop relying on timer_pending() for poll_work rescheduling sched/psi: Fix avgs_work re-arm in psi_avgs_work() sched/psi: Fix possible missing or delayed pending event sched: Always clear user_cpus_ptr in do_set_cpus_allowed() sched: Enforce user requested affinity sched: Always preserve the user requested cpumask sched: Introduce affinity_context sched: Add __releases annotations to affine_move_task() sched/fair: Check if prev_cpu has highest spare cap in feec() sched/fair: Consider capacity inversion in util_fits_cpu() sched/fair: Detect capacity inversion sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition sched/uclamp: Make cpu_overutilized() use util_fits_cpu() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/uclamp: Fix fits_capacity() check in feec() sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Fix relationship between uclamp and migration margin commit 8150f0cfb24f781aa61a332bf2426365462afff8 Merge: 02abf84aa52da b6d00da08610e Author: Jakub Kicinski Date: Mon Dec 12 15:33:39 2022 -0800 Merge branch 'bridge-mcast-extensions-for-evpn' Ido Schimmel says: ==================== bridge: mcast: Extensions for EVPN tl;dr ===== This patchset creates feature parity between user space and the kernel and allows the former to install and replace MDB port group entries with a source list and associated filter mode. This is required for EVPN use cases where multicast state is not derived from snooped IGMP/MLD packets, but instead derived from EVPN routes exchanged by the control plane in user space. Background ========== IGMPv3 [1] and MLDv2 [2] differ from earlier versions of the protocols in that they add support for source-specific multicast. That is, hosts can advertise interest in listening to a particular multicast address only from specific source addresses or from all sources except for specific source addresses. In kernel 5.10 [3][4], the bridge driver gained the ability to snoop IGMPv3/MLDv2 packets and install corresponding MDB port group entries. For example, a snooped IGMPv3 Membership Report that contains a single MODE_IS_EXCLUDE record for group 239.10.10.10 with sources 192.0.2.1, 192.0.2.2, 192.0.2.20 and 192.0.2.21 would trigger the creation of these entries: # bridge -d mdb show dev br0 port veth1 grp 239.10.10.10 src 192.0.2.21 temp filter_mode include proto kernel blocked dev br0 port veth1 grp 239.10.10.10 src 192.0.2.20 temp filter_mode include proto kernel blocked dev br0 port veth1 grp 239.10.10.10 src 192.0.2.2 temp filter_mode include proto kernel blocked dev br0 port veth1 grp 239.10.10.10 src 192.0.2.1 temp filter_mode include proto kernel blocked dev br0 port veth1 grp 239.10.10.10 temp filter_mode exclude source_list 192.0.2.21/0.00,192.0.2.20/0.00,192.0.2.2/0.00,192.0.2.1/0.00 proto kernel While the kernel can install and replace entries with a filter mode and source list, user space cannot. It can only add EXCLUDE entries with an empty source list, which is sufficient for IGMPv2/MLDv1, but not for IGMPv3/MLDv2. Use cases where the multicast state is not derived from snooped packets, but instead derived from routes exchanged by the user space control plane require feature parity between user space and the kernel in terms of MDB configuration. Such a use case is detailed in the next section. Motivation ========== RFC 7432 [5] defines a "MAC/IP Advertisement route" (type 2) [6] that allows NVE switches in the EVPN network to advertise and learn reachability information for unicast MAC addresses. Traffic destined to a unicast MAC address can therefore be selectively forwarded to a single NVE switch behind which the MAC is located. The same is not true for IP multicast traffic. Such traffic is simply flooded as BUM to all NVE switches in the broadcast domain (BD), regardless if a switch has interested receivers for the multicast stream or not. This is especially problematic for overlay networks that make heavy use of multicast. The issue is addressed by RFC 9251 [7] that defines a "Selective Multicast Ethernet Tag Route" (type 6) [8] which allows NVE switches in the EVPN network to advertise multicast streams that they are interested in. This is done by having each switch suppress IGMP/MLD packets from being transmitted to the NVE network and instead communicate the information over BGP to other switches. As far as the bridge driver is concerned, the above means that the multicast state (i.e., {multicast address, group timer, filter-mode, (source records)}) for the VXLAN bridge port is not populated by the kernel from snooped IGMP/MLD packets (they are suppressed), but instead by user space. Specifically, by the routing daemon that is exchanging EVPN routes with other NVE switches. Changes are obviously also required in the VXLAN driver, but they are the subject of future patchsets. See the "Future work" section. Implementation ============== The user interface is extended to allow user space to specify the filter mode of the MDB port group entry and its source list. Replace support is also added so that user space would not need to remove an entry and re-add it only to edit its source list or filter mode, as that would result in packet loss. Example usage: # bridge mdb replace dev br0 port dummy10 grp 239.1.1.1 permanent \ source_list 192.0.2.1,192.0.2.3 filter_mode exclude proto zebra # bridge -d -s mdb show dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.3 permanent filter_mode include proto zebra blocked 0.00 dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.1 permanent filter_mode include proto zebra blocked 0.00 dev br0 port dummy10 grp 239.1.1.1 permanent filter_mode exclude source_list 192.0.2.3/0.00,192.0.2.1/0.00 proto zebra 0.00 The netlink interface is extended with a few new attributes in the RTM_NEWMDB request message: [ struct nlmsghdr ] [ struct br_port_msg ] [ MDBA_SET_ENTRY ] struct br_mdb_entry [ MDBA_SET_ENTRY_ATTRS ] [ MDBE_ATTR_SOURCE ] struct in_addr / struct in6_addr [ MDBE_ATTR_SRC_LIST ] // new [ MDBE_SRC_LIST_ENTRY ] [ MDBE_SRCATTR_ADDRESS ] struct in_addr / struct in6_addr [ ...] [ MDBE_ATTR_GROUP_MODE ] // new u8 [ MDBE_ATTR_RTPORT ] // new u8 No changes are required in RTM_NEWMDB responses and notifications, as all the information can already be dumped by the kernel today. Testing ======= Tested with existing bridge multicast selftests: bridge_igmp.sh, bridge_mdb_port_down.sh, bridge_mdb.sh, bridge_mld.sh, bridge_vlan_mcast.sh. In addition, added many new test cases for existing as well as for new MDB functionality. Patchset overview ================= Patches #1-#8 are non-functional preparations for the core changes in later patches. Patches #9-#10 allow user space to install (*, G) entries with a source list and associated filter mode. Specifically, patch #9 adds the necessary kernel plumbing and patch #10 exposes the new functionality to user space via a few new attributes. Patch #11 allows user space to specify the routing protocol of new MDB port group entries so that a routing daemon could differentiate between entries installed by it and those installed by an administrator. Patch #12 allows user space to replace MDB port group entries. This is useful, for example, when user space wants to add a new source to a source list. Instead of deleting a (*, G) entry and re-adding it with an extended source list (which would result in packet loss), user space can simply replace the current entry. Patches #13-#14 add tests for existing MDB functionality as well as for all new functionality added in this patchset. Future work =========== The VXLAN driver will need to be extended with an MDB so that it could selectively forward IP multicast traffic to NVE switches with interested receivers instead of simply flooding it to all switches as BUM. The idea is to reuse the existing MDB interface for the VXLAN driver in a similar way to how the FDB interface is shared between the bridge and VXLAN drivers. From command line perspective, configuration will look as follows: # bridge mdb add dev br0 port vxlan0 grp 239.1.1.1 permanent \ filter_mode exclude source_list 198.50.100.1,198.50.100.2 # bridge mdb add dev vxlan0 port vxlan0 grp 239.1.1.1 permanent \ filter_mode include source_list 198.50.100.3,198.50.100.4 \ dst 192.0.2.1 dst_port 4789 src_vni 2 # bridge mdb add dev vxlan0 port vxlan0 grp 239.1.1.1 permanent \ filter_mode exclude source_list 198.50.100.1,198.50.100.2 \ dst 192.0.2.2 dst_port 4789 src_vni 2 Where the first command is enabled by this set, but the next two will be the subject of future work. From netlink perspective, the existing PF_BRIDGE/RTM_*MDB messages will be extended to the VXLAN driver. This means that a few new attributes will be added (e.g., 'MDBE_ATTR_SRC_VNI') and that the handlers for these messages will need to move to net/core/rtnetlink.c. The rtnetlink code will call into the appropriate driver based on the ifindex specified in the ancillary header. iproute2 patches can be found here [9]. Changelog ========= Since v1 [10]: * Patch #12: Remove extack from br_mdb_replace_group_sg(). * Patch #12: Change 'nlflags' to u16 and move it after 'filter_mode' to pack the structure. Since RFC [11]: * Patch #6: New patch. * Patch #9: Use an array instead of a list to store source entries. * Patch #10: Use an array instead of list to store source entries. * Patch #10: Drop br_mdb_config_attrs_fini(). * Patch #11: Reject protocol for host entries. * Patch #13: New patch. * Patch #14: New patch. [1] https://datatracker.ietf.org/doc/html/rfc3376 [2] https://www.rfc-editor.org/rfc/rfc3810 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6af52ae2ed14a6bc756d5606b29097dfd76740b8 [4] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68d4fd30c83b1b208e08c954cd45e6474b148c87 [5] https://datatracker.ietf.org/doc/html/rfc7432 [6] https://datatracker.ietf.org/doc/html/rfc7432#section-7.2 [7] https://datatracker.ietf.org/doc/html/rfc9251 [8] https://datatracker.ietf.org/doc/html/rfc9251#section-9.1 [9] https://github.com/idosch/iproute2/commits/submit/mdb_v1 [10] https://lore.kernel.org/netdev/20221208152839.1016350-1-idosch@nvidia.com/ [11] https://lore.kernel.org/netdev/20221018120420.561846-1-idosch@nvidia.com/ ==================== Link: https://lore.kernel.org/r/20221210145633.1328511-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit b6d00da08610e2b17412330d7cfc7c04a3b6570d Author: Ido Schimmel Date: Sat Dec 10 16:56:33 2022 +0200 selftests: forwarding: Add bridge MDB test Add a selftests that includes the following test cases: 1. Configuration tests. Both valid and invalid configurations are tested across all entry types (e.g., L2, IPv4). 2. Forwarding tests. Both host and port group entries are tested across all entry types. 3. Interaction between user installed MDB entries and IGMP / MLD control packets. Example output: INFO: # Host entries configuration tests TEST: Common host entries configuration tests (IPv4) [ OK ] TEST: Common host entries configuration tests (IPv6) [ OK ] TEST: Common host entries configuration tests (L2) [ OK ] INFO: # Port group entries configuration tests - (*, G) TEST: Common port group entries configuration tests (IPv4 (*, G)) [ OK ] TEST: Common port group entries configuration tests (IPv6 (*, G)) [ OK ] TEST: IPv4 (*, G) port group entries configuration tests [ OK ] TEST: IPv6 (*, G) port group entries configuration tests [ OK ] INFO: # Port group entries configuration tests - (S, G) TEST: Common port group entries configuration tests (IPv4 (S, G)) [ OK ] TEST: Common port group entries configuration tests (IPv6 (S, G)) [ OK ] TEST: IPv4 (S, G) port group entries configuration tests [ OK ] TEST: IPv6 (S, G) port group entries configuration tests [ OK ] INFO: # Port group entries configuration tests - L2 TEST: Common port group entries configuration tests (L2 (*, G)) [ OK ] TEST: L2 (*, G) port group entries configuration tests [ OK ] INFO: # Forwarding tests TEST: IPv4 host entries forwarding tests [ OK ] TEST: IPv6 host entries forwarding tests [ OK ] TEST: L2 host entries forwarding tests [ OK ] TEST: IPv4 port group "exclude" entries forwarding tests [ OK ] TEST: IPv6 port group "exclude" entries forwarding tests [ OK ] TEST: IPv4 port group "include" entries forwarding tests [ OK ] TEST: IPv6 port group "include" entries forwarding tests [ OK ] TEST: L2 port entries forwarding tests [ OK ] INFO: # Control packets tests TEST: IGMPv3 MODE_IS_INCLUE tests [ OK ] TEST: MLDv2 MODE_IS_INCLUDE tests [ OK ] Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit f9923a67ab623723663e8ba3eadf00a5bac82d6e Author: Ido Schimmel Date: Sat Dec 10 16:56:32 2022 +0200 selftests: forwarding: Rename bridge_mdb test The test is only concerned with host MDB entries and not with MDB entries as a whole. Rename the test to reflect that. Subsequent patches will add a more general test that will contain the test cases for host MDB entries and remove the current test. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 61f2183512a72c28674717b1ba706ed2749938d1 Author: Ido Schimmel Date: Sat Dec 10 16:56:31 2022 +0200 bridge: mcast: Support replacement of MDB port group entries Now that user space can specify additional attributes of port group entries such as filter mode and source list, it makes sense to allow user space to atomically modify these attributes by replacing entries instead of forcing user space to delete the entries and add them back. Replace MDB port group entries when the 'NLM_F_REPLACE' flag is specified in the netlink message header. When a (*, G) entry is replaced, update the following attributes: Source list, state, filter mode, protocol and flags. If the entry is temporary and in EXCLUDE mode, reset the group timer to the group membership interval. If the entry is temporary and in INCLUDE mode, reset the source timers of associated sources to the group membership interval. Examples: # bridge mdb replace dev br0 port dummy10 grp 239.1.1.1 permanent source_list 192.0.2.1,192.0.2.2 filter_mode include # bridge -d -s mdb show dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.2 permanent filter_mode include proto static 0.00 dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.1 permanent filter_mode include proto static 0.00 dev br0 port dummy10 grp 239.1.1.1 permanent filter_mode include source_list 192.0.2.2/0.00,192.0.2.1/0.00 proto static 0.00 # bridge mdb replace dev br0 port dummy10 grp 239.1.1.1 permanent source_list 192.0.2.1,192.0.2.3 filter_mode exclude proto zebra # bridge -d -s mdb show dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.3 permanent filter_mode include proto zebra blocked 0.00 dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.1 permanent filter_mode include proto zebra blocked 0.00 dev br0 port dummy10 grp 239.1.1.1 permanent filter_mode exclude source_list 192.0.2.3/0.00,192.0.2.1/0.00 proto zebra 0.00 # bridge mdb replace dev br0 port dummy10 grp 239.1.1.1 temp source_list 192.0.2.4,192.0.2.3 filter_mode include proto bgp # bridge -d -s mdb show dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.4 temp filter_mode include proto bgp 0.00 dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.3 temp filter_mode include proto bgp 0.00 dev br0 port dummy10 grp 239.1.1.1 temp filter_mode include source_list 192.0.2.4/259.44,192.0.2.3/259.44 proto bgp 0.00 Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 1d7b66a7d9754c229d12c53ad6a1effe88c16ca4 Author: Ido Schimmel Date: Sat Dec 10 16:56:30 2022 +0200 bridge: mcast: Allow user space to specify MDB entry routing protocol Add the 'MDBE_ATTR_RTPORT' attribute to allow user space to specify the routing protocol of the MDB port group entry. Enforce a minimum value of 'RTPROT_STATIC' to prevent user space from using protocol values that should only be set by the kernel (e.g., 'RTPROT_KERNEL'). Maintain backward compatibility by defaulting to 'RTPROT_STATIC'. The protocol is already visible to user space in RTM_NEWMDB responses and notifications via the 'MDBA_MDB_EATTR_RTPROT' attribute. The routing protocol allows a routing daemon to distinguish between entries configured by it and those configured by the administrator. Once MDB flush is supported, the protocol can be used as a criterion according to which the flush is performed. Examples: # bridge mdb add dev br0 port dummy10 grp 239.1.1.1 permanent proto kernel Error: integer out of range. # bridge mdb add dev br0 port dummy10 grp 239.1.1.1 permanent proto static # bridge mdb add dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.1 permanent proto zebra # bridge mdb add dev br0 port dummy10 grp 239.1.1.2 permanent source_list 198.51.100.1,198.51.100.2 filter_mode include proto 250 # bridge -d mdb show dev br0 port dummy10 grp 239.1.1.2 src 198.51.100.2 permanent filter_mode include proto 250 dev br0 port dummy10 grp 239.1.1.2 src 198.51.100.1 permanent filter_mode include proto 250 dev br0 port dummy10 grp 239.1.1.2 permanent filter_mode include source_list 198.51.100.2/0.00,198.51.100.1/0.00 proto 250 dev br0 port dummy10 grp 239.1.1.1 src 192.0.2.1 permanent filter_mode include proto zebra dev br0 port dummy10 grp 239.1.1.1 permanent filter_mode exclude proto static Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 6afaae6d12f54accf194e73ece617d1f456e438d Author: Ido Schimmel Date: Sat Dec 10 16:56:29 2022 +0200 bridge: mcast: Allow user space to add (*, G) with a source list and filter mode Add new netlink attributes to the RTM_NEWMDB request that allow user space to add (*, G) with a source list and filter mode. The RTM_NEWMDB message can already dump such entries (created by the kernel) so there is no need to add dump support. However, the message contains a different set of attributes depending if it is a request or a response. The naming and structure of the new attributes try to follow the existing ones used in the response. Request: [ struct nlmsghdr ] [ struct br_port_msg ] [ MDBA_SET_ENTRY ] struct br_mdb_entry [ MDBA_SET_ENTRY_ATTRS ] [ MDBE_ATTR_SOURCE ] struct in_addr / struct in6_addr [ MDBE_ATTR_SRC_LIST ] // new [ MDBE_SRC_LIST_ENTRY ] [ MDBE_SRCATTR_ADDRESS ] struct in_addr / struct in6_addr [ ...] [ MDBE_ATTR_GROUP_MODE ] // new u8 Response: [ struct nlmsghdr ] [ struct br_port_msg ] [ MDBA_MDB ] [ MDBA_MDB_ENTRY ] [ MDBA_MDB_ENTRY_INFO ] struct br_mdb_entry [ MDBA_MDB_EATTR_TIMER ] u32 [ MDBA_MDB_EATTR_SOURCE ] struct in_addr / struct in6_addr [ MDBA_MDB_EATTR_RTPROT ] u8 [ MDBA_MDB_EATTR_SRC_LIST ] [ MDBA_MDB_SRCLIST_ENTRY ] [ MDBA_MDB_SRCATTR_ADDRESS ] struct in_addr / struct in6_addr [ MDBA_MDB_SRCATTR_TIMER ] u8 [...] [ MDBA_MDB_EATTR_GROUP_MODE ] u8 Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit b1c8fec8d459fb49b2033c014256477e51913e2e Author: Ido Schimmel Date: Sat Dec 10 16:56:28 2022 +0200 bridge: mcast: Add support for (*, G) with a source list and filter mode In preparation for allowing user space to add (*, G) entries with a source list and associated filter mode, add the necessary plumbing to handle such requests. Extend the MDB configuration structure with a currently empty source array and filter mode that is currently hard coded to EXCLUDE. Add the source entries and the corresponding (S, G) entries before making the new (*, G) port group entry visible to the data path. Handle the creation of each source entry in a similar fashion to how it is created from the data path in response to received Membership Reports: Create the source entry, arm the source timer (if needed), add a corresponding (S, G) forwarding entry and finally mark the source entry as installed (by user space). Add the (S, G) entry by populating an MDB configuration structure and calling br_mdb_add_group_sg() as if a new entry is created by user space, with the sole difference that the 'src_entry' field is set to make sure that the group timer of such entries is never armed. Note that it is not currently possible to add more than 32 source entries to a port group entry. If this proves to be a problem we can either increase 'PG_SRC_ENT_LIMIT' or avoid forcing a limit on entries created by user space. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 079afd66161bbbde14ed9f207f7fe6170f5b37b3 Author: Ido Schimmel Date: Sat Dec 10 16:56:27 2022 +0200 bridge: mcast: Avoid arming group timer when (S, G) corresponds to a source User space will soon be able to install a (*, G) with a source list, prompting the creation of a (S, G) entry for each source. In this case, the group timer of the (S, G) entry should never be set. Solve this by adding a new field to the MDB configuration structure that denotes whether the (S, G) corresponds to a source or not. The field will be set in a subsequent patch where br_mdb_add_group_sg() is called in order to create a (S, G) entry for each user provided source. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit a01ecb1712ddbcd41360ad0c554b460adbac0528 Author: Ido Schimmel Date: Sat Dec 10 16:56:26 2022 +0200 bridge: mcast: Add a flag for user installed source entries There are a few places where the bridge driver differentiates between (S, G) entries installed by the kernel (in response to Membership Reports) and those installed by user space. One of them is when deleting an (S, G) entry corresponding to a source entry that is being deleted. While user space cannot currently add a source entry to a (*, G), it can add an (S, G) entry that later corresponds to a source entry created by the reception of a Membership Report. If this source entry is later deleted because its source timer expired or because the (*, G) entry is being deleted, the bridge driver will not delete the corresponding (S, G) entry if it was added by user space as permanent. This is going to be a problem when the ability to install a (*, G) with a source list is exposed to user space. In this case, when user space installs the (*, G) as permanent, then all the (S, G) entries corresponding to its source list will also be installed as permanent. When user space deletes the (*, G), all the source entries will be deleted and the expectation is that the corresponding (S, G) entries will be deleted as well. Solve this by introducing a new source entry flag denoting that the entry was installed by user space. When the entry is deleted, delete the corresponding (S, G) entry even if it was installed by user space as permanent, as the flag tells us that it was installed in response to the source entry being created. The flag will be set in a subsequent patch where source entries are created in response to user requests. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 083e353482b4c9b727846643ad6ca7b784dd486b Author: Ido Schimmel Date: Sat Dec 10 16:56:25 2022 +0200 bridge: mcast: Expose __br_multicast_del_group_src() Expose __br_multicast_del_group_src() which is symmetric to br_multicast_new_group_src() and does not remove the installed {S, G} forwarding entry, unlike br_multicast_del_group_src(). The function will be used in the error path when user space was able to add a new source entry, but failed to install a corresponding forwarding entry. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit fd0c696164cf13ae0128f14209e2dbfcd86584b8 Author: Ido Schimmel Date: Sat Dec 10 16:56:24 2022 +0200 bridge: mcast: Expose br_multicast_new_group_src() Currently, new group source entries are only created in response to received Membership Reports. Subsequent patches are going to allow user space to install (*, G) entries with a source list. As a preparatory step, expose br_multicast_new_group_src() so that it could later be invoked from the MDB code (i.e., br_mdb.c) that handles RTM_NEWMDB messages. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 160dd93114ddd31ed2b6290a7495d53717b79cf8 Author: Ido Schimmel Date: Sat Dec 10 16:56:23 2022 +0200 bridge: mcast: Add a centralized error path Subsequent patches will add memory allocations in br_mdb_config_init() as the MDB configuration structure will include a linked list of source entries. This memory will need to be freed regardless if br_mdb_add() succeeded or failed. As a preparation for this change, add a centralized error path where the memory will be freed. Note that br_mdb_del() already has one error path and therefore does not require any changes. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 1870a2d35abb6f4d8ff2213d50bbd082b1f8cde5 Author: Ido Schimmel Date: Sat Dec 10 16:56:22 2022 +0200 bridge: mcast: Place netlink policy before validation functions Subsequent patches are going to add additional validation functions and netlink policies. Some of these functions will need to perform parsing using nla_parse_nested() and the new policies. In order to keep all the policies next to each other, move the current policy to before the validation functions. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 6ff1e68eb21501042ebf8226d500398fd07350f3 Author: Ido Schimmel Date: Sat Dec 10 16:56:21 2022 +0200 bridge: mcast: Split (*, G) and (S, G) addition into different functions When the bridge is using IGMP version 3 or MLD version 2, it handles the addition of (*, G) and (S, G) entries differently. When a new (S, G) port group entry is added, all the (*, G) EXCLUDE ports need to be added to the port group of the new entry. Similarly, when a new (*, G) EXCLUDE port group entry is added, the port needs to be added to the port group of all the matching (S, G) entries. Subsequent patches will create more differences between both entry types. Namely, filter mode and source list can only be specified for (*, G) entries. Given the current and future differences between both entry types, handle the addition of each entry type in a different function, thereby avoiding the creation of one complex function. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit b63e30651c59bdef89ec158879d146e8d89cd5e1 Author: Ido Schimmel Date: Sat Dec 10 16:56:20 2022 +0200 bridge: mcast: Do not derive entry type from its filter mode Currently, the filter mode (i.e., INCLUDE / EXCLUDE) of MDB entries cannot be set from user space. Instead, it is set by the kernel according to the entry type: (*, G) entries are treated as EXCLUDE and (S, G) entries are treated as INCLUDE. This allows the kernel to derive the entry type from its filter mode. Subsequent patches will allow user space to set the filter mode of (*, G) entries, making the current assumption incorrect. As a preparation, remove the current assumption and instead determine the entry type from its key, which is a more direct way. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 02abf84aa52da86586ec6323969afa158ec6e4aa Author: Jiapeng Chong Date: Mon Dec 12 13:58:13 2022 +0800 qlcnic: Clean up some inconsistent indenting No functional modification involved. drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c:714 qlcnic_validate_ring_count() warn: inconsistent indenting. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3419 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20221212055813.91154-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Jakub Kicinski commit e095493091e850d5292ad01d8fbf5cde1d89ac53 Author: Vladimir Oltean Date: Sat Dec 10 01:52:42 2022 +0200 net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path If dsa_tag_8021q_setup() fails, for example due to the inability of the device to install a VLAN, the tag_8021q context of the switch will leak. Make sure it is freed on the error path. Fixes: 328621f6131f ("net: dsa: tag_8021q: absorb dsa_8021q_setup into dsa_tag_8021q_{,un}register") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20221209235242.480344-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b1746fbab15a1d6d5e61846f260f8fece1fca576 Author: Tirthendu Sarkar Date: Fri Dec 9 10:55:53 2022 -0800 i40e: allow toggling loopback mode via ndo_set_features callback Add support for NETIF_F_LOOPBACK. This feature can be set via: $ ethtool -K eth0 loopback This sets the MAC Tx->Rx loopback. This feature is used for the xsk selftests, and might have other uses too. Signed-off-by: Tirthendu Sarkar Reviewed-by: Alexander Lobakin Reviewed-by: Leon Romanovsky Tested-by: Magnus Karlsson Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20221209185553.2520088-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 0c87b545a2ed5cd8a6318011f1c92b188c2d74bc Author: Bartosz Staszewski Date: Fri Dec 9 10:54:11 2022 -0800 i40e: Fix the inability to attach XDP program on downed interface Whenever trying to load XDP prog on downed interface, function i40e_xdp was passing vsi->rx_buf_len field to i40e_xdp_setup() which was equal 0. i40e_open() calls i40e_vsi_configure_rx() which configures that field, but that only happens when interface is up. When it is down, i40e_open() is not being called, thus vsi->rx_buf_len is not set. Solution for this is calculate buffer length in newly created function - i40e_calculate_vsi_rx_buf_len() that return actual buffer length. Buffer length is being calculated based on the same rules applied previously in i40e_vsi_configure_rx() function. Fixes: 613142b0bb88 ("i40e: Log error for oversized MTU on device") Fixes: 0c8493d90b6b ("i40e: add XDP support for pass and drop actions") Signed-off-by: Bartosz Staszewski Signed-off-by: Mateusz Palczewski Tested-by: Shwetha Nagaraju Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen Reviewed-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221209185411.2519898-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit add76959575736c194b3118d96e43f8cd7bcec82 Merge: 617fe4fa82b2f 17b8d847b92d8 Author: Linus Torvalds Date: Mon Dec 12 15:19:38 2022 -0800 Merge tag 'perf-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events updates from Ingo Molnar: - Thoroughly rewrite the data structures that implement perf task context handling, with the goal of fixing various quirks and unfeatures both in already merged, and in upcoming proposed code. The old data structure is the per task and per cpu perf_event_contexts: task_struct::perf_events_ctxp[] <-> perf_event_context <-> perf_cpu_context ^ | ^ | ^ `---------------------------------' | `--> pmu ---' v ^ perf_event ------' In this new design this is replaced with a single task context and a single CPU context, plus intermediate data-structures: task_struct::perf_event_ctxp -> perf_event_context <- perf_cpu_context ^ | ^ ^ `---------------------------' | | | | perf_cpu_pmu_context <--. | `----. ^ | | | | | | v v | | ,--> perf_event_pmu_context | | | | | | | v v | perf_event ---> pmu ----------------' [ See commit bd2756811766 for more details. ] This rewrite was developed by Peter Zijlstra and Ravi Bangoria. - Optimize perf_tp_event() - Update the Intel uncore PMU driver, extending it with UPI topology discovery on various hardware models. - Misc fixes & cleanups * tag 'perf-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Make set_mapping() procedure void perf/x86/intel/uncore: Update sysfs-devices-mapping file perf/x86/intel/uncore: Enable UPI topology discovery for Sapphire Rapids perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server perf/x86/intel/uncore: Get UPI NodeID and GroupID perf/x86/intel/uncore: Enable UPI topology discovery for Skylake Server perf/x86/intel/uncore: Generalize get_topology() for SKX PMUs perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D perf/x86/intel/uncore: Clear attr_update properly perf/x86/intel/uncore: Introduce UPI topology type perf/x86/intel/uncore: Generalize IIO topology support perf/core: Don't allow grouping events from different hw pmus perf/amd/ibs: Make IBS a core pmu perf: Fix function pointer case perf/x86/amd: Remove the repeated declaration perf: Fix possible memleak in pmu_dev_alloc() ... commit 26a8057a1ada97b528b93fdf3ac4fd03170f1900 Author: Yuwei Guan Date: Sun Dec 11 21:08:41 2022 +0800 f2fs: reset wait_ms to default if any of the victims have been selected In non-foreground gc mode, if no victim is selected, the gc process will wait for no_gc_sleep_time before waking up again. In this subsequent time, even though a victim will be selected, the gc process still waits for no_gc_sleep_time before waking up. The configuration of wait_ms is not reasonable. After any of the victims have been selected, we need to reset wait_ms to default sleep time from no_gc_sleep_time. Signed-off-by: Yuwei Guan Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2a78dd22c2eba50cba8254d4166481791ed884bc Merge: 1280d4b76f340 cb54d392279dd Author: Jakub Kicinski Date: Mon Dec 12 15:18:28 2022 -0800 Merge branch 'net-add-iff_no_addrconf-to-prevent-ipv6-addrconf' Xin Long says: ==================== net: add IFF_NO_ADDRCONF to prevent ipv6 addrconf This patchset adds IFF_NO_ADDRCONF flag for dev->priv_flags to prevent ipv6 addrconf, as Jiri Pirko's suggestion. For Bonding it changes to use this flag instead of IFF_SLAVE flag in Patch 1, and for Teaming and Net Failover it sets this flag before calling dev_open() in Patch 2 and 3. ==================== Link: https://lore.kernel.org/r/cover.1670599241.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit cb54d392279dd450e65f6fa3c3f66db8cbdbcc0e Author: Xin Long Date: Fri Dec 9 10:21:40 2022 -0500 net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf Similar to Bonding and Team, to prevent ipv6 addrconf with IFF_NO_ADDRCONF in slave_dev->priv_flags for slave ports is also needed in net failover. Note that dev_open(slave_dev) is called in .slave_register, which is called after the IFF_NO_ADDRCONF flag is set in failover_slave_register(). Signed-off-by: Xin Long Signed-off-by: Jakub Kicinski commit 0aa64df30b382fc71d4fb1827d528e0eb3eff854 Author: Xin Long Date: Fri Dec 9 10:21:39 2022 -0500 net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf This patch is to use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf for Team port. This flag will be set in team_port_enter(), which is called before dev_open(), and cleared in team_port_leave(), called after dev_close() and the err path in team_port_add(). Signed-off-by: Xin Long Signed-off-by: Jakub Kicinski commit 8a321cf7becc6c065ae595b837b826a2a81036b9 Author: Xin Long Date: Fri Dec 9 10:21:38 2022 -0500 net: add IFF_NO_ADDRCONF and use it in bonding to prevent ipv6 addrconf Currently, in bonding it reused the IFF_SLAVE flag and checked it in ipv6 addrconf to prevent ipv6 addrconf. However, it is not a proper flag to use for no ipv6 addrconf, for bonding it has to move IFF_SLAVE flag setting ahead of dev_open() in bond_enslave(). Also, IFF_MASTER/SLAVE are historical flags used in bonding and eql, as Jiri mentioned, the new devices like Team, Failover do not use this flag. So as Jiri suggested, this patch adds IFF_NO_ADDRCONF in priv_flags of the device to indicate no ipv6 addconf, and uses it in bonding and moves IFF_SLAVE flag setting back to its original place. Signed-off-by: Xin Long Signed-off-by: Jakub Kicinski commit 617fe4fa82b2fe5bcb99f97f223f408603bfa5a0 Merge: 2f60f830842d6 90d7588967870 Author: Linus Torvalds Date: Mon Dec 12 15:14:53 2022 -0800 Merge tag 'locking-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Two changes in this cycle: - a micro-optimization in static_key_slow_inc_cpuslocked() - fix futex death-notification wakeup bug" * tag 'locking-core-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Resend potentially swallowed owner death notification jump_label: Use atomic_try_cmpxchg() in static_key_slow_inc_cpuslocked() commit ede5a389852d3640a28e7187fb32b7f204380901 Author: Piergiorgio Beruto Date: Sat Dec 10 23:37:22 2022 +0100 stmmac: fix potential division by 0 When the MAC is connected to a 10 Mb/s PHY and the PTP clock is derived from the MAC reference clock (default), the clk_ptp_rate becomes too small and the calculated sub second increment becomes 0 when computed by the stmmac_config_sub_second_increment() function within stmmac_init_tstamp_counter(). Therefore, the subsequent div_u64 in stmmac_init_tstamp_counter() operation triggers a divide by 0 exception as shown below. [ 95.062067] socfpga-dwmac ff700000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 95.076440] socfpga-dwmac ff700000.ethernet eth0: PHY [stmmac-0:08] driver [NCN26000] (irq=49) [ 95.095964] dwmac1000: Master AXI performs any burst length [ 95.101588] socfpga-dwmac ff700000.ethernet eth0: No Safety Features support found [ 95.109428] Division by zero in kernel. [ 95.113447] CPU: 0 PID: 239 Comm: ifconfig Not tainted 6.1.0-rc7-centurion3-1.0.3.0-01574-gb624218205b7-dirty #77 [ 95.123686] Hardware name: Altera SOCFPGA [ 95.127695] unwind_backtrace from show_stack+0x10/0x14 [ 95.132938] show_stack from dump_stack_lvl+0x40/0x4c [ 95.137992] dump_stack_lvl from Ldiv0+0x8/0x10 [ 95.142527] Ldiv0 from __aeabi_uidivmod+0x8/0x18 [ 95.147232] __aeabi_uidivmod from div_u64_rem+0x1c/0x40 [ 95.152552] div_u64_rem from stmmac_init_tstamp_counter+0xd0/0x164 [ 95.158826] stmmac_init_tstamp_counter from stmmac_hw_setup+0x430/0xf00 [ 95.165533] stmmac_hw_setup from __stmmac_open+0x214/0x2d4 [ 95.171117] __stmmac_open from stmmac_open+0x30/0x44 [ 95.176182] stmmac_open from __dev_open+0x11c/0x134 [ 95.181172] __dev_open from __dev_change_flags+0x168/0x17c [ 95.186750] __dev_change_flags from dev_change_flags+0x14/0x50 [ 95.192662] dev_change_flags from devinet_ioctl+0x2b4/0x604 [ 95.198321] devinet_ioctl from inet_ioctl+0x1ec/0x214 [ 95.203462] inet_ioctl from sock_ioctl+0x14c/0x3c4 [ 95.208354] sock_ioctl from vfs_ioctl+0x20/0x38 [ 95.212984] vfs_ioctl from sys_ioctl+0x250/0x844 [ 95.217691] sys_ioctl from ret_fast_syscall+0x0/0x4c [ 95.222743] Exception stack(0xd0ee1fa8 to 0xd0ee1ff0) [ 95.227790] 1fa0: 00574c4f be9aeca4 00000003 00008914 be9aeca4 be9aec50 [ 95.235945] 1fc0: 00574c4f be9aeca4 0059f078 00000036 be9aee8c be9aef7a 00000015 00000000 [ 95.244096] 1fe0: 005a01f0 be9aec38 004d7484 b6e67d74 Signed-off-by: Piergiorgio Beruto Fixes: 91a2559c1dc5 ("net: stmmac: Fix sub-second increment") Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/de4c64ccac9084952c56a06a8171d738604c4770.1670678513.git.piergiorgio.beruto@gmail.com Signed-off-by: Jakub Kicinski commit 87c978123ef1f346d7385eaccc141022d368166f Author: Christophe JAILLET Date: Sat Dec 10 18:35:00 2022 +0100 octeontx2-af: cn10k: mcs: Fix a resource leak in the probe and remove functions In mcs_register_interrupts(), a call to request_irq() is not balanced by a corresponding free_irq(), neither in the error handling path, nor in the remove function. Add the missing calls. Fixes: 6c635f78c474 ("octeontx2-af: cn10k: mcs: Handle MCS block interrupts") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/69f153db5152a141069f990206e7389f961d41ec.1670693669.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 1280d4b76f3402645aa7075a53f49a3a14be07a8 Author: Uladzislau Koshchanka Date: Sat Dec 10 03:44:23 2022 +0300 lib: packing: replace bit_reverse() with bitrev8() Remove bit_reverse() function. Instead use bitrev8() from linux/bitrev.h + bitshift. Reduces code-repetition. Signed-off-by: Uladzislau Koshchanka Link: https://lore.kernel.org/r/20221210004423.32332-1-koshchanka@gmail.com Signed-off-by: Jakub Kicinski commit 93e637a37b2872c2fce6ce4df6e59cdc2fe8ca5e Author: Kurt Kanzenbach Date: Mon Dec 12 09:15:46 2022 +0100 dt-bindings: net: dsa: hellcreek: Sync DSA maintainers The current DSA maintainers are Florian Fainelli, Andrew Lunn and Vladimir Oltean. Update the hellcreek binding accordingly. Signed-off-by: Kurt Kanzenbach Reviewed-by: Vladimir Oltean Acked-by: Rob Herring Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20221212081546.6916-1-kurt@linutronix.de Signed-off-by: Jakub Kicinski commit d7b061b80ee6f91aa0b89daa3069802d7ea4c57f Author: Yunsheng Lin Date: Mon Dec 12 11:24:26 2022 +0800 net: tso: inline tso_count_descs() tso_count_descs() is a small function doing simple calculation, and tso_count_descs() is used in fast path, so inline it to reduce the overhead of calls. Signed-off-by: Yunsheng Lin Link: https://lore.kernel.org/r/20221212032426.16050-1-linyunsheng@huawei.com Signed-off-by: Jakub Kicinski commit 8f18655c49eb6abfe7fc3711d32d23b311fbc6a6 Author: Vladimir Oltean Date: Fri Dec 9 19:58:40 2022 +0200 net: dsa: don't call ptp_classify_raw() if switch doesn't provide RX timestamping ptp_classify_raw() is not exactly cheap, since it invokes a BPF program for every skb in the receive path. For switches which do not provide ds->ops->port_rxtstamp(), running ptp_classify_raw() provides precisely nothing, so check for the presence of the function pointer first, since that is much cheaper. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Reviewed-by: Kurt Kanzenbach Link: https://lore.kernel.org/r/20221209175840.390707-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit cd2aafa25b94b4d7f46fbae0bf58701689db296b Merge: 4cc58a087ddd0 9e3d9ae52b565 Author: Jakub Kicinski Date: Mon Dec 12 15:01:23 2022 -0800 Merge branch 'trace-points-for-mv88e6xxx' Vladimir Oltean says: ==================== Trace points for mv88e6xxx While testing Hans Schultz' attempt at offloading MAB on mv88e6xxx: https://patchwork.kernel.org/project/netdevbpf/cover/20221205185908.217520-1-netdev@kapio-technology.com/ I noticed that he still didn't get rid of the huge log spam caused by ATU and VTU violations, even if we discussed about this: https://patchwork.kernel.org/project/netdevbpf/cover/20221112203748.68995-1-netdev@kapio-technology.com/#25091076 It seems unlikely he's going to ever do this, so here is my own stab at converting those messages to trace points. This is IMO an improvement regardless of whether Hans' work with MAB lands or not, especially the VTU violations which were quite annoying to me as well. A small sample of before: $ ./bridge_locked_port.sh lan1 lan2 lan3 lan4 [ 114.465272] mv88e6085 d0032004.mdio-mii:10: VTU member violation for vid 100, source port 9 [ 119.550508] mv88e6xxx_g1_vtu_prob_irq_thread_fn: 34 callbacks suppressed [ 120.369586] mv88e6085 d0032004.mdio-mii:10: VTU member violation for vid 100, source port 9 [ 120.473658] mv88e6085 d0032004.mdio-mii:10: VTU member violation for vid 100, source port 9 [ 125.535209] mv88e6xxx_g1_vtu_prob_irq_thread_fn: 21 callbacks suppressed [ 125.535243] mv88e6085 d0032004.mdio-mii:10: VTU member violation for vid 100, source port 9 [ 126.174558] mv88e6085 d0032004.mdio-mii:10: VTU member violation for vid 100, source port 9 [ 130.234055] mv88e6085 d0032004.mdio-mii:10: ATU miss violation for 00:01:02:03:04:01 fid 3 portvec 4 spid 2 [ 130.338193] mv88e6085 d0032004.mdio-mii:10: ATU miss violation for 00:01:02:03:04:01 fid 3 portvec 4 spid 2 [ 134.626099] mv88e6xxx_g1_atu_prob_irq_thread_fn: 38 callbacks suppressed [ 134.626132] mv88e6085 d0032004.mdio-mii:10: ATU miss violation for 00:01:02:03:04:01 fid 3 portvec 4 spid 2 and after: $ trace-cmd record -e mv88e6xxx ./bridge_locked_port.sh lan1 lan2 lan3 lan4 $ trace-cmd report irq/35-moxtet-60 [001] 93.929734: mv88e6xxx_vtu_miss_violation: dev d0032004.mdio-mii:10 spid 9 vid 100 irq/35-moxtet-60 [001] 94.183209: mv88e6xxx_vtu_miss_violation: dev d0032004.mdio-mii:10 spid 9 vid 100 irq/35-moxtet-60 [001] 101.865545: mv88e6xxx_vtu_miss_violation: dev d0032004.mdio-mii:10 spid 9 vid 100 irq/35-moxtet-60 [001] 121.831261: mv88e6xxx_vtu_member_violation: dev d0032004.mdio-mii:10 spid 9 vid 100 irq/35-moxtet-60 [001] 122.371238: mv88e6xxx_vtu_member_violation: dev d0032004.mdio-mii:10 spid 9 vid 100 irq/35-moxtet-60 [001] 148.452932: mv88e6xxx_atu_miss_violation: dev d0032004.mdio-mii:10 spid 2 portvec 0x4 addr 00:01:02:03:04:01 fid 0 v1 at: https://patchwork.kernel.org/project/netdevbpf/cover/20221207233954.3619276-1-vladimir.oltean@nxp.com/ ==================== Link: https://lore.kernel.org/r/20221209172817.371434-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9e3d9ae52b5657399a7b61258cc7482434a911bb Author: Vladimir Oltean Date: Fri Dec 9 19:28:17 2022 +0200 net: dsa: mv88e6xxx: replace VTU violation prints with trace points It is possible to trigger these VTU violation messages very easily, it's only necessary to send packets with an unknown VLAN ID to a port that belongs to a VLAN-aware bridge. Do a similar thing as for ATU violation messages, and hide them in the kernel's trace buffer. New usage model: $ trace-cmd list | grep mv88e6xxx mv88e6xxx mv88e6xxx:mv88e6xxx_vtu_miss_violation mv88e6xxx:mv88e6xxx_vtu_member_violation $ trace-cmd report Signed-off-by: Vladimir Oltean Reviewed-by: Saeed Mahameed Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 8646384d80f3d3b4a66b3284dbbd8232d1b8799e Author: Vladimir Oltean Date: Fri Dec 9 19:28:16 2022 +0200 net: dsa: mv88e6xxx: replace ATU violation prints with trace points In applications where the switch ports must perform 802.1X based authentication and are therefore locked, ATU violation interrupts are quite to be expected as part of normal operation. The problem is that they currently spam the kernel log, even if rate limited. Create a series of trace points, all derived from the same event class, which log these violations to the kernel's trace buffer, which is both much faster and much easier to ignore than printing to a serial console. New usage model: $ trace-cmd list | grep mv88e6xxx mv88e6xxx mv88e6xxx:mv88e6xxx_atu_full_violation mv88e6xxx:mv88e6xxx_atu_miss_violation mv88e6xxx:mv88e6xxx_atu_member_violation $ trace-cmd record -e mv88e6xxx sleep 10 Signed-off-by: Vladimir Oltean Reviewed-by: Saeed Mahameed Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 4bf24ad09bc0b05e97fb48b962b2c9246fc76727 Author: Hans J. Schultz Date: Fri Dec 9 19:28:15 2022 +0200 net: dsa: mv88e6xxx: read FID when handling ATU violations When an ATU violation occurs, the switch uses the ATU FID register to report the FID of the MAC address that incurred the violation. It would be good for the driver to know the FID value for purposes such as logging and CPU-based authentication. Up until now, the driver has been calling the mv88e6xxx_g1_atu_op() function to read ATU violations, but that doesn't do exactly what we want, namely it calls mv88e6xxx_g1_atu_fid_write() with FID 0. (side note, the documentation for the ATU Get/Clear Violation command says that writes to the ATU FID register have no effect before the operation starts, it's only that we disregard the value that this register provides once the operation completes) So mv88e6xxx_g1_atu_fid_write() is not what we want, but rather mv88e6xxx_g1_atu_fid_read(). However, the latter doesn't exist, we need to write it. The remainder of mv88e6xxx_g1_atu_op() except for mv88e6xxx_g1_atu_fid_write() is still needed, namely to send a GET_CLR_VIOLATION command to the ATU. In principle we could have still kept calling mv88e6xxx_g1_atu_op(), but the MDIO writes to the ATU FID register are pointless, but in the interest of doing less CPU work per interrupt, write a new function called mv88e6xxx_g1_read_atu_violation() and call it. The FID will be the port default FID as set by mv88e6xxx_port_set_fid() if the VID from the packet cannot be found in the VTU. Otherwise it is the FID derived from the VTU entry associated with that VID. Signed-off-by: Hans J. Schultz Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 8a1786b7d44180ad8316d280d99524db6272198f Author: Vladimir Oltean Date: Fri Dec 9 19:28:14 2022 +0200 net: dsa: mv88e6xxx: remove ATU age out violation print Currently, the MV88E6XXX_PORT_ASSOC_VECTOR_INT_AGE_OUT bit (interrupt on age out) is not enabled by the driver, and as a result, the print for age out violations is dead code. Remove it until there is some way for this to be triggered. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 7411143f2021530d7641fbb40daaada4ee63f7e6 Author: Yangtao Li Date: Tue Nov 29 12:15:23 2022 +0800 f2fs: fix some format WARNING in debug.c and sysfs.c To fix: WARNING: function definition argument 'struct f2fs_attr *' should also have an identifier name + ssize_t (*show)(struct f2fs_attr *, struct f2fs_sb_info *, char *); WARNING: return sysfs_emit(...) formats should include a terminating newline + return sysfs_emit(buf, "(none)"); WARNING: Prefer 'unsigned int' to bare use of 'unsigned' + unsigned npages = NODE_MAPPING(sbi)->nrpages; WARNING: Missing a blank line after declarations + unsigned npages = COMPRESS_MAPPING(sbi)->nrpages; + si->page_mem += (unsigned long long)npages << PAGE_SHIFT; WARNING: quoted string split across lines + seq_printf(s, "CP merge (Queued: %4d, Issued: %4d, Total: %4d, " + "Cur time: %4d(ms), Peak time: %4d(ms))\n", Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit 25547439f1dcc3def6062bd3e69165cd806a594e Author: Yangtao Li Date: Fri Dec 2 12:58:41 2022 +0800 f2fs: don't call f2fs_issue_discard_timeout() when discard_cmd_cnt is 0 in f2fs_put_super() No need to call f2fs_issue_discard_timeout() in f2fs_put_super, when no discard command requires issue. Since the caller of f2fs_issue_discard_timeout() usually judges the number of discard commands before using it. Let's move this logic to f2fs_issue_discard_timeout(). By the way, use f2fs_realtime_discard_enable to simplify the code. Reported-by: kernel test robot Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit 15e38ee44d50cad264da80ef75626b9224ddc4a3 Author: Yangtao Li Date: Mon Dec 5 22:56:03 2022 +0800 f2fs: fix iostat parameter for discard Just like other data we count uses the number of bytes as the basic unit, but discard uses the number of cmds as the statistical unit. In fact the discard command contains the number of blocks, so let's change to the number of bytes as the base unit. Fixes: b0af6d491a6b ("f2fs: add app/fs io stat") Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit db8dcd25ec84120d4e57a7f17a566825cec17ae8 Author: Colin Ian King Date: Wed Dec 7 13:42:17 2022 +0000 f2fs: Fix spelling mistake in label: free_bio_enrty_cache -> free_bio_entry_cache There is a spelling mistake in a label name. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2f60f830842d6c6960a0c038695f7bb4f0ef896d Merge: 9196a0ba9f0eb be84d8ed3f04e Author: Linus Torvalds Date: Mon Dec 12 14:54:24 2022 -0800 Merge tag 'x86_alternatives_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 alternative update from Borislav Petkov: "A single alternatives patching fix for modules: - Have alternatives patch the same sections in modules as in vmlinux" * tag 'x86_alternatives_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternative: Consistently patch SMP locks in vmlinux and modules commit 71644dff481180ba024ac4f5cb1f068756357adf Author: Jaegeuk Kim Date: Thu Dec 1 17:37:15 2022 -0800 f2fs: add block_age-based extent cache This patch introduces a runtime hot/cold data separation method for f2fs, in order to improve the accuracy for data temperature classification, reduce the garbage collection overhead after long-term data updates. Enhanced hot/cold data separation can record data block update frequency as "age" of the extent per inode, and take use of the age info to indicate better temperature type for data block allocation: - It records total data blocks allocated since mount; - When file extent has been updated, it calculate the count of data blocks allocated since last update as the age of the extent; - Before the data block allocated, it searches for the age info and chooses the suitable segment for allocation. Test and result: - Prepare: create about 30000 files * 3% for cold files (with cold file extension like .apk, from 3M to 10M) * 50% for warm files (with random file extension like .FcDxq, from 1K to 4M) * 47% for hot files (with hot file extension like .db, from 1K to 256K) - create(5%)/random update(90%)/delete(5%) the files * total write amount is about 70G * fsync will be called for .db files, and buffered write will be used for other files The storage of test device is large enough(128G) so that it will not switch to SSR mode during the test. Benefit: dirty segment count increment reduce about 14% - before: Dirty +21110 - after: Dirty +18286 Signed-off-by: qixiaoyu1 Signed-off-by: xiongping1 Signed-off-by: Jaegeuk Kim commit 72840cccc0a1a0a0dc1bb27b669a9111be6d0f6a Author: Jaegeuk Kim Date: Fri Dec 2 13:51:09 2022 -0800 f2fs: allocate the extent_cache by default Let's allocate it to remove the runtime complexity. Signed-off-by: Jaegeuk Kim commit e7547daccd6a37522f0af74ec4b5a3036f3dd328 Author: Jaegeuk Kim Date: Wed Nov 30 09:26:29 2022 -0800 f2fs: refactor extent_cache to support for read and more This patch prepares extent_cache to be ready for addition. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 749d543c0d451fff31e8f7a3e0a031ffcbf1ebb1 Author: Jaegeuk Kim Date: Wed Nov 30 10:01:18 2022 -0800 f2fs: remove unnecessary __init_extent_tree Added into the caller. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3bac20a8f011b8ed4012b43f4f33010432b3c647 Author: Jaegeuk Kim Date: Wed Nov 30 09:44:58 2022 -0800 f2fs: move internal functions into extent_cache.c No functional change. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 12607c1ba7637e750402f555b6695c50fce77a2b Author: Jaegeuk Kim Date: Wed Nov 30 09:36:43 2022 -0800 f2fs: specify extent cache for read explicitly Let's descrbie it's read extent cache. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ed8ac22b6b75804743f1dae6563d75f85cfd1483 Author: Yangtao Li Date: Thu Nov 24 10:48:42 2022 +0800 f2fs: introduce f2fs_is_readonly() for readability Introduce f2fs_is_readonly() and use it to simplify code. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e480751970e84bc13ab5c288dbbe16b0638cc088 Author: Yangtao Li Date: Thu Nov 24 11:37:08 2022 +0800 f2fs: remove F2FS_SET_FEATURE() and F2FS_CLEAR_FEATURE() macro F2FS_SET_FEATURE() and F2FS_CLEAR_FEATURE() have never been used since they were introduced by this commit 76f105a2dbcd("f2fs: add feature facility in superblock"). So let's remove them. BTW, convert f2fs_sb_has_##name to return bool. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9196a0ba9f0ebe168c7b186f63cf7cab02e55778 Merge: 7adcadb98405c 50865c14f34ed Author: Linus Torvalds Date: Mon Dec 12 14:51:56 2022 -0800 Merge tag 'ras_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - Fix confusing output from /sys/kernel/debug/ras/daemon_active - Add another MCE severity error case to the Intel error severity table to promote UC and AR errors to panic severity and remove the corresponding code condition doing that. - Make sure the thresholding and deferred error interrupts on AMD SMCA systems clear the all registers reporting an error so that there are no multiple errors logged for the same event * tag 'ras_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: RAS: Fix return value from show_trace() x86/mce: Use severity table to handle uncorrected errors in kernel x86/MCE/AMD: Clear DFR errors found in THR handler commit 4cc58a087ddd075255f1037494fbba2f507278fa Merge: 95d1815f0970d 7aca0ac4792e6 Author: Jakub Kicinski Date: Mon Dec 12 14:51:29 2022 -0800 Merge tag 'for-net-next-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: - Add a new VID/PID 0489/e0f2 for MT7922 - Add Realtek RTL8852BE support ID 0x0cb8:0xc559 - Add a new PID/VID 13d3/3549 for RTL8822CU - Add support for broadcom BCM43430A0 & BCM43430A1 - Add CONFIG_BT_HCIBTUSB_POLL_SYNC - Add CONFIG_BT_LE_L2CAP_ECRED - Add support for CYW4373A0 - Add support for RTL8723DS - Add more device IDs for WCN6855 - Add Broadcom BCM4377 family PCIe Bluetooth * tag 'for-net-next-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (51 commits) Bluetooth: Wait for HCI_OP_WRITE_AUTH_PAYLOAD_TO to complete Bluetooth: ISO: Avoid circular locking dependency Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: hci_conn: Fix crash on hci_create_cis_sync Bluetooth: btintel: Fix existing sparce warnings Bluetooth: btusb: Fix existing sparce warning Bluetooth: btusb: Fix new sparce warnings Bluetooth: btusb: Add a new PID/VID 13d3/3549 for RTL8822CU Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 dt-bindings: net: realtek-bluetooth: Add RTL8723DS Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922 dt-bindings: bluetooth: broadcom: add BCM43430A0 & BCM43430A1 Bluetooth: hci_bcm4377: Fix missing pci_disable_device() on error in bcm4377_probe() ... ==================== Link: https://lore.kernel.org/r/20221212222322.1690780-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 7adcadb98405cb4ef56b2518164026c1069d8669 Merge: 40deb5e41ac78 3919430fe93bc Author: Linus Torvalds Date: Mon Dec 12 14:47:31 2022 -0800 Merge tag 'edac_updates_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Make ghes_edac a simple module like the rest of the EDAC drivers and drop the forced built-in only configuration by disentangling it from GHES (Jia He) - The usual small cleanups and improvements all over EDAC land * tag 'edac_updates_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() EDAC/i5400: Fix typo in comment: vaious -> various EDAC/mc_sysfs: Increase legacy channel support to 12 MAINTAINERS: Make Mauro EDAC reviewer MAINTAINERS: Make Manivannan Sadhasivam the maintainer of qcom_edac EDAC/igen6: Return the correct error type when not the MC owner apei/ghes: Use xchg_release() for updating new cache slot instead of cmpxchg() EDAC: Check for GHES preference in the chipset-specific EDAC drivers EDAC/ghes: Make ghes_edac a proper module EDAC/ghes: Prepare to make ghes_edac a proper module EDAC/ghes: Add a notifier for reporting memory errors efi/cper: Export several helpers for ghes_edac to use EDAC/i5000: Mark as BROKEN commit 95d1815f0970d2f8e980a9a53dd0bf215de4d90a Merge: 15eb162176213 144361c1949f2 Author: Jakub Kicinski Date: Mon Dec 12 14:45:36 2022 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next 1) Incorrect error check in nft_expr_inner_parse(), from Dan Carpenter. 2) Add DATA_SENT state to SCTP connection tracking helper, from Sriram Yagnaraman. 3) Consolidate nf_confirm for ipv4 and ipv6, from Florian Westphal. 4) Add bitmask support for ipset, from Vishwanath Pai. 5) Handle icmpv6 redirects as RELATED, from Florian Westphal. 6) Add WARN_ON_ONCE() to impossible case in flowtable datapath, from Li Qiong. 7) A large batch of IPVS updates to replace timer-based estimators by kthreads to scale up wrt. CPUs and workload (millions of estimators). Julian Anastasov says: This patchset implements stats estimation in kthread context. It replaces the code that runs on single CPU in timer context every 2 seconds and causing latency splats as shown in reports [1], [2], [3]. The solution targets setups with thousands of IPVS services, destinations and multi-CPU boxes. Spread the estimation on multiple (configured) CPUs and multiple time slots (timer ticks) by using multiple chains organized under RCU rules. When stats are not needed, it is recommended to use run_estimation=0 as already implemented before this change. RCU Locking: - As stats are now RCU-locked, tot_stats, svc and dest which hold estimator structures are now always freed from RCU callback. This ensures RCU grace period after the ip_vs_stop_estimator() call. Kthread data: - every kthread works over its own data structure and all such structures are attached to array. For now we limit kthreads depending on the number of CPUs. - even while there can be a kthread structure, its task may not be running, eg. before first service is added or while the sysctl var is set to an empty cpulist or when run_estimation is set to 0 to disable the estimation. - the allocated kthread context may grow from 1 to 50 allocated structures for timer ticks which saves memory for setups with small number of estimators - a task and its structure may be released if all estimators are unlinked from its chains, leaving the slot in the array empty - every kthread data structure allows limited number of estimators. Kthread 0 is also used to initially calculate the max number of estimators to allow in every chain considering a sub-100 microsecond cond_resched rate. This number can be from 1 to hundreds. - kthread 0 has an additional job of optimizing the adding of estimators: they are first added in temp list (est_temp_list) and later kthread 0 distributes them to other kthreads. The optimization is based on the fact that newly added estimator should be estimated after 2 seconds, so we have the time to offload the adding to chain from controlling process to kthread 0. - to add new estimators we use the last added kthread context (est_add_ktid). The new estimators are linked to the chains just before the estimated one, based on add_row. This ensures their estimation will start after 2 seconds. If estimators are added in bursts, common case if all services and dests are initially configured, we may spread the estimators to more chains and as result, reducing the initial delay below 2 seconds. Many thanks to Jiri Wiesner for his valuable comments and for spending a lot of time reviewing and testing the changes on different platforms with 48-256 CPUs and 1-8 NUMA nodes under different cpufreq governors. The new IPVS estimators do not use workqueue infrastructure because: - The estimation can take long time when using multiple IPVS rules (eg. millions estimator structures) and especially when box has multiple CPUs due to the for_each_possible_cpu usage that expects packets from any CPU. With est_nice sysctl we have more control how to prioritize the estimation kthreads compared to other processes/kthreads that have latency requirements (such as servers). As a benefit, we can see these kthreads in top and decide if we will need some further control to limit their CPU usage (max number of structure to estimate per kthread). - with kthreads we run code that is read-mostly, no write/lock operations to process the estimators in 2-second intervals. - work items are one-shot: as estimators are processed every 2 seconds, they need to be re-added every time. This again loads the timers (add_timer) if we use delayed works, as there are no kthreads to do the timings. [1] Report from Yunhong Jiang: https://lore.kernel.org/netdev/D25792C1-1B89-45DE-9F10-EC350DC04ADC@gmail.com/ [2] https://marc.info/?l=linux-virtual-server&m=159679809118027&w=2 [3] Report from Dust: https://archive.linuxvirtualserver.org/html/lvs-devel/2020-12/msg00000.html * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: ipvs: run_estimation should control the kthread tasks ipvs: add est_cpulist and est_nice sysctl vars ipvs: use kthreads for stats estimation ipvs: use u64_stats_t for the per-cpu counters ipvs: use common functions for stats allocation ipvs: add rcu protection to stats netfilter: flowtable: add a 'default' case to flowtable datapath netfilter: conntrack: set icmpv6 redirects as RELATED netfilter: ipset: Add support for new bitmask parameter netfilter: conntrack: merge ipv4+ipv6 confirm functions netfilter: conntrack: add sctp DATA_SENT state netfilter: nft_inner: fix IS_ERR() vs NULL check ==================== Link: https://lore.kernel.org/r/20221211101204.1751-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 40deb5e41ac783d49371940581db2ae108a754d1 Merge: 1cab145a94ac9 55228db2697c0 Author: Linus Torvalds Date: Mon Dec 12 14:41:57 2022 -0800 Merge tag 'x86_fpu_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu updates from Dave Hansen: "There are two little fixes in here, one to give better XSAVE warnings and another to address some undefined behavior in offsetof(). There is also a collection of patches to fix some issues with ptrace and the protection keys register (PKRU). PKRU is a real oddity because it is exposed in the XSAVE-related ABIs, but it is generally managed without using XSAVE in the kernel. This fix thankfully came with a selftest to ward off future regressions. Summary: - Clarify XSAVE consistency warnings - Fix up ptrace interface to protection keys register (PKRU) - Avoid undefined compiler behavior with TYPE_ALIGN" * tag 'x86_fpu_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN selftests/vm/pkeys: Add a regression test for setting PKRU through ptrace x86/fpu: Emulate XRSTOR's behavior if the xfeatures PKRU bit is not set x86/fpu: Allow PKRU to be (once again) written by ptrace. x86/fpu: Add a pkru argument to copy_uabi_to_xstate() x86/fpu: Add a pkru argument to copy_uabi_from_kernel_to_xstate(). x86/fpu: Take task_struct* in copy_sigframe_from_user_to_xstate() x86/fpu/xstate: Fix XSTATE_WARN_ON() to emit relevant diagnostics commit 1cab145a94ac9816dcea63e6f2a04c385ac8c3fc Merge: 287f037db5b46 727209376f499 Author: Linus Torvalds Date: Mon Dec 12 14:39:51 2022 -0800 Merge tag 'x86_splitlock_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 splitlock updates from Dave Hansen: "Add a sysctl to control the split lock misery mode. This enables users to reduce the penalty inflicted on split lock users. There are some proprietary, binary-only games which became entirely unplayable with the old penalty. Anyone opting into the new mode is, of course, more exposed to the DoS nasitness inherent with split locks, but they can play their games again" * tag 'x86_splitlock_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/split_lock: Add sysctl to control the misery mode commit 287f037db5b46de5a86e4bdfbf02e0206ca877bf Merge: a89ef2aa552db 97fa21f65c3eb Author: Linus Torvalds Date: Mon Dec 12 14:30:54 2022 -0800 Merge tag 'x86_cache_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cache resource control updates from Dave Hansen: "These declare the resource control (rectrl) MSRs a bit more normally and clean up an unnecessary structure member: - Remove unnecessary arch_has_empty_bitmaps structure memory - Move rescrtl MSR defines into msr-index.h, like normal MSRs" * tag 'x86_cache_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Move MSR defines into msr-index.h x86/resctrl: Remove arch_has_empty_bitmaps commit a89ef2aa552db985e0ee8cb458846298c007704c Merge: 2da68a77b9407 00e07cfbdf0b2 Author: Linus Torvalds Date: Mon Dec 12 14:27:49 2022 -0800 Merge tag 'x86_tdx_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 tdx updates from Dave Hansen: "This includes a single chunk of new functionality for TDX guests which allows them to talk to the trusted TDX module software and obtain an attestation report. This report can then be used to prove the trustworthiness of the guest to a third party and get access to things like storage encryption keys" * tag 'x86_tdx_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/tdx: Test TDX attestation GetReport support virt: Add TDX guest driver x86/tdx: Add a wrapper to get TDREPORT0 from the TDX Module commit 7aca0ac4792e6cb0f35ef97bfcb39b1663a92fb7 Author: Luiz Augusto von Dentz Date: Wed Dec 7 11:56:57 2022 -0800 Bluetooth: Wait for HCI_OP_WRITE_AUTH_PAYLOAD_TO to complete This make sure HCI_OP_WRITE_AUTH_PAYLOAD_TO completes before notifying the encryption change just as is done with HCI_OP_READ_ENC_KEY_SIZE. Signed-off-by: Luiz Augusto von Dentz commit 241f51931c35085449502c10f64fb3ecd6e02171 Author: Luiz Augusto von Dentz Date: Tue Dec 6 16:34:42 2022 -0800 Bluetooth: ISO: Avoid circular locking dependency This attempts to avoid circular locking dependency between sock_lock and hdev_lock: WARNING: possible circular locking dependency detected 6.0.0-rc7-03728-g18dd8ab0a783 #3 Not tainted ------------------------------------------------------ kworker/u3:2/53 is trying to acquire lock: ffff888000254130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: iso_conn_del+0xbd/0x1d0 but task is already holding lock: ffffffff9f39a080 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_cis_estabilished_evt+0x1b5/0x500 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock+0x10e/0xfe0 hci_le_remote_feat_complete_evt+0x17f/0x320 hci_event_packet+0x39c/0x7d0 hci_rx_work+0x2bf/0x950 process_one_work+0x569/0x980 worker_thread+0x2a3/0x6f0 kthread+0x153/0x180 ret_from_fork+0x22/0x30 -> #1 (&hdev->lock){+.+.}-{3:3}: __mutex_lock+0x10e/0xfe0 iso_connect_cis+0x6f/0x5a0 iso_sock_connect+0x1af/0x710 __sys_connect+0x17e/0x1b0 __x64_sys_connect+0x37/0x50 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x62/0xcc -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: __lock_acquire+0x1b51/0x33d0 lock_acquire+0x16f/0x3b0 lock_sock_nested+0x32/0x80 iso_conn_del+0xbd/0x1d0 iso_connect_cfm+0x226/0x680 hci_le_cis_estabilished_evt+0x1ed/0x500 hci_event_packet+0x39c/0x7d0 hci_rx_work+0x2bf/0x950 process_one_work+0x569/0x980 worker_thread+0x2a3/0x6f0 kthread+0x153/0x180 ret_from_fork+0x22/0x30 other info that might help us debug this: Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_ISO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); *** DEADLOCK *** 4 locks held by kworker/u3:2/53: #0: ffff8880021d9130 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x4ad/0x980 #1: ffff888002387de0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x4ad/0x980 #2: ffff888001ac0070 (&hdev->lock){+.+.}-{3:3}, at: hci_le_cis_estabilished_evt+0xc3/0x500 #3: ffffffff9f39a080 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_cis_estabilished_evt+0x1b5/0x500 Signed-off-by: Luiz Augusto von Dentz commit 0ba18967d4544955b2eff2fbc4f2a8750c4df90a Author: Yang Yingliang Date: Wed Dec 7 10:18:35 2022 +0800 Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit 39c1eb6fcbae8ce9bb71b2ac5cb609355a2b181b Author: Yang Yingliang Date: Wed Dec 7 10:18:34 2022 +0800 Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 9238f36a5a50 ("Bluetooth: Add request cmd_complete and cmd_status functions") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit 7b503e339c1a80bf0051ec2d19c3bc777014ac61 Author: Yang Yingliang Date: Wed Dec 7 10:18:33 2022 +0800 Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit 383630cc6758d619874c2e8bb2f68a61f3f9ef6e Author: Yang Yingliang Date: Wed Dec 7 10:18:32 2022 +0800 Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 43eb12d78960 ("Bluetooth: Fix/implement Three-wire reliable packet sending") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit 8f458f783dfbb19c1f1cb58ed06eeb701f52091b Author: Yang Yingliang Date: Wed Dec 7 10:18:31 2022 +0800 Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 166d2f6a4332 ("[Bluetooth] Add UART driver for Texas Instruments' BRF63xx chips") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit df4cfc91208e0a98f078223793f5871b1a82cc54 Author: Yang Yingliang Date: Wed Dec 7 10:18:30 2022 +0800 Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 0ff252c1976d ("Bluetooth: hciuart: Add support QCA chipset for UART") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit b15a6bd3c80c77faec8317319b97f976b1a08332 Author: Yang Yingliang Date: Tue Dec 6 20:59:10 2022 +0800 Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Fixes: 803b58367ffb ("Bluetooth: btusb: Implement driver internal packet reassembly") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit cee50ce899de415baf4da3ed38b7d4f13c3170d1 Author: Wang ShaoBo Date: Mon Dec 5 21:53:57 2022 +0800 Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() skb allocated by __hci_cmd_sync would not be used whether in checking for supported iBT hardware variants or after, we should free it in all error branches, this patch makes the case read version failed or default error case free skb before return. Fixes: c86c7285bb08 ("Bluetooth: btintel: Fix the legacy bootloader returns tlv based version") Fixes: 019a1caa7fd2 ("Bluetooth: btintel: Refactoring setup routine for bootloader devices") Signed-off-by: Wang ShaoBo Reviewed-by: Tedd Ho-Jeong An Signed-off-by: Luiz Augusto von Dentz commit 50757a259ba78c4e938b5735e76ffec6cd0c942e Author: Luiz Augusto von Dentz Date: Mon Dec 5 17:11:57 2022 -0800 Bluetooth: hci_conn: Fix crash on hci_create_cis_sync When attempting to connect multiple ISO sockets without using DEFER_SETUP may result in the following crash: BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0 Read of size 2 at addr 0000000000000036 by task kworker/u3:1/50 CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted 6.0.0-rc7-02243-gb84a13ff4eda #4373 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: dump_stack_lvl+0x19/0x27 kasan_report+0xbc/0xf0 ? hci_create_cis_sync+0x18b/0x2b0 hci_create_cis_sync+0x18b/0x2b0 ? get_link_mode+0xd0/0xd0 ? __ww_mutex_lock_slowpath+0x10/0x10 ? mutex_lock+0xe0/0xe0 ? get_link_mode+0xd0/0xd0 hci_cmd_sync_work+0x111/0x190 process_one_work+0x427/0x650 worker_thread+0x87/0x750 ? process_one_work+0x650/0x650 kthread+0x14e/0x180 ? kthread_exit+0x50/0x50 ret_from_fork+0x22/0x30 Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Luiz Augusto von Dentz commit 069ab3f94cfe266bd2810564bf287e765034b4f8 Author: Luiz Augusto von Dentz Date: Mon Dec 5 10:25:52 2022 -0800 Bluetooth: btintel: Fix existing sparce warnings This fix the following warnings detect with make W=1 C=1: drivers/bluetooth/btintel.c:1041:38: warning: cast to restricted __le32 drivers/bluetooth/btintel.c:1786:25: warning: cast to restricted __le16 drivers/bluetooth/btintel.c:1795:25: warning: cast to restricted __le16 drivers/bluetooth/btintel.c:1796:25: warning: cast to restricted __le16 drivers/bluetooth/btintel.c:1797:25: warning: cast to restricted __le16 Signed-off-by: Luiz Augusto von Dentz commit 42d3b43e3f64ba4fec6c849980b88f47ae2e3318 Author: Luiz Augusto von Dentz Date: Mon Dec 5 09:58:43 2022 -0800 Bluetooth: btusb: Fix existing sparce warning This fix the following warnings detect with make W=1 C=1: drivers/bluetooth/btusb.c:3426:28: warning: cast to restricted __le32 Signed-off-by: Luiz Augusto von Dentz commit cb3648a78e51c90fc95b99677450145119a9675c Author: Luiz Augusto von Dentz Date: Mon Dec 5 09:49:15 2022 -0800 Bluetooth: btusb: Fix new sparce warnings This fix the following warnings detect with make W=1 C=1: drivers/bluetooth/btusb.c:2212:9: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2212:9: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2245:18: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2249:18: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2253:18: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2257:18: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2261:18: warning: cast to restricted __le16 drivers/bluetooth/btusb.c:2267:18: warning: cast to restricted __le16 Signed-off-by: Luiz Augusto von Dentz commit 6d0a4fe28ac21610c968f9f1ad47e6b705affb5c Author: Gongwei Li Date: Thu Dec 1 17:43:53 2022 +0800 Bluetooth: btusb: Add a new PID/VID 13d3/3549 for RTL8822CU * /sys/kernel/debug/usb/devices T: Bus=03 Lev=02 Prnt=02 Port=02 Cnt=03 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=b85b Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Gongwei Li Signed-off-by: Luiz Augusto von Dentz commit 393b4916b7b5b94faf5c6a7c68df1c62d17e4f38 Author: Artem Lukyanov Date: Wed Nov 23 11:10:05 2022 +0300 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 Add the support ID(0x0cb8, 0xc559) to usb_device_id table for Realtek RTL8852BE. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cb8 ProdID=c559 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Artem Lukyanov Signed-off-by: Luiz Augusto von Dentz commit ba6ae1fb680331a8db05063e3fd42615d634277a Author: Samuel Holland Date: Thu Nov 24 22:09:56 2022 -0600 dt-bindings: net: realtek-bluetooth: Add RTL8723DS RTL8723DS is another variant of the RTL8723 WiFi + Bluetooth chip. It is already supported by the hci_uart/btrtl driver. Document the compatible. Acked-by: Rob Herring Reviewed-by: Alistair Francis Signed-off-by: Samuel Holland Signed-off-by: Luiz Augusto von Dentz commit 13fcc94d1bbcbf48ca771d124c0c536e8e414229 Author: Andy Chi Date: Mon Nov 28 15:49:57 2022 +0800 Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922 Add VID/PID 0489/e0f2 for MediaTek MT7922 Bluetooth chip. Found and tested with HP ProBook. From /sys/kernel/debug/usb/devices: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f2 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Andy Chi Signed-off-by: Luiz Augusto von Dentz commit d4e9b8b802525f12375a858a6d3711f9ef4ce779 Author: Luca Weiss Date: Sat Sep 24 16:21:55 2022 +0200 dt-bindings: bluetooth: broadcom: add BCM43430A0 & BCM43430A1 Document the compatible string for BCM43430A0 bluetooth used in lg-lenok and BCM43430A1 used in asus-sparrow. Signed-off-by: Luca Weiss Reviewed-by: Linus Walleij Acked-by: Rob Herring Signed-off-by: Luiz Augusto von Dentz commit b1e05cfb646cda7c53b5a34ea946c9e506db3c1c Author: Yang Yingliang Date: Sat Nov 12 17:04:37 2022 +0800 Bluetooth: hci_bcm4377: Fix missing pci_disable_device() on error in bcm4377_probe() pci_disable_device() need be called while module exiting, switch to use pcim_enable(), pci_disable_device() will be called in pcim_release() after probe() failure. Fixes: ab80b2cec05f ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards") Signed-off-by: Yang Yingliang Reviewed-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit ac09bb3f87a776f8c7cabc746066a9aca8f507b6 Author: Raman Varabets Date: Tue Nov 8 20:54:13 2022 +0800 Bluetooth: btusb: Add Realtek 8761BUV support ID 0x2B89:0x8761 Identifies as "Realtek Bluetooth Radio"; used in UGREEN CM390 (P/N 80889). Device description at /sys/kernel/debug/usb/devices: T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 7 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2b89 ProdID=8761 Rev= 2.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00E04C239987 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Raman Varabets Signed-off-by: Luiz Augusto von Dentz commit 8a06127602de70541e751a8c64a06995ee281f22 Author: Sven Peter Date: Fri Nov 4 22:13:03 2022 +0100 Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards Broadcom BCM4377/4378/4387 are dual WiFi/Bluetooth boards found in Apple machines. This driver adds support for the Bluetooth function which exposes a shared memory IPC protocol over PCIe to tunnel HCI traffic. Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit ffcb0a445ec2d5753751437706aa0a7ea8351099 Author: Sven Peter Date: Fri Nov 4 22:13:02 2022 +0100 Bluetooth: Add quirk to disable MWS Transport Configuration Broadcom 4378/4387 controllers found in Apple Silicon Macs claim to support getting MWS Transport Layer Configuration, < HCI Command: Read Local Supported... (0x04|0x0002) plen 0 > HCI Event: Command Complete (0x0e) plen 68 Read Local Supported Commands (0x04|0x0002) ncmd 1 Status: Success (0x00) [...] Get MWS Transport Layer Configuration (Octet 30 - Bit 3)] [...] , but then don't actually allow the required command: > HCI Event: Command Complete (0x0e) plen 15 Get MWS Transport Layer Configuration (0x05|0x000c) ncmd 1 Status: Command Disallowed (0x0c) Number of transports: 0 Baud rate list: 0 entries 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit 392fca352c7a95e2828d49e7500e26d0c87ca265 Author: Sven Peter Date: Fri Nov 4 22:13:01 2022 +0100 Bluetooth: Add quirk to disable extended scanning Broadcom 4377 controllers found in Apple x86 Macs with the T2 chip claim to support extended scanning when querying supported states, < HCI Command: LE Read Supported St.. (0x08|0x001c) plen 0 > HCI Event: Command Complete (0x0e) plen 12 LE Read Supported States (0x08|0x001c) ncmd 1 Status: Success (0x00) States: 0x000003ffffffffff [...] LE Set Extended Scan Parameters (Octet 37 - Bit 5) LE Set Extended Scan Enable (Octet 37 - Bit 6) [...] , but then fail to actually implement the extended scanning: < HCI Command: LE Set Extended Sca.. (0x08|0x0041) plen 8 Own address type: Random (0x01) Filter policy: Accept all advertisement (0x00) PHYs: 0x01 Entry 0: LE 1M Type: Active (0x01) Interval: 11.250 msec (0x0012) Window: 11.250 msec (0x0012) > HCI Event: Command Complete (0x0e) plen 4 LE Set Extended Scan Parameters (0x08|0x0041) ncmd 1 Status: Unknown HCI Command (0x01) Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit ad38e55e1c89384aecee1bb0425bf1bf21ec86fd Author: Sven Peter Date: Fri Nov 4 22:13:00 2022 +0100 Bluetooth: hci_event: Ignore reserved bits in LE Extended Adv Report Broadcom controllers present on Apple Silicon devices use the upper 8 bits of the event type in the LE Extended Advertising Report for the channel on which the frame has been received. These bits are reserved according to the Bluetooth spec anyway such that we can just drop them to ensure that the advertising results are parsed correctly. The following excerpt from a btmon trace shows a report received on channel 37 by these controllers: > HCI Event: LE Meta Event (0x3e) plen 55 LE Extended Advertising Report (0x0d) Num reports: 1 Entry 0 Event type: 0x2513 Props: 0x0013 Connectable Scannable Use legacy advertising PDUs Data status: Complete Reserved (0x2500) Legacy PDU Type: Reserved (0x2513) Address type: Public (0x00) Address: XX:XX:XX:XX:XX:XX (Shenzhen Jingxun Software [...]) Primary PHY: LE 1M Secondary PHY: No packets SID: no ADI field (0xff) TX power: 127 dBm RSSI: -76 dBm (0xb4) Periodic advertising interval: 0.00 msec (0x0000) Direct address type: Public (0x00) Direct address: 00:00:00:00:00:00 (OUI 00-00-00) Data length: 0x1d [...] Flags: 0x18 Simultaneous LE and BR/EDR (Controller) Simultaneous LE and BR/EDR (Host) Company: Harman International Industries, Inc. (87) Data: [...] Service Data (UUID 0xfddf): Name (complete): JBL Flip 5 Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit 7a73b976eda916a2ed703e4b996c92c871715d9b Author: Sven Peter Date: Fri Nov 4 22:12:59 2022 +0100 arm64: dts: apple: t8103: Add Bluetooth controller Add bluetooth controller nodes and the required brcm,board-type properties to be able to select the correct firmware to all board device trees. Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz commit c9176e10b2b68dfa4b94dce11ad99214ceecf714 Author: Sven Peter Date: Fri Nov 4 22:12:58 2022 +0100 dt-bindings: net: Add Broadcom BCM4377 family PCIe Bluetooth These chips are combined Wi-Fi/Bluetooth radios which expose a PCI subfunction for the Bluetooth part. They are found in Apple machines such as the x86 models with the T2 chip or the arm64 models with the M1 or M2 chips. Signed-off-by: Sven Peter Reviewed-by: Rob Herring Signed-off-by: Luiz Augusto von Dentz commit 45564c4ef607a4410f333a3a5e881bab90c761cd Author: Sven Peter Date: Fri Nov 4 22:12:57 2022 +0100 dt-bindings: net: Add generic Bluetooth controller Bluetooth controllers share the common local-bd-address property. Add a generic YAML schema to replace bluetooth.txt for those. Signed-off-by: Sven Peter Reviewed-by: Rob Herring Signed-off-by: Luiz Augusto von Dentz commit 02d056a3404e20245a69dcb4022a0930085fc5ec Author: Marek Vasut Date: Wed Nov 2 17:47:05 2022 +0100 Bluetooth: hci_bcm: Add CYW4373A0 support CYW4373A0 is a Wi-Fi + Bluetooth combo device from Cypress. This chip is present e.g. on muRata 2AE module. This chip has additional quirk where the HCI command 0xfc45, used on older chips to switch UART clock from 24 MHz to 48 MHz, to support baudrates over 3 Mbdps, is no longer recognized by this newer chip. This newer chip can configure the 4 Mbdps baudrate without the need to issue HCI command 0xfc45, so add flag to indicate this and do not issue the command on this chip to avoid failure to set 4 Mbdps baud rate. It is not clear whether there is a way to determine which chip does and which chip does not support the HCI command 0xfc45, other than trial and error. Reviewed-by: Linus Walleij Signed-off-by: Marek Vasut Signed-off-by: Luiz Augusto von Dentz commit 892913f0f2fdf57cd7271a59bf489ca0c60eded5 Author: Marek Vasut Date: Wed Nov 2 17:47:04 2022 +0100 dt-bindings: net: broadcom-bluetooth: Add CYW4373A0 DT binding CYW4373A0 is a Wi-Fi + Bluetooth combo device from Cypress. This chip is present e.g. on muRata 2AE module. Extend the binding with its DT compatible. Acked-by: Rob Herring Reviewed-by: Linus Walleij Signed-off-by: Marek Vasut Signed-off-by: Luiz Augusto von Dentz commit 3958e87783e746a2ce78fbb30f24231569f03543 Author: Kang Minchul Date: Mon Oct 31 03:17:22 2022 +0900 Bluetooth: Use kzalloc instead of kmalloc/memset Replace kmalloc+memset by kzalloc for better readability and simplicity. This addresses the cocci warning below: WARNING: kzalloc should be used for d, instead of kmalloc/memset Signed-off-by: Kang Minchul Signed-off-by: Luiz Augusto von Dentz commit ca2a99447e17acd67258aa1d54d7ea3c404a779c Author: Shengyu Qu Date: Sun Oct 30 01:22:54 2022 +0800 Bluetooth: btusb: Add more device IDs for WCN6855 Add IDs to usb_device_id table for WCN6855. IDs are extracted from Windows driver of Lenovo Thinkpad T14 Gen 2(Driver version 1.0.0.1205 Windows 10) Windows driver download address: https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/ thinkpad-t-series-laptops/thinkpad-t14-gen-2-type-20xk-20xl/downloads /driver-list/ Signed-off-by: Shengyu Qu Signed-off-by: Luiz Augusto von Dentz commit 63db780a93eb802ece1bbf61ab5894ad8827b56e Author: Christophe JAILLET Date: Sun Oct 30 08:00:03 2022 +0100 Bluetooth: Fix EALREADY and ELOOP cases in bt_status() 'err' is known to be <0 at this point. So, some cases can not be reached because of a missing "-". Add it. Fixes: ca2045e059c3 ("Bluetooth: Add bt_status") Signed-off-by: Christophe JAILLET Signed-off-by: Luiz Augusto von Dentz commit 462fcd53924ccc21596d30edd0673fa7c939b392 Author: Luiz Augusto von Dentz Date: Thu Oct 27 16:18:04 2022 -0700 Bluetooth: Add CONFIG_BT_LE_L2CAP_ECRED This adds CONFIG_BT_LE_L2CAP_ECRED which can be used to enable L2CAP Enhanced Credit Flow Control Mode by default, previously it was only possible to set it via module parameter (e.g. bluetooth.enable_ecred=1). Since L2CAP ECRED mode is required by the likes of EATT which is recommended for LE Audio this enables it by default. Signed-off-by: Luiz Augusto von Dentz Tested-By: Tedd Ho-Jeong An commit db11223571d489d1aab575a4ac4b7352d2d54e2f Author: Luiz Augusto von Dentz Date: Tue Oct 25 14:12:58 2022 -0700 Bluetooth: btusb: Default CONFIG_BT_HCIBTUSB_POLL_SYNC=y poll_sync has been proven to fix races of USB data and event endpoints so this enables it by default. Signed-off-by: Luiz Augusto von Dentz Tested-by: Tedd Ho-Jeong An commit bb1afb2955212d30177b122b13ae636a69abf883 Author: Luiz Augusto von Dentz Date: Tue Oct 25 14:12:57 2022 -0700 Bluetooth: btusb: Add CONFIG_BT_HCIBTUSB_POLL_SYNC This adds CONFIG_BT_HCIBTUSB_POLL_SYNC which can be used to set the default behavior of Bluetooth USB controller with respect to poll synchronization of its endpoits. Signed-off-by: Luiz Augusto von Dentz Tested-by: Tedd Ho-Jeong An commit 47c50853bb9c5c35bf5c3eb00b712310ec2969e2 Author: Igor Skalkin Date: Mon Oct 24 15:40:33 2022 +0200 virtio_bt: Fix alignment in configuration struct The current version of the configuration structure has unaligned 16-bit fields, but according to the specification [1], access to the configuration space must be aligned. Add a second, aligned version of the configuration structure and a new feature bit indicating that this version is being used. [1] https://docs.oasis-open.org/virtio/virtio/v1.1/virtio-v1.1.pdf Signed-off-by: Igor Skalkin Signed-off-by: Luiz Augusto von Dentz commit 3b1c7c00b8c22b3cb79532252c59eb0b287bb86d Author: Inga Stotland Date: Fri Oct 21 17:48:56 2022 -0700 Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS When validating the parameter length for MGMT_OP_ADD_EXT_ADV_PARAMS command, use the correct op code in error status report: was MGMT_OP_ADD_ADVERTISING, changed to MGMT_OP_ADD_EXT_ADV_PARAMS. Fixes: 12410572833a2 ("Bluetooth: Break add adv into two mgmt commands") Signed-off-by: Inga Stotland Signed-off-by: Luiz Augusto von Dentz commit 0d75da38e060d21f948b3df5f5e349c962cf1ed2 Author: Yang Yingliang Date: Thu Oct 20 10:16:56 2022 +0800 Bluetooth: hci_core: fix error handling in hci_register_dev() If hci_register_suspend_notifier() returns error, the hdev and rfkill are leaked. We could disregard the error and print a warning message instead to avoid leaks, as it just means we won't be handing suspend requests. Fixes: 9952d90ea288 ("Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND") Signed-off-by: Yang Yingliang Signed-off-by: Luiz Augusto von Dentz commit 37224a290853a69f7e8e8c2269c9caea6e2bcb4b Author: Jiapeng Chong Date: Mon Oct 17 13:47:13 2022 +0800 Bluetooth: Use kzalloc instead of kmalloc/memset Use kzalloc rather than duplicating its implementation, which makes code simple and easy to understand. ./net/bluetooth/hci_conn.c:2038:6-13: WARNING: kzalloc should be used for cp, instead of kmalloc/memset. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2406 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Luiz Augusto von Dentz commit e9b3e5b8c65733f626a7ee919c4bc895b51d7bb2 Author: Zhengping Jiang Date: Thu Oct 13 14:45:08 2022 -0700 Bluetooth: hci_qca: only assign wakeup with serial port support Only assign hdev->wakeup if the serial port supports wakeup. Otherwise it will fall back to the hci_uart_wakeup or the behavior that can be overridden before calling the hci_uart_register_device(). Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz commit d11ab690c300becca17223531f9ca4ae29284c52 Author: Pauli Virtanen Date: Tue Oct 11 22:25:34 2022 +0300 Bluetooth: hci_conn: use HCI dst_type values also for BIS For ISO BIS related functions in hci_conn.c, make dst_type values be HCI address type values, not ISO socket address type values. This makes it consistent with CIS functions. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit a479e71322ced3e663b0baf17a6d250c973454c8 Author: Hilda Wu Date: Wed Oct 5 16:43:31 2022 +0800 Bluetooth: btusb: Ignore zero length of USB packets on ALT 6 for specific chip For USB ALT 6 settings some Realtek chips need to transmit mSBC data continuously without the zero length of USB packets. In this commit, create BTUSB_ALT6_CONTINUOUS_TX to manage the behavior. Therefore, create REALTEK_ALT6_CONTINUOUS_TX_CHIP to manage the specific chip model for the behavior. Signed-off-by: Max Chou Signed-off-by: Hilda Wu Signed-off-by: Luiz Augusto von Dentz commit 5b355944b19011011dd3fd4187444c5ff1d76ad2 Author: Hilda Wu Date: Wed Oct 5 16:43:30 2022 +0800 Bluetooth: btrtl: Add btrealtek data struct This patch adds a data structure for btrealtek object, and the definition of vendor behavior flags. It also adds macros to set/test/get the flags. Signed-off-by: Hilda Wu Signed-off-by: Luiz Augusto von Dentz commit dc65b4b0f90a2c5eb37b47cd3a82fcd857a69264 Author: Michael S. Tsirkin Date: Mon Oct 10 13:14:37 2022 -0400 Bluetooth: virtio_bt: fix device removal Device removal is clearly out of virtio spec: it attempts to remove unused buffers from a VQ before invoking device reset. To fix, make open/close NOPs and do all cleanup/setup in probe/remove. NB: This is a hacky way to handle this - virtbt_{open,close} as NOP is not really what a driver is supposed to be doing. These are transport enable/disable callbacks from the BT core towards the driver. It maps to a device being enabled/disabled by something like bluetoothd for example. So if disabled, users expect that no resources/queues are in use. It does work with all other transports like USB, SDIO, UART etc. There should be no buffer used if the device is powered off. We also don’t have any USB URBs in-flight if the transport is not active. The way to implement a proper fix would be using vq reset if supported, or even using a full device reset. The cost of the hack is a single skb wasted on an unused bt device. NB2: with this fix in place driver still suffers from a race condition if an interrupt triggers while device is being reset. To fix, in the virtbt_close() callback we should deactivate all interrupts. To be fixed. squashed fixup: bluetooth: virtio_bt: fix an error code in probe() Signed-off-by: Dan Carpenter Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Michael S. Tsirkin Message-Id: <20220811080943.198245-1-mst@redhat.com> Signed-off-by: Luiz Augusto von Dentz Tested-by: Igor Skalkin commit 97dfaf073f5881c624856ef293be307b6166115c Author: Archie Pusaka Date: Wed Oct 5 15:09:47 2022 +0800 Bluetooth: hci_sync: cancel cmd_timer if hci_open failed If a command is already sent, we take care of freeing it, but we also need to cancel the timeout as well. Signed-off-by: Archie Pusaka Reviewed-by: Abhishek Pandit-Subedi Signed-off-by: Luiz Augusto von Dentz commit eeb1aafe97fa6da558157d2eb18cce25878b8656 Author: Luiz Augusto von Dentz Date: Fri Oct 7 18:08:43 2022 -0700 Bluetooth: hci_sync: Fix not able to set force_static_address force_static_address shall be writable while hdev is initing but is not considered powered yet since the static address is written only when powered. Signed-off-by: Luiz Augusto von Dentz Tested-by: Brian Gix commit e411443c32554b4db157eb49f199d9cfebda2817 Author: Luiz Augusto von Dentz Date: Fri Oct 7 13:25:38 2022 -0700 Bluetooth: hci_sync: Fix not setting static address This attempts to program the address stored in hdev->static_addr after the init sequence has been complete: @ MGMT Command: Set Static A.. (0x002b) plen 6 Address: C0:55:44:33:22:11 (Static) @ MGMT Event: Command Complete (0x0001) plen 7 Set Static Address (0x002b) plen 4 Status: Success (0x00) Current settings: 0x00008200 Low Energy Static Address @ MGMT Event: New Settings (0x0006) plen 4 Current settings: 0x00008200 Low Energy Static Address < HCI Command: LE Set Random.. (0x08|0x0005) plen 6 Address: C0:55:44:33:22:11 (Static) > HCI Event: Command Complete (0x0e) plen 4 LE Set Random Address (0x08|0x0005) ncmd 1 Status: Success (0x00) @ MGMT Event: Command Complete (0x0001) plen 7 Set Powered (0x0005) plen 4 Status: Success (0x00) Current settings: 0x00008201 Powered Low Energy Static Address @ MGMT Event: New Settings (0x0006) plen 4 Current settings: 0x00008201 Powered Low Energy Static Address Signed-off-by: Luiz Augusto von Dentz Tested-by: Brian Gix commit b3fdb8c9789dcb888986c75ef6677d41d40ec83e Author: Nicolas Cavallari Date: Wed Oct 5 17:06:21 2022 +0200 Bluetooth: Work around SCO over USB HCI design defect The USB interface between the host and the bluetooth adapter used for SCO packets uses an USB isochronous endpoint with a fragmentation scheme that does not tolerate errors. Except USB isochronous transfers do not provide a reliable stream with guaranteed delivery. (There is no retry on error, see USB spec v2.0 5.6 and 8.5.5.) To fragment a packet, the bluetooth HCI simply splits it in parts and transfer them as-is. The receiver is expected to reconstruct the packet by assuming the first fragment contains the header and parsing its size field. There is no error detection either. If a fragment is lost, the end result is that the kernel is no longer synchronized and will pass malformed data to the upper layers, since it has no way to tell if the first fragment is an actual first fragment or a continuation fragment. Resynchronization can only happen by luck and requires an unbounded amount of time. The typical symptom for a HSP/HFP bluetooth headset is that the microphone stops working and dmesg contains piles of rate-limited "Bluetooth: hci0: SCO packet for unknown connection handle XXXX" errors for an indeterminate amount of time, until the kernel accidentally resynchronize. A workaround is to ask the upper layer to prevalidate the first fragment header. This is not possible with user channels so this workaround is disabled in this case. This problem is the most severe when using an ath3k adapter on an i.MX 6 board, where packet loss occur regularly, possibly because it is an USB1 device connected on an USB2 hub and this is a special case requiring split transactions. Signed-off-by: Nicolas Cavallari Signed-off-by: Luiz Augusto von Dentz commit c9209b269afd29c55b8be49916725ed469f8c5d9 Author: Archie Pusaka Date: Thu Oct 6 17:09:31 2022 +0800 Bluetooth: btusb: Introduce generic USB reset On cmd_timeout with no reset_gpio, reset the USB port as a last resort. This patch changes the behavior of btusb_intel_cmd_timeout and btusb_rtl_cmd_timeout. Signed-off-by: Archie Pusaka Reviewed-by: Abhishek Pandit-Subedi Reviewed-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz commit f9c5cbd52c62f2fa9d2dfbe1af8fb00e5056aefe Author: Chethan Tumkur Narayan Date: Mon Oct 3 12:18:36 2022 +0530 btusb: Avoid reset of ISOC endpoint alt settings to zero In case of suspend/resume and HCI_RESET (BT On and Off), ISOC endpoint set to alt setting 0 when no SCO connection exists. This patch shall avoid resetting of ISOC endpoint to alt setting to 0. Signed-off-by: Chethan Tumkur Narayan Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 2da68a77b940722b04c2f7604a758eab46cf6cf9 Merge: c1f0fcd85d3d6 89e927bbcd45d Author: Linus Torvalds Date: Mon Dec 12 14:18:44 2022 -0800 Merge tag 'x86_sgx_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 sgx updates from Dave Hansen: "The biggest deal in this series is support for a new hardware feature that allows enclaves to detect and mitigate single-stepping attacks. There's also a minor performance tweak and a little piece of the kmap_atomic() -> kmap_local() transition. Summary: - Introduce a new SGX feature (Asynchrounous Exit Notification) for bare-metal enclaves and KVM guests to mitigate single-step attacks - Increase batching to speed up enclave release - Replace kmap/kunmap_atomic() calls" * tag 'x86_sgx_for_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Replace kmap/kunmap_atomic() calls KVM/VMX: Allow exposing EDECCSSA user leaf function to KVM guest x86/sgx: Allow enclaves to use Asynchrounous Exit Notification x86/sgx: Reduce delay and interference of enclave release commit c1f0fcd85d3d66f002fc1a4986363840fcca766d Merge: 691806e977a3a f04facfb993de Author: Linus Torvalds Date: Mon Dec 12 13:55:31 2022 -0800 Merge tag 'cxl-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl updates from Dan Williams: "Compute Express Link (CXL) updates for 6.2. While it may seem backwards, the CXL update this time around includes some focus on CXL 1.x enabling where the work to date had been with CXL 2.0 (VH topologies) in mind. First generation CXL can mostly be supported via BIOS, similar to DDR, however it became clear there are use cases for OS native CXL error handling and some CXL 3.0 endpoint features can be deployed on CXL 1.x hosts (Restricted CXL Host (RCH) topologies). So, this update brings RCH topologies into the Linux CXL device model. In support of the ongoing CXL 2.0+ enabling two new core kernel facilities are added. One is the ability for the kernel to flag collisions between userspace access to PCI configuration registers and kernel accesses. This is brought on by the PCIe Data-Object-Exchange (DOE) facility, a hardware mailbox over config-cycles. The other is a cpu_cache_invalidate_memregion() API that maps to wbinvd_on_all_cpus() on x86. To prevent abuse it is disabled in guest VMs and architectures that do not support it yet. The CXL paths that need it, dynamic memory region creation and security commands (erase / unlock), are disabled when it is not present. As for the CXL 2.0+ this cycle the subsystem gains support Persistent Memory Security commands, error handling in response to PCIe AER notifications, and support for the "XOR" host bridge interleave algorithm. Summary: - Add the cpu_cache_invalidate_memregion() API for cache flushing in response to physical memory reconfiguration, or memory-side data invalidation from operations like secure erase or memory-device unlock. - Add a facility for the kernel to warn about collisions between kernel and userspace access to PCI configuration registers - Add support for Restricted CXL Host (RCH) topologies (formerly CXL 1.1) - Add handling and reporting of CXL errors reported via the PCIe AER mechanism - Add support for CXL Persistent Memory Security commands - Add support for the "XOR" algorithm for CXL host bridge interleave - Rework / simplify CXL to NVDIMM interactions - Miscellaneous cleanups and fixes" * tag 'cxl-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (71 commits) cxl/region: Fix memdev reuse check cxl/pci: Remove endian confusion cxl/pci: Add some type-safety to the AER trace points cxl/security: Drop security command ioctl uapi cxl/mbox: Add variable output size validation for internal commands cxl/mbox: Enable cxl_mbox_send_cmd() users to validate output size cxl/security: Fix Get Security State output payload endian handling cxl: update names for interleave ways conversion macros cxl: update names for interleave granularity conversion macros cxl/acpi: Warn about an invalid CHBCR in an existing CHBS entry tools/testing/cxl: Require cache invalidation bypass cxl/acpi: Fail decoder add if CXIMS for HBIG is missing cxl/region: Fix spelling mistake "memergion" -> "memregion" cxl/regs: Fix sparse warning cxl/acpi: Set ACPI's CXL _OSC to indicate RCD mode support tools/testing/cxl: Add an RCH topology cxl/port: Add RCD endpoint port enumeration cxl/mem: Move devm_cxl_add_endpoint() from cxl_core to cxl_mem tools/testing/cxl: Add XOR Math support to cxl_test cxl/acpi: Support CXL XOR Interleave Math (CXIMS) ... commit 691806e977a3a64895bd891878ed726cdbd282c0 Merge: 456ed864fd907 75b15aa0d83ec Author: Linus Torvalds Date: Mon Dec 12 13:45:21 2022 -0800 Merge tag 'thermal-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These include thermal core fixes to protect thermal device operations against thermal device removal, other thermal core fixes and updates of Intel thermal control drivers. Specifics: - Fix race conditions related to thermal device operations that are not protected against thermal device removal (Guenter Roeck) - Fix error code in __thermal_cooling_device_register() (Dan Carpenter) - Validate new cooling device state (coming from user space) in cur_state_store() and reuse the max_state value from cooling device structure in the sysfs interface (Viresh Kumar) - Fix some possible name leaks in error paths in the thermal control core code (Yang Yingliang) - Detect TCC lock bit set in the intel_tcc_cooling driver and make it refuse to update the TCC offset in that case (Zhang Rui) - Add TCC cooling support for RaptorLake-S (Zhang Rui) - Prevent accidental clearing of HFI status by one of the other drivers using the same status register (Srinivas Pandruvada) - Protect clearing of thermal status bits in Intel thermal control drivers (Srinivas Pandruvada) - Allow the HFI thermal control driver to ACK an HFI event for the previously observed timestamp (Srinivas Pandruvada) - Remove a pointless die_id check from the HFI thermal driver and adjust the definition a data structure used by it (Ricardo Neri)" * tag 'thermal-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: hfi: Remove a pointless die_id check thermal: core: fix some possible name leaks in error paths thermal: intel: hfi: ACK HFI for the same timestamp thermal: intel: Protect clearing of thermal status bits thermal: intel: Prevent accidental clearing of HFI status thermal/core: Protect thermal device operations against thermal device removal thermal/core: Remove thermal_zone_set_trips() thermal/core: Protect sysfs accesses to thermal operations with thermal zone mutex thermal/core: Protect hwmon accesses to thermal operations with thermal zone mutex thermal/core: Introduce locked version of thermal_zone_device_update thermal/core: Move parameter validation from __thermal_zone_get_temp to thermal_zone_get_temp thermal/core: Ensure that thermal device is registered in thermal_zone_get_temp thermal/core: Delete device under thermal device zone lock thermal/core: Destroy thermal zone device mutex in release function thermal: intel: intel_tcc_cooling: Add TCC cooling support for RaptorLake-S thermal: intel: intel_tcc_cooling: Detect TCC lock bit thermal: intel: hfi: Improve the type of hfi_features::nr_table_pages thermal/core: fix error code in __thermal_cooling_device_register() thermal: sysfs: Reuse cdev->max_state thermal: Validate new state in cur_state_store() commit 456ed864fd907d5f5484c7c4795da212537842fe Merge: 045e222d0a9dc bee74dcbd3908 Author: Linus Torvalds Date: Mon Dec 12 13:38:17 2022 -0800 Merge tag 'acpi-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and PNP updates from Rafael Wysocki: "These include new code (for instance, support for the FFH address space type and support for new firmware data structures in ACPICA), some new quirks (mostly related to backlight handling and I2C enumeration), a number of fixes and a fair amount of cleanups all over. Specifics: - Update the ACPICA code in the kernel to the 20221020 upstream version and fix a couple of issues in it: - Make acpi_ex_load_op() match upstream implementation (Rafael Wysocki) - Add support for loong_arch-specific APICs in MADT (Huacai Chen) - Add support for fixed PCIe wake event (Huacai Chen) - Add EBDA pointer sanity checks (Vit Kabele) - Avoid accessing VGA memory when EBDA < 1KiB (Vit Kabele) - Add CCEL table support to both compiler/disassembler (Kuppuswamy Sathyanarayanan) - Add a couple of new UUIDs to the known UUID list (Bob Moore) - Add support for FFH Opregion special context data (Sudeep Holla) - Improve warning message for "invalid ACPI name" (Bob Moore) - Add support for CXL 3.0 structures (CXIMS & RDPAS) in the CEDT table (Alison Schofield) - Prepare IORT support for revision E.e (Robin Murphy) - Finish support for the CDAT table (Bob Moore) - Fix error code path in acpi_ds_call_control_method() (Rafael Wysocki) - Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao) - Update the version of the ACPICA code in the kernel (Bob Moore) - Use ZERO_PAGE(0) instead of empty_zero_page in the ACPI device enumeration code (Giulio Benetti) - Change the return type of the ACPI driver remove callback to void and update its users accordingly (Dawei Li) - Add general support for FFH address space type and implement the low- level part of it for ARM64 (Sudeep Holla) - Fix stale comments in the ACPI tables parsing code and make it print more messages related to MADT (Hanjun Guo, Huacai Chen) - Replace invocations of generic library functions with more kernel- specific counterparts in the ACPI sysfs interface (Christophe JAILLET, Xu Panda) - Print full name paths of ACPI power resource objects during enumeration (Kane Chen) - Eliminate a compiler warning regarding a missing function prototype in the ACPI power management code (Sudeep Holla) - Fix and clean up the ACPI processor driver (Rafael Wysocki, Li Zhong, Colin Ian King, Sudeep Holla) - Add quirk for the HP Pavilion Gaming 15-cx0041ur to the ACPI EC driver (Mia Kanashi) - Add some mew ACPI backlight handling quirks and update some existing ones (Hans de Goede) - Make the ACPI backlight driver prefer the native backlight control over vendor backlight control when possible (Hans de Goede) - Drop unsetting ACPI APEI driver data on remove (Uwe Kleine-König) - Use xchg_release() instead of cmpxchg() for updating new GHES cache slots (Ard Biesheuvel) - Clean up the ACPI APEI code (Sudeep Holla, Christophe JAILLET, Jay Lu) - Add new I2C device enumeration quirks for Medion Lifetab S10346 and Lenovo Yoga Tab 3 Pro (YT3-X90F) (Hans de Goede) - Make the ACPI battery driver notify user space about adding new battery hooks and removing the existing ones (Armin Wolf) - Modify the pfr_update and pfr_telemetry drivers to use ACPI_FREE() for freeing acpi_object structures to help diagnostics (Wang ShaoBo) - Make the ACPI fan driver use sysfs_emit_at() in its sysfs interface code (ye xingchen) - Fix the _FIF package extraction failure handling in the ACPI fan driver (Hanjun Guo) - Fix the PCC mailbox handling error code path (Huisong Li) - Avoid using PCC Opregions if there is no platform interrupt allocated for this purpose (Huisong Li) - Use sysfs_emit() instead of scnprintf() in the ACPI PAD driver and CPPC library (ye xingchen) - Fix some kernel-doc issues in the ACPI GSI processing code (Xiongfeng Wang) - Fix name memory leak in pnp_alloc_dev() (Yang Yingliang) - Do not disable PNP devices on suspend when they cannot be re-enabled on resume (Hans de Goede) - Clean up the ACPI thermal driver a bit (Rafael Wysocki)" * tag 'acpi-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (67 commits) ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 ACPI: APEI: EINJ: Refactor available_error_type_show() ACPI: APEI: EINJ: Fix formatting errors ACPI: processor: perflib: Adjust acpi_processor_notify_smm() return value ACPI: processor: perflib: Rearrange acpi_processor_notify_smm() ACPI: processor: perflib: Rearrange unregistration routine ACPI: processor: perflib: Drop redundant parentheses ACPI: processor: perflib: Adjust white space ACPI: processor: idle: Drop unnecessary statements and parens ACPI: thermal: Adjust critical.flags.valid check ACPI: fan: Convert to use sysfs_emit_at() API ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() ACPI: battery: Call power_supply_changed() when adding hooks ACPI: use sysfs_emit() instead of scnprintf() ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Tab 3 Pro (YT3-X90F) ACPI: APEI: Remove a useless include PNP: Do not disable devices on suspend when they cannot be re-enabled on resume ACPI: processor: Silence missing prototype warnings ACPI: processor_idle: Silence missing prototype warnings ACPI: PM: Silence missing prototype warning ... commit 045e222d0a9dcec152abe0633f538cafd965b12b Merge: 631aa74442317 ed6a00471dd44 Author: Linus Torvalds Date: Mon Dec 12 13:19:07 2022 -0800 Merge tag 'pm-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These include two new drivers (cpufreq driver for Apple SoC CPU P-states and the SCMI Powercap based power capping driver), other new hardware support and driver extensions (Qualcomm cpufreq driver and its DT bindings, TI cpufreq driver, intel_pstate, intel-uncore-freq), a bunch of fixes and cleanups all over and a cpupower utility update including new features related to RAPL support. Specifics: - Fix nasty and hard to debug race condition introduced by mistake in the runtime PM core code and clean up that code somewhat on top of the fix (Rafael Wysocki) - Generalize of_perf_domain_get_sharing_cpumask phandle format (Hector Martin) - Add new cpufreq driver for Apple SoC CPU P-states (Hector Martin) - Update Qualcomm cpufreq driver (Manivannan Sadhasivam, Chen Hui): - CPU clock provider support - Generic cleanups or reorganization - Potential memleak fix - Fix of the return value of cpufreq_driver->get() - Update Qualcomm cpufreq driver's DT bindings (Manivannan Sadhasivam, Rob Herring, Melody Olvera): - Support for CPU clock provider - Missing cache-related properties fixes - Support for QDU1000/QRU1000 - Add support for ti,am625 SoC and enable build of ti-cpufreq for ARCH_K3 (Dave Gerlach, and Vibhore Vardhan) - Use flexible array to simplify memory allocation in the tegra186 cpufreq driver (Christophe JAILLET) - Convert cpufreq statistics code to use sysfs_emit_at() (ye xingchen) - Allow intel_pstate to use no-HWP mode on Sapphire Rapids (Giovanni Gherdovich) - Add missing pci_dev_put() to the amd_freq_sensitivity cpufreq driver (Xiongfeng Wang) - Initialize the kobj_unregister completion before calling kobject_init_and_add() in the cpufreq core code (Yongqiang Liu) - Defer setting boost MSRs in the ACPI cpufreq driver (Stuart Hayes, Nathan Chancellor) - Make intel_pstate accept initial EPP value of 0x80 (Srinivas Pandruvada) - Make read-only array sys_clk_src in the SPEAr cpufreq driver static (Colin Ian King) - Make array speeds in the longhaul cpufreq driver static (Colin Ian King) - Use str_enabled_disabled() helper in the ACPI cpufreq driver (Andy Shevchenko) - Drop a reference to CVS from cpufreq documentation (Conghui Wang) - Improve kernel messages printed by the PSCI cpuidle driver (Ulf Hansson) - Make the DT cpuidle driver return the correct number of parsed idle states, clean it up and clarify a comment in it (Ulf Hansson) - Modify the tasks freezing code to avoid using pr_cont() and refine an error message printed by it (Rafael Wysocki) - Make the hibernation core code complain about memory map mismatches during resume to help diagnostics (Xueqin Luo) - Fix mistake in a kerneldoc comment in the hibernation code (xiongxin) - Reverse the order of performance and enabling operations in the generic power domains code (Abel Vesa) - Power off[on] domains in hibernate .freeze[thaw]_noirq hook of in the generic power domains code (Abel Vesa) - Consolidate genpd_restore_noirq() and genpd_resume_noirq() (Shawn Guo) - Pass generic PM noirq hooks to genpd_finish_suspend() (Shawn Guo) - Drop generic power domain status manipulation during hibernate restore (Shawn Guo) - Fix compiler warnings with make W=1 in the idle_inject power capping driver (Srinivas Pandruvada) - Use kstrtobool() instead of strtobool() in the power capping sysfs interface (Christophe JAILLET) - Add SCMI Powercap based power capping driver (Cristian Marussi) - Add Emerald Rapids support to the intel-uncore-freq driver (Artem Bityutskiy) - Repair slips in kernel-doc comments in the generic notifier code (Lukas Bulwahn) - Fix several DT issues in the OPP library reorganize code around opp-microvolt- DT property (Viresh Kumar) - Allow any of opp-microvolt, opp-microamp, or opp-microwatt properties to be present without the others present (James Calligeros) - Fix clock-latency-ns property in DT example (Serge Semin) - Add a private governor_data for devfreq governors (Kant Fan) - Reorganize devfreq code to use device_match_of_node() and devm_platform_get_and_ioremap_resource() instead of open coding them (ye xingchen, Minghao Chi) - Make cpupower choose base_cpu to display default cpupower details instead of picking CPU 0 (Saket Kumar Bhaskar) - Add Georgian translation to cpupower documentation (Zurab Kargareteli) - Introduce powercap intel-rapl library, powercap-info command, and RAPL monitor into cpupower (Thomas Renninger)" * tag 'pm-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (64 commits) PM: runtime: Adjust white space in the core code cpufreq: Remove CVS version control contents from documentation cpufreq: stats: Convert to use sysfs_emit_at() API cpufreq: ACPI: Only set boost MSRs on supported CPUs PM: sleep: Refine error message in try_to_freeze_tasks() PM: sleep: Avoid using pr_cont() in the tasks freezing code PM: runtime: Relocate rpm_callback() right after __rpm_callback() PM: runtime: Do not call __rpm_callback() from rpm_idle() PM / devfreq: event: use devm_platform_get_and_ioremap_resource() PM / devfreq: event: Use device_match_of_node() PM / devfreq: Use device_match_of_node() powercap: idle_inject: Fix warnings with make W=1 PM: hibernate: Complain about memory map mismatches during resume dt-bindings: cpufreq: cpufreq-qcom-hw: Add QDU1000/QRU1000 cpufreq cpufreq: tegra186: Use flexible array to simplify memory allocation cpupower: rapl monitor - shows the used power consumption in uj for each rapl domain cpupower: Introduce powercap intel-rapl library and powercap-info command cpupower: Add Georgian translation cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP mode cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() ... commit 054be257f28ca8eeb8e3620766501b81ceb4b293 Author: Mark Brown Date: Wed Dec 7 13:03:02 2022 +0000 Documentation: dev-tools: Clarify requirements for result description Currently the KTAP specification says that a test result line is [][ # [] []] and the description of a test can be "any sequence of words (can't include #)" which specifies that there may be more than one word but does not specify anything other than those words which might be used to separate the words which probably isn't what we want. Given that practically we have tests using a range of separators for words including combinations of spaces and combinations of other symbols like underscores or punctuation let's just clarify that the description can contain any character other than # (marking the start of the directive/diagnostic) or newline (marking the end of this test result). Signed-off-by: Mark Brown Reviewed-by: Kees Cook Reviewed-by: David Gow Signed-off-by: Shuah Khan commit b11e51dd70947107fa4076c6286dce301671afc1 Author: Rae Moar Date: Wed Dec 7 01:40:24 2022 +0000 apparmor: test: make static symbols visible during kunit testing Use macros, VISIBLE_IF_KUNIT and EXPORT_SYMBOL_IF_KUNIT, to allow static symbols to be conditionally set to be visible during apparmor_policy_unpack_test, which removes the need to include the testing file in the implementation file. Change the namespace of the symbols that are now conditionally visible (by adding the prefix aa_) to avoid confusion with symbols of the same name. Allow the test to be built as a module and namespace the module name from policy_unpack_test to apparmor_policy_unpack_test to improve clarity of the module name. Provide an example of how static symbols can be dealt with in testing. Signed-off-by: Rae Moar Reviewed-by: David Gow Acked-by: John Johansen Signed-off-by: Shuah Khan commit 9c988fae6f6ae3224a568ab985881b66bb50c9ec Author: Rae Moar Date: Wed Dec 7 01:40:23 2022 +0000 kunit: add macro to allow conditionally exposing static symbols to tests Create two macros: VISIBLE_IF_KUNIT - A macro that sets symbols to be static if CONFIG_KUNIT is not enabled. Otherwise if CONFIG_KUNIT is enabled there is no change to the symbol definition. EXPORT_SYMBOL_IF_KUNIT(symbol) - Exports symbol into EXPORTED_FOR_KUNIT_TESTING namespace only if CONFIG_KUNIT is enabled. Must use MODULE_IMPORT_NS(EXPORTED_FOR_KUNIT_TESTING) in test file in order to use symbols. Signed-off-by: Rae Moar Reviewed-by: John Johansen Reviewed-by: David Gow Signed-off-by: Shuah Khan commit c2bb92bc4ea13842fdd27819c0d5b48df2b86ea5 Author: Daniel Latypov Date: Wed Nov 30 10:54:19 2022 -0800 kunit: tool: make parser preserve whitespace when printing test log Currently, kunit_parser.py is stripping all leading whitespace to make parsing easier. But this means we can't accurately show kernel output for failing tests or when the kernel crashes. Embarassingly, this affects even KUnit's own output, e.g. [13:40:46] Expected 2 + 1 == 2, but [13:40:46] 2 + 1 == 3 (0x3) [13:40:46] not ok 1 example_simple_test [13:40:46] [FAILED] example_simple_test After this change, here's what the output in context would look like [13:40:46] =================== example (4 subtests) =================== [13:40:46] # example_simple_test: initializing [13:40:46] # example_simple_test: EXPECTATION FAILED at lib/kunit/kunit-example-test.c:29 [13:40:46] Expected 2 + 1 == 2, but [13:40:46] 2 + 1 == 3 (0x3) [13:40:46] [FAILED] example_simple_test [13:40:46] [SKIPPED] example_skip_test [13:40:46] [SKIPPED] example_mark_skipped_test [13:40:46] [PASSED] example_all_expect_macros_test [13:40:46] # example: initializing suite [13:40:46] # example: pass:1 fail:1 skip:2 total:4 [13:40:46] # Totals: pass:1 fail:1 skip:2 total:4 [13:40:46] ===================== [FAILED] example ===================== This example shows one minor cosmetic defect this approach has. The test counts lines prevent us from dedenting the suite-level output. But at the same time, any form of non-KUnit output would do the same unless it happened to be indented as well. Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit a81fe7ecf717e5ae16892c282378ca380d4e99c9 Author: David Gow Date: Wed Dec 7 12:33:19 2022 +0800 Documentation: kunit: Fix "How Do I Use This" / "Next Steps" sections The "How Do I Use This" section of index.rst and "Next Steps" section of start.rst were just copies of the table of contents, and therefore weren't really useful either when looking a sphinx generated output (which already had the TOC visible) or when reading the source (where it's just a list of files that ls could give you). Instead, provide a small number of concrete next steps, and a bit more description about what the pages contain. This also removes the broken reference to 'tips.rst', which was previously removed. Fixed git am whitespace complaints during commit: Shuah Khan Fixes: 4399c737a97d ("Documentation: kunit: Remove redundant 'tips.rst' page") Signed-off-by: David Gow Reviewed-by: Sadiya Kazi Reviewed-by: Bagas Sanjaya Signed-off-by: Shuah Khan commit 5937e0c04afc7d4b7b737fda93316ba4b74183c0 Author: Daniel Latypov Date: Mon Nov 28 16:12:34 2022 -0800 kunit: tool: don't include KTAP headers and the like in the test log We print the "test log" on failure. This is meant to be all the kernel output that happened during the test. But we also include the special KTAP lines in it, which are often redundant. E.g. we include the "not ok" line in the log, right before we print that the test case failed... [13:51:48] Expected 2 + 1 == 2, but [13:51:48] 2 + 1 == 3 (0x3) [13:51:48] not ok 1 example_simple_test [13:51:48] [FAILED] example_simple_test More full example after this patch: [13:51:48] =================== example (4 subtests) =================== [13:51:48] # example_simple_test: initializing [13:51:48] # example_simple_test: EXPECTATION FAILED at lib/kunit/kunit-example-test.c:29 [13:51:48] Expected 2 + 1 == 2, but [13:51:48] 2 + 1 == 3 (0x3) [13:51:48] [FAILED] example_simple_test Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 6c738b52316c58ae8a87abf0907f87a7b5e7a109 Author: Rae Moar Date: Wed Nov 23 18:25:58 2022 +0000 kunit: improve KTAP compliance of KUnit test output Change KUnit test output to better comply with KTAP v1 specifications found here: https://kernel.org/doc/html/latest/dev-tools/ktap.html. 1) Use "KTAP version 1" instead of "TAP version 14" as test output header 2) Remove '-' between test number and test name on test result lines 2) Add KTAP version lines to each subtest header as well Note that the new KUnit output still includes the “# Subtest” line now located after the KTAP version line. This does not completely match the KTAP v1 spec but since it is classified as a diagnostic line, it is not expected to be disruptive or break any existing parsers. This “# Subtest” line comes from the TAP 14 spec (https://testanything.org/tap-version-14-specification.html) and it is used to define the test name before the results. Original output: TAP version 14 1..1 # Subtest: kunit-test-suite 1..3 ok 1 - kunit_test_1 ok 2 - kunit_test_2 ok 3 - kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 - kunit-test-suite New output: KTAP version 1 1..1 KTAP version 1 # Subtest: kunit-test-suite 1..3 ok 1 kunit_test_1 ok 2 kunit_test_2 ok 3 kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 kunit-test-suite Signed-off-by: Rae Moar Reviewed-by: Daniel Latypov Reviewed-by: David Gow Tested-by: Anders Roxell Signed-off-by: Shuah Khan commit 434498a6bee3db729dbdb7f131f3506f4dca85e8 Author: Rae Moar Date: Wed Nov 23 18:25:57 2022 +0000 kunit: tool: parse KTAP compliant test output Change the KUnit parser to be able to parse test output that complies with the KTAP version 1 specification format found here: https://kernel.org/doc/html/latest/dev-tools/ktap.html. Ensure the parser is able to parse tests with the original KUnit test output format as well. KUnit parser now accepts any of the following test output formats: Original KUnit test output format: TAP version 14 1..1 # Subtest: kunit-test-suite 1..3 ok 1 - kunit_test_1 ok 2 - kunit_test_2 ok 3 - kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 - kunit-test-suite KTAP version 1 test output format: KTAP version 1 1..1 KTAP version 1 1..3 ok 1 kunit_test_1 ok 2 kunit_test_2 ok 3 kunit_test_3 ok 1 kunit-test-suite New KUnit test output format (changes made in the next patch of this series): KTAP version 1 1..1 KTAP version 1 # Subtest: kunit-test-suite 1..3 ok 1 kunit_test_1 ok 2 kunit_test_2 ok 3 kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 kunit-test-suite Signed-off-by: Rae Moar Reviewed-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 909c6475d568826be377893cf5abb7cde5877230 Author: David Gow Date: Fri Nov 25 16:43:06 2022 +0800 mm: slub: test: Use the kunit_get_current_test() function Use the newly-added function kunit_get_current_test() instead of accessing current->kunit_test directly. This function uses a static key to return more quickly when KUnit is enabled, but no tests are actively running. There should therefore be a negligible performance impact to enabling the slub KUnit tests. Other than the performance improvement, this should be a no-op. Cc: Oliver Glitta Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Christoph Lameter Cc: Vlastimil Babka Cc: David Rientjes Cc: Andrew Morton Signed-off-by: David Gow Acked-by: Vlastimil Babka Acked-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Shuah Khan commit 91e93592219f74c4d5cd4f27006d726ac86ae15d Author: David Gow Date: Fri Nov 25 16:43:05 2022 +0800 kunit: Use the static key when retrieving the current test In order to detect if a KUnit test is running, and to access its context, the 'kunit_test' member of the current task_struct is used. Usually, this is accessed directly or via the kunit_fail_current_task() function. In order to speed up the case where no test is running, add a wrapper, kunit_get_current_test(), which uses the static key to fail early. Equally, Speed up kunit_fail_current_test() by using the static key. This should make it convenient for code to call this unconditionally in fakes or error paths, without worrying that this will slow the code down significantly. If CONFIG_KUNIT=n (or m), this compiles away to nothing. If CONFIG_KUNIT=y, it will compile down to a NOP (on most architectures) if no KUnit test is currently running. Note that kunit_get_current_test() does not work if KUnit is built as a module. This mirrors the existing restriction on kunit_fail_current_test(). Note that the definition of kunit_fail_current_test() still wraps an empty, inline function if KUnit is not built-in. This is to ensure that the printf format string __attribute__ will still work. Also update the documentation to suggest users use the new kunit_get_current_test() function, update the example, and to describe the behaviour when KUnit is disabled better. Cc: Jonathan Corbet Cc: Sadiya Kazi Signed-off-by: David Gow Reviewed-by: Daniel Latypov Signed-off-by: Shuah Khan commit 908d0c177bbc7c34ab9129c6f2bcd87487115632 Author: David Gow Date: Fri Nov 25 16:43:04 2022 +0800 kunit: Provide a static key to check if KUnit is actively running tests KUnit does a few expensive things when enabled. This hasn't been a problem because KUnit was only enabled on test kernels, but with a few people enabling (but not _using_) KUnit on production systems, we need a runtime way of handling this. Provide a 'kunit_running' static key (defaulting to false), which allows us to hide any KUnit code behind a static branch. This should reduce the performance impact (on other code) of having KUnit enabled to a single NOP when no tests are running. Note that, while it looks unintuitive, tests always run entirely within __kunit_test_suites_init(), so it's safe to decrement the static key at the end of this function, rather than in __kunit_test_suites_exit(), which is only there to clean up results in debugfs. Signed-off-by: David Gow Reviewed-by: Daniel Latypov Signed-off-by: Shuah Khan commit 309e22effb741a8c65131a2694a49839fd685a27 Author: Daniel Latypov Date: Mon Nov 21 11:55:26 2022 -0800 kunit: tool: make --json do nothing if --raw_ouput is set When --raw_output is set (to any value), we don't actually parse the test results. So asking to print the test results as json doesn't make sense. We internally create a fake test with one passing subtest, so --json would actually print out something misleading. This patch: * Rewords the flag descriptions so hopefully this is more obvious. * Also updates --raw_output's description to note the default behavior is to print out only "KUnit" results (actually any KTAP results) * also renames and refactors some related logic for clarity (e.g. test_result => test, it's a kunit_parser.Test object). Notably, this patch does not make it an error to specify --json and --raw_output together. This is an edge case, but I know of at least one wrapper around kunit.py that always sets --json. You'd never be able to use --raw_output with that wrapper. Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 0a7d5c30b7f02887319a1382fbb8dc1c8250fe2c Author: Daniel Latypov Date: Thu Nov 10 19:18:55 2022 -0800 kunit: tool: tweak error message when no KTAP found We currently tell people we "couldn't find any KTAP output" with no indication as to what this might mean. After this patch, we get: $ ./tools/testing/kunit/kunit.py parse /dev/null ============================================================ [ERROR] Test: : Could not find any KTAP output. Did any KUnit tests run? ============================================================ Testing complete. Ran 0 tests: errors: 1 Note: we could try and generate a more verbose message like > Please check .kunit/test.log to see the raw kernel output. or the like, but we'd need to know what the build dir was to know where test.log actually lives. This patch tries to make a more minimal improvement. Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 34c68f432c67f0d9bd4e64cf0929f399c6a4e1b0 Author: Daniel Latypov Date: Wed Nov 9 13:20:32 2022 -0800 kunit: remove KUNIT_INIT_MEM_ASSERTION macro Commit 870f63b7cd78 ("kunit: eliminate KUNIT_INIT_*_ASSERT_STRUCT macros") removed all the other macros of this type. But it raced with commit b8a926bea8b1 ("kunit: Introduce KUNIT_EXPECT_MEMEQ and KUNIT_EXPECT_MEMNEQ macros"), which added another instance. Remove KUNIT_INIT_MEM_ASSERTION and just use the generic KUNIT_INIT_ASSERT macro instead. Rename the `size` arg to avoid conflicts by appending a "_" (like we did in the previous commit). Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit a5b9abaa6049340a93a852b1d6d069064fddb624 Author: David Gow Date: Fri Nov 11 10:29:06 2022 -0800 Documentation: kunit: Remove redundant 'tips.rst' page The contents of 'tips.rst' was mostly included in 'usage.rst' way back in commit 953574390634 ("Documentation: KUnit: Rework writing page to focus on writing tests"), but the tips page remained behind as well. The parent patches in this series fill in the gaps, so now 'tips.rst' is redundant. Therefore, delete 'tips.rst'. While I regret breaking any links to 'tips' which might exist externally, it's confusing to have two subtly different versions of the same content around. Signed-off-by: David Gow Signed-off-by: Daniel Latypov Reviewed-by: Sadiya Kazi Signed-off-by: Shuah Khan commit ec0a42a17e463ee5b1ebd2d60337e8ae8e5ace2b Author: Daniel Latypov Date: Fri Nov 11 10:29:05 2022 -0800 Documentation: KUnit: reword description of assertions The existing wording implies that kunit_kmalloc_array() is "the method under test". We're actually testing the sort() function in that example. This is because the example was changed in commit 953574390634 ("Documentation: KUnit: Rework writing page to focus on writing tests"), but the wording was not. Also add a `note` telling people they can use the KUNIT_ASSERT_EQ() macros from any function. Some users might be coming from a framework like gUnit where that'll compile but silently do the wrong thing. Signed-off-by: Daniel Latypov Reviewed-by: Sadiya Kazi Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 65c48a48ead042856525b92cedf673d2bf5bdfc9 Author: Daniel Latypov Date: Fri Nov 11 10:29:04 2022 -0800 Documentation: KUnit: make usage.rst a superset of tips.rst, remove duplication usage.rst had most of the content of the tips.rst page copied over. But it's missing https://www.kernel.org/doc/html/v6.0/dev-tools/kunit/tips.html#customizing-error-messages Copy it over so we can retire tips.rst w/o losing content. And in that process, it also gained a duplicate section about how KUNIT_ASSERT_*() exit the test case early. Remove that. Signed-off-by: Daniel Latypov Reviewed-by: Sadiya Kazi Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 697365c086791372945037557f99bc164e2db855 Author: Daniel Latypov Date: Fri Sep 30 17:26:37 2022 -0700 kunit: eliminate KUNIT_INIT_*_ASSERT_STRUCT macros These macros exist because passing an initializer list to other macros is hard. The goal of these macros is to generate a line like struct $ASSERT_TYPE __assertion = $APPROPRIATE_INITIALIZER; e.g. struct kunit_unary_assertion __assertion = { .condition = "foo()", .expected_true = true }; But the challenge is you can't pass `{.condition=..., .expect_true=...}` as a macro argument, since the comma means you're actually passing two arguments, `{.condition=...` and `.expect_true=....}`. So we'd made custom macros for each different initializer-list shape. But we can work around this with the following generic macro #define KUNIT_INIT_ASSERT(initializers...) { initializers } Note: this has the downside that we have to rename some macros arguments to not conflict with the struct field names (e.g. `expected_true`). It's a bit gross, but probably worth reducing the # of macros. Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 101e32a025da386ba6f6efbfe3e75b6ec5a358aa Author: Daniel Latypov Date: Thu Nov 3 10:47:40 2022 -0700 kunit: tool: remove redundant file.close() call in unit test We're using a `with` block above, so the file object is already closed. Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 05d9d2c3ee1e4b587f71455f6d3d1493289204ff Author: Daniel Latypov Date: Thu Nov 3 10:47:39 2022 -0700 kunit: tool: unit tests all check parser errors, standardize formatting a bit Let's verify that the parser isn't reporting any errors for valid inputs. This change also * does result.status checking on one line * makes sure we consistently do it outside of the `with` block Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit f473dd9488d910aab109e8c6a2e4181125ca322a Author: Daniel Latypov Date: Thu Nov 3 10:47:38 2022 -0700 kunit: tool: make TestCounts a dataclass Since we're using Python 3.7+, we can use dataclasses to tersen the code. It also lets us create pre-populated TestCounts() objects and compare them in our unit test. (Before, you could only create empty ones). Signed-off-by: Daniel Latypov Reviewed-by: David Gow Signed-off-by: Shuah Khan commit a38a211e9e0ca20f5d65307c98571f40f78ad396 Merge: 84698dad0641f d3295fee3c756 Author: Jakub Kicinski Date: Mon Dec 12 13:11:25 2022 -0800 Merge branch 'mptcp-fix-ipv6-reqsk-ops-and-some-netlink-error-codes' Mat Martineau says: ==================== mptcp: Fix IPv6 reqsk ops and some netlink error codes Patch 1 adds some missing error status values for MPTCP path management netlink commands with invalid attributes. Patches 2-4 make IPv6 subflows use the correct request_sock_ops structure and IPv6-specific destructor. The first patch in this group is a prerequisite change that simplifies the last two patches. ==================== Link: https://lore.kernel.org/r/20221210002810.289674-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit d3295fee3c756ece33ac0d935e172e68c0a4161b Author: Matthieu Baerts Date: Fri Dec 9 16:28:10 2022 -0800 mptcp: use proper req destructor for IPv6 Before, only the destructor from TCP request sock in IPv4 was called even if the subflow was IPv6. It is important to use the right destructor to avoid memory leaks with some advanced IPv6 features, e.g. when the request socks contain specific IPv6 options. Fixes: 79c0949e9a09 ("mptcp: Add key generation and token tree") Reviewed-by: Mat Martineau Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 34b21d1ddc8ace77a8fa35c1b1e06377209e0dae Author: Matthieu Baerts Date: Fri Dec 9 16:28:09 2022 -0800 mptcp: dedicated request sock for subflow in v6 tcp_request_sock_ops structure is specific to IPv4. It should then not be used with MPTCP subflows on top of IPv6. For example, it contains the 'family' field, initialised to AF_INET. This 'family' field is used by TCP FastOpen code to generate the cookie but also by TCP Metrics, SELinux and SYN Cookies. Using the wrong family will not lead to crashes but displaying/using/checking wrong things. Note that 'send_reset' callback from request_sock_ops structure is used in some error paths. It is then also important to use the correct one for IPv4 or IPv6. The slab name can also be different in IPv4 and IPv6, it will be used when printing some log messages. The slab pointer will anyway be the same because the object size is the same for both v4 and v6. A BUILD_BUG_ON() has also been added to make sure this size is the same. Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections") Reviewed-by: Mat Martineau Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 3fff88186f047627bb128d65155f42517f8e448f Author: Matthieu Baerts Date: Fri Dec 9 16:28:08 2022 -0800 mptcp: remove MPTCP 'ifdef' in TCP SYN cookies To ease the maintenance, it is often recommended to avoid having #ifdef preprocessor conditions. Here the section related to CONFIG_MPTCP was quite short but the next commit needs to add more code around. It is then cleaner to move specific MPTCP code to functions located in net/mptcp directory. Now that mptcp_subflow_request_sock_ops structure can be static, it can also be marked as "read only after init". Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit e0fe1123ab2b07d2cd5475660bd0b4e6993ffaa7 Author: Wei Yongjun Date: Fri Dec 9 16:28:07 2022 -0800 mptcp: netlink: fix some error return code Fix to return negative error code -EINVAL from some error handling case instead of 0, as done elsewhere in those functions. Fixes: 9ab4807c84a4 ("mptcp: netlink: Add MPTCP_PM_CMD_ANNOUNCE") Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Wei Yongjun Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 70be6f322860d322ebcd120cf0c05402ead5c6de Author: Dan Carpenter Date: Thu Dec 8 19:02:17 2022 +0300 vfio/mlx5: error pointer dereference in error handling This code frees the wrong "buf" variable and results in an error pointer dereference. Fixes: 34e2f27143d1 ("vfio/mlx5: Introduce multiple loads") Signed-off-by: Dan Carpenter Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/Y5IKia5SaiVxYmG5@kili Signed-off-by: Alex Williamson commit fe3dd71db2b81c202bc80532bbe0e07238a45ed9 Author: Dan Carpenter Date: Thu Dec 8 19:01:26 2022 +0300 vfio/mlx5: fix error code in mlx5vf_precopy_ioctl() The copy_to_user() function returns the number of bytes remaining to be copied but we want to return a negative error code here. Fixes: 0dce165b1adf ("vfio/mlx5: Introduce vfio precopy ioctl implementation") Signed-off-by: Dan Carpenter Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/Y5IKVknlf5Z5NPtU@kili Signed-off-by: Alex Williamson commit d1f0f50fbbbbca1e3e8157e51934613bf88f6d44 Author: Shang XiaoJing Date: Thu Dec 8 09:33:41 2022 +0800 samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() Add missing pci_disable_device() in fail path of mdpy_fb_probe(). Besides, fix missing release functions in mdpy_fb_remove(). Fixes: cacade1946a4 ("sample: vfio mdev display - guest driver") Signed-off-by: Shang XiaoJing Link: https://lore.kernel.org/r/20221208013341.3999-1-shangxiaojing@huawei.com Signed-off-by: Alex Williamson commit 84698dad0641ffdb7273f3b31664ce32a2e1386c Merge: 5f7d78b2b12a9 fb21cad284891 Author: Jakub Kicinski Date: Mon Dec 12 13:04:54 2022 -0800 Merge branch 'update-joakim-zhang-entries' Florian Fainelli says: ==================== Update Joakim Zhang entries Shawn, since you are the i.MX maintainer I added you and the NXP Linux Team as the de-facto maintainers for those entries, however there may be other people to list, thanks! ==================== Link: https://lore.kernel.org/r/20221209220519.1542872-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit fb21cad28489137a384c25b045d1c5e178f6610b Author: Florian Fainelli Date: Fri Dec 9 14:05:19 2022 -0800 dt-bindings: FEC/i.MX DWMAC and INTMUX maintainer Emails to Joakim Zhang bounce, add Shawn Guo (i.MX architecture maintainer) and the NXP Linux Team exploder email as well as well Wei Wang for FEC and Clark Wang for DWMAC. Acked-by: Krzysztof Kozlowski Signed-off-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 4e81462a45ce7d758eb29ec60126f5793593c6f7 Author: Florian Fainelli Date: Fri Dec 9 14:05:18 2022 -0800 MAINTAINERS: Update NXP FEC maintainer Emails to Joakim Zhang bounce, update the list of maintainers per feedback from Clark Wang and designate Wei Fang as the primary maintainer. Signed-off-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 15eb1621762134bd3a0f81020359b0c7745d1080 Author: Rob Herring Date: Fri Dec 9 11:15:52 2022 -0600 dt-bindings: net: Convert Socionext NetSec Ethernet to DT schema Convert the Socionext NetSec Ethernet binding to DT schema format. Signed-off-by: Rob Herring Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20221209171553.3350583-1-robh@kernel.org Signed-off-by: Jakub Kicinski commit 4e426e2534ce2811380ef09ee2a050779d1b5a29 Author: Taras Chornyi Date: Fri Dec 9 17:45:21 2022 +0200 MAINTAINERS: Update email address for Marvell Prestera Ethernet Switch driver Taras's Marvell email account will be shut down soon so change it to Plvision. Signed-off-by: Taras Chornyi Signed-off-by: Vadym Kochan Link: https://lore.kernel.org/r/20221209154521.1246881-1-vadym.kochan@plvision.eu Signed-off-by: Jakub Kicinski commit 631aa744423173bf921191ba695bbc7c1aabd9e0 Merge: 0a1d4434db5f8 00ed1eabcc3b7 Author: Linus Torvalds Date: Mon Dec 12 13:01:14 2022 -0800 Merge tag 'x86-misc-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Thomas Gleixner: "Updates for miscellaneous x86 areas: - Reserve a new boot loader type for barebox which is usally used on ARM and MIPS, but can also be utilized as EFI payload on x86 to provide watchdog-supervised boot up. - Consolidate the native and compat 32bit signal handling code and split the 64bit version out into a separate source file - Switch the ESPFIX random usage to get_random_long()" * tag 'x86-misc-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/espfix: Use get_random_long() rather than archrandom x86/signal/64: Move 64-bit signal code to its own file x86/signal/32: Merge native and compat 32-bit signal code x86/signal: Add ABI prefixes to frame setup functions x86/signal: Merge get_sigframe() x86: Remove __USER32_DS signal/compat: Remove compat_sigset_t override x86/signal: Remove sigset_t parameter from frame setup functions x86/signal: Remove sig parameter from frame setup functions Documentation/x86/boot: Reserve type_of_loader=13 for barebox commit 80a464d83f08cac5052c7f857fc067b3fe88071d Author: Xu Panda Date: Fri Dec 9 15:38:59 2022 +0800 net: hns3: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/202212091538591375035@zte.com.cn Signed-off-by: Jakub Kicinski commit da05cecc4939c0410d56c29e252998b192756318 Author: Firo Yang Date: Fri Dec 9 13:48:54 2022 +0800 sctp: sysctl: make extra pointers netns aware Recently, a customer reported that from their container whose net namespace is different to the host's init_net, they can't set the container's net.sctp.rto_max to any value smaller than init_net.sctp.rto_min. For instance, Host: sudo sysctl net.sctp.rto_min net.sctp.rto_min = 1000 Container: echo 100 > /mnt/proc-net/sctp/rto_min echo 400 > /mnt/proc-net/sctp/rto_max echo: write error: Invalid argument This is caused by the check made from this'commit 4f3fdf3bc59c ("sctp: add check rto_min and rto_max in sysctl")' When validating the input value, it's always referring the boundary value set for the init_net namespace. Having container's rto_max smaller than host's init_net.sctp.rto_min does make sense. Consider that the rto between two containers on the same host is very likely smaller than it for two hosts. So to fix this problem, as suggested by Marcelo, this patch makes the extra pointers of rto_min, rto_max, pf_retrans, and ps_retrans point to the corresponding variables from the newly created net namespace while the new net namespace is being registered in sctp_sysctl_net_register. Fixes: 4f3fdf3bc59c ("sctp: add check rto_min and rto_max in sysctl") Reviewed-by: Marcelo Ricardo Leitner Reviewed-by: Jakub Kicinski Acked-by: Marcelo Ricardo Leitner Signed-off-by: Firo Yang Link: https://lore.kernel.org/r/20221209054854.23889-1-firo.yang@suse.com Signed-off-by: Jakub Kicinski commit 5f7d78b2b12a9d561f48fa00bab29b40f4616dad Author: Eric Pilmore Date: Thu Dec 8 16:06:59 2022 -0800 ntb_netdev: Use dev_kfree_skb_any() in interrupt context TX/RX callback handlers (ntb_netdev_tx_handler(), ntb_netdev_rx_handler()) can be called in interrupt context via the DMA framework when the respective DMA operations have completed. As such, any calls by these routines to free skb's, should use the interrupt context safe dev_kfree_skb_any() function. Previously, these callback handlers would call the interrupt unsafe version of dev_kfree_skb(). This has not presented an issue on Intel IOAT DMA engines as that driver utilizes tasklets rather than a hard interrupt handler, like the AMD PTDMA DMA driver. On AMD systems, a kernel WARNING message is encountered, which is being issued from skb_release_head_state() due to in_hardirq() being true. Besides the user visible WARNING from the kernel, the other symptom of this bug was that TCP/IP performance across the ntb_netdev interface was very poor, i.e. approximately an order of magnitude below what was expected. With the repair to use dev_kfree_skb_any(), kernel WARNINGs from skb_release_head_state() ceased and TCP/IP performance, as measured by iperf, was on par with expected results, approximately 20 Gb/s on AMD Milan based server. Note that this performance is comparable with Intel based servers. Fixes: 765ccc7bc3d91 ("ntb_netdev: correct skb leak") Fixes: 548c237c0a997 ("net: Add support for NTB virtual ethernet device") Signed-off-by: Eric Pilmore Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20221209000659.8318-1-epilmore@gigaio.com Signed-off-by: Jakub Kicinski commit 9352e7470a1b4edd2fa9d235420ecc7bc3971bdc Merge: 2afc1fbbdab2a 5656374b168c9 Author: Paolo Bonzini Date: Tue Dec 6 12:29:06 2022 -0500 Merge remote-tracking branch 'kvm/queue' into HEAD x86 Xen-for-KVM: * Allow the Xen runstate information to cross a page boundary * Allow XEN_RUNSTATE_UPDATE flag behaviour to be configured * add support for 32-bit guests in SCHEDOP_poll x86 fixes: * One-off fixes for various emulation flows (SGX, VMXON, NRIPS=0). * Reinstate IBPB on emulated VM-Exit that was incorrectly dropped a few years back when eliminating unnecessary barriers when switching between vmcs01 and vmcs02. * Clean up the MSR filter docs. * Clean up vmread_error_trampoline() to make it more obvious that params must be passed on the stack, even for x86-64. * Let userspace set all supported bits in MSR_IA32_FEAT_CTL irrespective of the current guest CPUID. * Fudge around a race with TSC refinement that results in KVM incorrectly thinking a guest needs TSC scaling when running on a CPU with a constant TSC, but no hardware-enumerated TSC frequency. * Advertise (on AMD) that the SMM_CTL MSR is not supported * Remove unnecessary exports Selftests: * Fix an inverted check in the access tracking perf test, and restore support for asserting that there aren't too many idle pages when running on bare metal. * Fix an ordering issue in the AMX test introduced by recent conversions to use kvm_cpu_has(), and harden the code to guard against similar bugs in the future. Anything that tiggers caching of KVM's supported CPUID, kvm_cpu_has() in this case, effectively hides opt-in XSAVE features if the caching occurs before the test opts in via prctl(). * Fix build errors that occur in certain setups (unsure exactly what is unique about the problematic setup) due to glibc overriding static_assert() to a variant that requires a custom message. * Introduce actual atomics for clear/set_bit() in selftests Documentation: * Remove deleted ioctls from documentation * Various fixes commit 8964916d206071b058c6351f88b1966bd58cbde0 Author: Jerry Ray Date: Fri Dec 9 09:35:02 2022 -0600 net: lan9303: Fix read error execution path This patch fixes an issue where a read failure of a port statistic counter will return unknown results. While it is highly unlikely the read will ever fail, it is much cleaner to return a zero for the stat count. Fixes: a1292595e006 ("net: dsa: add new DSA switch driver for the SMSC-LAN9303") Signed-off-by: Jerry Ray Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20221209153502.7429-1-jerry.ray@microchip.com Signed-off-by: Jakub Kicinski commit 5821504f5073983733465b8bc430049c4343bbd7 Author: Roger Quadros Date: Thu Dec 8 12:55:34 2022 +0200 net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open() Ensure pm_runtime_put() is issued in error path. Reported-by: Jakub Kicinski Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") Signed-off-by: Roger Quadros Reviewed-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221208105534.63709-1-rogerq@kernel.org Signed-off-by: Jakub Kicinski commit 0a1d4434db5f86c50018fe0aab299ac97dc15b76 Merge: 79ad89123c252 18a207849218d Author: Linus Torvalds Date: Mon Dec 12 12:52:02 2022 -0800 Merge tag 'timers-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Updates for timers, timekeeping and drivers: Core: - The timer_shutdown[_sync]() infrastructure: Tearing down timers can be tedious when there are circular dependencies to other things which need to be torn down. A prime example is timer and workqueue where the timer schedules work and the work arms the timer. What needs to prevented is that pending work which is drained via destroy_workqueue() does not rearm the previously shutdown timer. Nothing in that shutdown sequence relies on the timer being functional. The conclusion was that the semantics of timer_shutdown_sync() should be: - timer is not enqueued - timer callback is not running - timer cannot be rearmed Preventing the rearming of shutdown timers is done by discarding rearm attempts silently. A warning for the case that a rearm attempt of a shutdown timer is detected would not be really helpful because it's entirely unclear how it should be acted upon. The only way to address such a case is to add 'if (in_shutdown)' conditionals all over the place. This is error prone and in most cases of teardown not required all. - The real fix for the bluetooth HCI teardown based on timer_shutdown_sync(). A larger scale conversion to timer_shutdown_sync() is work in progress. - Consolidation of VDSO time namespace helper functions - Small fixes for timer and timerqueue Drivers: - Prevent integer overflow on the XGene-1 TVAL register which causes an never ending interrupt storm. - The usual set of new device tree bindings - Small fixes and improvements all over the place" * tag 'timers-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits) dt-bindings: timer: renesas,cmt: Add r8a779g0 CMT support dt-bindings: timer: renesas,tmu: Add r8a779g0 support clocksource/drivers/arm_arch_timer: Use kstrtobool() instead of strtobool() clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() clocksource/drivers/timer-ti-dm: Clear settings on probe and free clocksource/drivers/timer-ti-dm: Make timer_get_irq static clocksource/drivers/timer-ti-dm: Fix warning for omap_timer_match clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error clocksource/drivers/timer-npcm7xx: Enable timer 1 clock before use dt-bindings: timer: nuvoton,npcm7xx-timer: Allow specifying all clocks dt-bindings: timer: rockchip: Add rockchip,rk3128-timer clockevents: Repair kernel-doc for clockevent_delta2ns() clocksource/drivers/ingenic-ost: Define pm functions properly in platform_driver struct clocksource/drivers/sh_cmt: Access registers according to spec vdso/timens: Refactor copy-pasted find_timens_vvar_page() helper into one copy Bluetooth: hci_qca: Fix the teardown problem for real timers: Update the documentation to reflect on the new timer_shutdown() API timers: Provide timer_shutdown[_sync]() timers: Add shutdown mechanism to the internal functions timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode ... commit 79ad89123c2523a7982d457641dd64f339307e6c Merge: 369013162f7a7 ff4c85c05333c Author: Linus Torvalds Date: Mon Dec 12 12:44:03 2022 -0800 Merge tag 'x86-cleanups-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Thomas Gleixner: "A set of x86 cleanups: - Rework the handling of x86_regset for 32 and 64 bit. The original implementation tried to minimize the allocation size with quite some hard to understand and fragile tricks. Make it robust and straight forward by separating the register enumerations for 32 and 64 bit completely. - Add a few missing static annotations - Remove the stale unused setup_once() assembly function - Address a few minor static analysis and kernel-doc warnings" * tag 'x86-cleanups-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/asm/32: Remove setup_once() x86/kaslr: Fix process_mem_region()'s return value x86: Fix misc small issues x86/boot: Repair kernel-doc for boot_kstrtoul() x86: Improve formatting of user_regset arrays x86: Separate out x86_regset for 32 and 64 bit x86/i8259: Make default_legacy_pic static x86/tsc: Make art_related_clocksource static commit 369013162f7a7aed9e685e4763c3395700e909ad Merge: 08d72bd299d08 2833275568755 Author: Linus Torvalds Date: Mon Dec 12 12:30:31 2022 -0800 Merge tag 'x86-apic-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 apic update from Thomas Gleixner: "A set of changes for the x86 APIC code: - Handle the case where x2APIC is enabled and locked by the BIOS on a kernel with CONFIG_X86_X2APIC=n gracefully. Instead of a panic which does not make it to the graphical console during very early boot, simply disable the local APIC completely and boot with the PIC and very limited functionality, which allows to diagnose the issue - Convert x86 APIC device tree bindings to YAML - Extend x86 APIC device tree bindings to configure interrupt delivery mode and handle this in during init. This allows to boot with device tree on platforms which lack a legacy PIC" * tag 'x86-apic-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/of: Add support for boot time interrupt delivery mode configuration x86/of: Replace printk(KERN_LVL) with pr_lvl() dt-bindings: x86: apic: Introduce new optional bool property for lapic dt-bindings: x86: apic: Convert Intel's APIC bindings to YAML schema x86/of: Remove unused early_init_dt_add_memory_arch() x86/apic: Handle no CONFIG_X86_X2APIC on systems with x2APIC enabled by BIOS commit fba119cee1412f49c472f3913241d00f830761fd Merge: 26f708a28454d 832c3f66f53f1 Author: Jakub Kicinski Date: Mon Dec 12 12:15:23 2022 -0800 Merge tag 'wireless-next-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.2 Fourth set of patches for v6.2. Few final patches, a big change is that rtw88 now has USB support. Major changes: rtw88 * support USB devices rtw8821cu, rtw8822bu, rtw8822cu and rtw8723du * tag 'wireless-next-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (43 commits) wifi: rtl8xxxu: fixing IQK failures for rtl8192eu wifi: rtlwifi: btcoexist: fix conditions branches that are never executed wifi: rtlwifi: rtl8192se: remove redundant rtl_get_bbreg() call wifi: rtw88: Add rtw8723du chipset support wifi: rtw88: Add rtw8822cu chipset support wifi: rtw88: Add rtw8822bu chipset support wifi: rtw88: Add rtw8821cu chipset support wifi: rtw88: Add common USB chip support wifi: rtw88: iterate over vif/sta list non-atomically wifi: rtw88: Drop coex mutex wifi: rtw88: Drop h2c.lock wifi: rtw88: Drop rf_lock wifi: rtw88: Call rtw_fw_beacon_filter_config() with rtwdev->mutex held wifi: rtw88: print firmware type in info message wifi: rtw89: add join info upon create interface wifi: rtw89: fix unsuccessful interface_add flow wifi: rtw89: stop mac port function when stop_ap() wifi: rtw89: add mac TSF sync function wifi: rtw89: request full firmware only once if it's early requested wifi: rtw89: don't request partial firmware if SECURITY_LOADPIN_ENFORCE ... ==================== Link: https://lore.kernel.org/r/20221212093026.5C5AEC433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 23e188a16423a6e65290abf39dd427ff047e6843 Author: Miaohe Lin Date: Sat Dec 10 18:10:42 2022 +0800 writeback: remove obsolete macro EXPIRE_DIRTY_ATIME EXPIRE_DIRTY_ATIME is not used anymore. Remove it. Signed-off-by: Miaohe Lin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221210101042.2012931-1-linmiaohe@huawei.com Signed-off-by: Jens Axboe commit a9438b44bc7015b18931e312bbd249a25bb59a65 Author: Jan Kara Date: Mon Dec 12 12:36:33 2022 +0100 writeback: Add asserts for adding freed inode to lists In the past we had several use-after-free issues with inodes getting added to writeback lists after evict() removed them. These are painful to debug so add some asserts to catch the problem earlier. The only non-obvious change in the commit is that we need to tweak redirty_tail_locked() to avoid triggering assertion in inode_io_list_move_locked(). Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221212113633.29181-1-jack@suse.cz Signed-off-by: Jens Axboe commit 08d72bd299d08ae019a8a999b95f3e72643a11a4 Merge: 9d33edb20f7e6 6f855b39e4602 Author: Linus Torvalds Date: Mon Dec 12 11:56:59 2022 -0800 Merge tag 'smp-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug updates from Thomas Gleixner: "A small set of updates for CPU hotplug: - Prevent stale CPU hotplug state in the cpu_down() path which was detected by stress testing the sysfs interface - Ensure that the target CPU hotplug state for the boot CPU is CPUHP_ONLINE instead of the compile time init value CPUHP_OFFLINE. - Switch back to the original behaviour of warning when a CPU hotplug callback in the DYING/STARTING section returns an error code. Otherwise a buggy callback can leave the CPUs in an non recoverable state" * tag 'smp-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Do not bail-out in DYING/STARTING sections cpu/hotplug: Set cpuhp target for boot cpu cpu/hotplug: Make target_store() a nop when target == state commit 26f708a28454df2062a63fd869e983c379f50ff0 Merge: b2b509fb5a1e6 99523094de48d Author: Jakub Kicinski Date: Mon Dec 12 11:27:41 2022 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Alexei Starovoitov says: ==================== pull-request: bpf-next 2022-12-11 We've added 74 non-merge commits during the last 11 day(s) which contain a total of 88 files changed, 3362 insertions(+), 789 deletions(-). The main changes are: 1) Decouple prune and jump points handling in the verifier, from Andrii. 2) Do not rely on ALLOW_ERROR_INJECTION for fmod_ret, from Benjamin. Merged from hid tree. 3) Do not zero-extend kfunc return values. Necessary fix for 32-bit archs, from Björn. 4) Don't use rcu_users to refcount in task kfuncs, from David. 5) Three reg_state->id fixes in the verifier, from Eduard. 6) Optimize bpf_mem_alloc by reusing elements from free_by_rcu, from Hou. 7) Refactor dynptr handling in the verifier, from Kumar. 8) Remove the "/sys" mount and umount dance in {open,close}_netns in bpf selftests, from Martin. 9) Enable sleepable support for cgrp local storage, from Yonghong. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (74 commits) selftests/bpf: test case for relaxed prunning of active_lock.id selftests/bpf: Add pruning test case for bpf_spin_lock bpf: use check_ids() for active_lock comparison selftests/bpf: verify states_equal() maintains idmap across all frames bpf: states_equal() must build idmap for all function frames selftests/bpf: test cases for regsafe() bug skipping check_id() bpf: regsafe() must not skip check_ids() docs/bpf: Add documentation for BPF_MAP_TYPE_SK_STORAGE selftests/bpf: Add test for dynptr reinit in user_ringbuf callback bpf: Use memmove for bpf_dynptr_{read,write} bpf: Move PTR_TO_STACK alignment check to process_dynptr_func bpf: Rework check_func_arg_reg_off bpf: Rework process_dynptr_func bpf: Propagate errors from process_* checks in check_func_arg bpf: Refactor ARG_PTR_TO_DYNPTR checks into process_dynptr_func bpf: Skip rcu_barrier() if rcu_trace_implies_rcu_gp() is true bpf: Reuse freed element in free_by_rcu during allocation selftests/bpf: Bring test_offload.py back to life bpf: Fix comment error in fixup_kfunc_call function bpf: Do not zero-extend kfunc return values ... ==================== Link: https://lore.kernel.org/r/20221212024701.73809-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit 9d33edb20f7e6943250d6bb96ceaf2368f674d51 Merge: f10bc40168032 6132a490f9c81 Author: Linus Torvalds Date: Mon Dec 12 11:21:29 2022 -0800 Merge tag 'irq-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Updates for the interrupt core and driver subsystem: The bulk is the rework of the MSI subsystem to support per device MSI interrupt domains. This solves conceptual problems of the current PCI/MSI design which are in the way of providing support for PCI/MSI[-X] and the upcoming PCI/IMS mechanism on the same device. IMS (Interrupt Message Store] is a new specification which allows device manufactures to provide implementation defined storage for MSI messages (as opposed to PCI/MSI and PCI/MSI-X that has a specified message store which is uniform accross all devices). The PCI/MSI[-X] uniformity allowed us to get away with "global" PCI/MSI domains. IMS not only allows to overcome the size limitations of the MSI-X table, but also gives the device manufacturer the freedom to store the message in arbitrary places, even in host memory which is shared with the device. There have been several attempts to glue this into the current MSI code, but after lengthy discussions it turned out that there is a fundamental design problem in the current PCI/MSI-X implementation. This needs some historical background. When PCI/MSI[-X] support was added around 2003, interrupt management was completely different from what we have today in the actively developed architectures. Interrupt management was completely architecture specific and while there were attempts to create common infrastructure the commonalities were rudimentary and just providing shared data structures and interfaces so that drivers could be written in an architecture agnostic way. The initial PCI/MSI[-X] support obviously plugged into this model which resulted in some basic shared infrastructure in the PCI core code for setting up MSI descriptors, which are a pure software construct for holding data relevant for a particular MSI interrupt, but the actual association to Linux interrupts was completely architecture specific. This model is still supported today to keep museum architectures and notorious stragglers alive. In 2013 Intel tried to add support for hot-pluggable IO/APICs to the kernel, which was creating yet another architecture specific mechanism and resulted in an unholy mess on top of the existing horrors of x86 interrupt handling. The x86 interrupt management code was already an incomprehensible maze of indirections between the CPU vector management, interrupt remapping and the actual IO/APIC and PCI/MSI[-X] implementation. At roughly the same time ARM struggled with the ever growing SoC specific extensions which were glued on top of the architected GIC interrupt controller. This resulted in a fundamental redesign of interrupt management and provided the today prevailing concept of hierarchical interrupt domains. This allowed to disentangle the interactions between x86 vector domain and interrupt remapping and also allowed ARM to handle the zoo of SoC specific interrupt components in a sane way. The concept of hierarchical interrupt domains aims to encapsulate the functionality of particular IP blocks which are involved in interrupt delivery so that they become extensible and pluggable. The X86 encapsulation looks like this: |--- device 1 [Vector]---[Remapping]---[PCI/MSI]--|... |--- device N where the remapping domain is an optional component and in case that it is not available the PCI/MSI[-X] domains have the vector domain as their parent. This reduced the required interaction between the domains pretty much to the initialization phase where it is obviously required to establish the proper parent relation ship in the components of the hierarchy. While in most cases the model is strictly representing the chain of IP blocks and abstracting them so they can be plugged together to form a hierarchy, the design stopped short on PCI/MSI[-X]. Looking at the hardware it's clear that the actual PCI/MSI[-X] interrupt controller is not a global entity, but strict a per PCI device entity. Here we took a short cut on the hierarchical model and went for the easy solution of providing "global" PCI/MSI domains which was possible because the PCI/MSI[-X] handling is uniform across the devices. This also allowed to keep the existing PCI/MSI[-X] infrastructure mostly unchanged which in turn made it simple to keep the existing architecture specific management alive. A similar problem was created in the ARM world with support for IP block specific message storage. Instead of going all the way to stack a IP block specific domain on top of the generic MSI domain this ended in a construct which provides a "global" platform MSI domain which allows overriding the irq_write_msi_msg() callback per allocation. In course of the lengthy discussions we identified other abuse of the MSI infrastructure in wireless drivers, NTB etc. where support for implementation specific message storage was just mindlessly glued into the existing infrastructure. Some of this just works by chance on particular platforms but will fail in hard to diagnose ways when the driver is used on platforms where the underlying MSI interrupt management code does not expect the creative abuse. Another shortcoming of today's PCI/MSI-X support is the inability to allocate or free individual vectors after the initial enablement of MSI-X. This results in an works by chance implementation of VFIO (PCI pass-through) where interrupts on the host side are not set up upfront to avoid resource exhaustion. They are expanded at run-time when the guest actually tries to use them. The way how this is implemented is that the host disables MSI-X and then re-enables it with a larger number of vectors again. That works by chance because most device drivers set up all interrupts before the device actually will utilize them. But that's not universally true because some drivers allocate a large enough number of vectors but do not utilize them until it's actually required, e.g. for acceleration support. But at that point other interrupts of the device might be in active use and the MSI-X disable/enable dance can just result in losing interrupts and therefore hard to diagnose subtle problems. Last but not least the "global" PCI/MSI-X domain approach prevents to utilize PCI/MSI[-X] and PCI/IMS on the same device due to the fact that IMS is not longer providing a uniform storage and configuration model. The solution to this is to implement the missing step and switch from global PCI/MSI domains to per device PCI/MSI domains. The resulting hierarchy then looks like this: |--- [PCI/MSI] device 1 [Vector]---[Remapping]---|... |--- [PCI/MSI] device N which in turn allows to provide support for multiple domains per device: |--- [PCI/MSI] device 1 |--- [PCI/IMS] device 1 [Vector]---[Remapping]---|... |--- [PCI/MSI] device N |--- [PCI/IMS] device N This work converts the MSI and PCI/MSI core and the x86 interrupt domains to the new model, provides new interfaces for post-enable allocation/free of MSI-X interrupts and the base framework for PCI/IMS. PCI/IMS has been verified with the work in progress IDXD driver. There is work in progress to convert ARM over which will replace the platform MSI train-wreck. The cleanup of VFIO, NTB and other creative "solutions" are in the works as well. Drivers: - Updates for the LoongArch interrupt chip drivers - Support for MTK CIRQv2 - The usual small fixes and updates all over the place" * tag 'irq-core-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (134 commits) irqchip/ti-sci-inta: Fix kernel doc irqchip/gic-v2m: Mark a few functions __init irqchip/gic-v2m: Include arm-gic-common.h irqchip/irq-mvebu-icu: Fix works by chance pointer assignment iommu/amd: Enable PCI/IMS iommu/vt-d: Enable PCI/IMS x86/apic/msi: Enable PCI/IMS PCI/MSI: Provide pci_ims_alloc/free_irq() PCI/MSI: Provide IMS (Interrupt Message Store) support genirq/msi: Provide constants for PCI/IMS support x86/apic/msi: Enable MSI_FLAG_PCI_MSIX_ALLOC_DYN PCI/MSI: Provide post-enable dynamic allocation interfaces for MSI-X PCI/MSI: Provide prepare_desc() MSI domain op PCI/MSI: Split MSI-X descriptor setup genirq/msi: Provide MSI_FLAG_MSIX_ALLOC_DYN genirq/msi: Provide msi_domain_alloc_irq_at() genirq/msi: Provide msi_domain_ops:: Prepare_desc() genirq/msi: Provide msi_desc:: Msi_data genirq/msi: Provide struct msi_map x86/apic/msi: Remove arch_create_remap_msi_irq_domain() ... commit 0e2c9884cbbae00f956d881848669790d73be43d Merge: e0a1d1394b220 503fa6d17040f 49e62e0d96baf 63cd992e5179d 3c79ace9c0d0b Author: Stephen Boyd Date: Mon Dec 12 11:13:28 2022 -0800 Merge branches 'clk-mediatek', 'clk-trace', 'clk-qcom' and 'clk-microchip' into clk-next - Tracepoints for clk_rate_request structures * clk-mediatek: clk: mediatek: fix dependency of MT7986 ADC clocks clk: mediatek: Change PLL register API for MT8186 clk: mediatek: Add new clock driver to handle FHCTL hardware dt-bindings: clock: mediatek: Add new bindings of MediaTek frequency hopping clk: mediatek: Export PLL operations symbols clk: mediatek: mt8186-topckgen: Add GPU clock mux notifier clk: mediatek: mt8186-mfg: Propagate rate changes to parent clk: mediatek: mt8195-topckgen: Drop flags for main/univpll fixed factors clk: mediatek: mt8192: Drop flags for main/univpll fixed factors clk: mediatek: mt6795-topckgen: Drop flags for main/sys/univpll fixed factors clk: mediatek: mt8173: Drop flags for main/sys/univpll fixed factors clk: mediatek: mt8183: Drop flags for sys/univpll fixed factors clk: mediatek: mt8183: Compress top_divs array entries clk: mediatek: mt8186-topckgen: Drop flags for main/univpll fixed factors clk: mediatek: clk-mtk: Allow specifying flags on mtk_fixed_factor clocks * clk-trace: clk: Add trace events for rate requests clk: Store clk_core for clk_rate_request * clk-qcom: (69 commits) clk: qcom: rpmh: add support for SM6350 rpmh IPA clock clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: mmcc-msm8974: move clock parent tables down clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: gcc-msm8974: move clock parent tables down clk: qcom: gcc-msm8974: use ARRAY_SIZE instead of specifying num_parents dt-bindings: clocks: qcom,mmcc: define clocks/clock-names for MSM8974 dt-bindings: clock: split qcom,gcc-msm8974,-msm8226 to the separate file clk: qcom: gcc-ipq4019: switch to devm_clk_notifier_register clk: qcom: rpmh: remove usage of platform name clk: qcom: rpmh: rename VRM clock data clk: qcom: rpmh: rename ARC clock data clk: qcom: rpmh: support separate symbol name for the RPMH clocks clk: qcom: rpmh: remove platform names from BCM clocks clk: qcom: rpmh: drop all _ao names clk: qcom: rpmh: reuse common duplicate clocks clk: qcom: rpmh: group clock definitions together clk: qcom: rpm: drop the platform from clock definitions clk: qcom: rpm: drop the _clk suffix completely ... * clk-microchip: clk: microchip: enable the MPFS clk driver by default if SOC_MICROCHIP_POLARFIRE clk: microchip: check for null return of devm_kzalloc() commit e0a1d1394b220d8083c773d1f208925aa1e0eddf Merge: 83907bf316287 5381dc785312e 76c340e93f5aa 266162b799a72 5595eabd99934 Author: Stephen Boyd Date: Mon Dec 12 11:13:08 2022 -0800 Merge branches 'clk-spear', 'clk-fract', 'clk-rockchip' and 'clk-imx' into clk-next - Debugfs support for fractional divider clk * clk-spear: clk: spear: Fix SSP clock definition on SPEAr600 clk: spear: Fix CLCD clock definition on SPEAr600 * clk-fract: clk: fractional-divider: Regroup inclusions clk: fractional-divider: Show numerator and denominator in debugfs clk: fractional-divider: Split out clk_fd_get_div() helper * clk-rockchip: clk: rockchip: Fix memory leak in rockchip_clk_register_pll() clk: rockchip: add clock controller for the RK3588 clk: rockchip: add lookup table support clk: rockchip: simplify rockchip_clk_add_lookup clk: rockchip: allow additional mux options for cpu-clock frequency changes clk: rockchip: add pll type for RK3588 clk: rockchip: add register offset of the cores select parent dt-bindings: clock: add rk3588 cru bindings dt-bindings: reset: add rk3588 reset definitions dt-bindings: clock: add rk3588 clock definitions clk: rockchip: use proper crypto0 name on rk3399 * clk-imx: clk: imx: rename imx_obtain_fixed_clk_hw() to imx_get_clk_hw_by_name() clk: imx8mn: fix imx8mn_enet_phy_sels clocks list clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx: rename video_pll1 to video_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: imxrt1050: add IMXRT1050_CLK_LCDIF_PIX clock gate clk: imx: imxrt1050: fix IMXRT1050_CLK_LCDIF_APB offsets clk: imx8mp: Add audio shared gate dt-bindings: clock: imx8mp: Add ids for the audio shared gate clk: imx: pll14xx: Add 320 MHz and 640 MHz entries for PLL146x clk: imx93: keep sys ctr clock always on clk: imx: keep hsio bus clock always on clk: imx93: drop tpm1/3, lpit1/2 clk dt-bindings: clock: imx93: drop TPM1/3 LPIT1/2 entry clk: imx93: correct enet clock clk: imx93: unmap anatop base in error handling path clk: imx: imx8mp: add shared clk gate for usb suspend clk dt-bindings: clocks: imx8mp: Add ID for usb suspend clock clk: imx93: correct the flexspi1 clock setting commit 83907bf316287ad9b888e1661d34c6ed0b3313f2 Merge: a9fc882f57625 687daae7941c7 01e6bf9921eef d0b1c69288cf0 9f8e30559b042 53949843d30c3 Author: Stephen Boyd Date: Mon Dec 12 11:12:52 2022 -0800 Merge branches 'clk-bindings', 'clk-renesas', 'clk-amlogic', 'clk-allwinner' and 'clk-ti' into clk-next * clk-bindings: dt-bindings: clock: ti,cdce925: Convert to DT schema * clk-renesas: (26 commits) clk: renesas: r8a779f0: Fix Ethernet Switch clocks clk: renesas: r8a779g0: Add Z0 clock support clk: renesas: r8a779g0: Add CMT clocks clk: renesas: r8a779g0: Add TMU and SASYNCRT clocks clk: renesas: r8a779f0: Fix SCIF parent clocks clk: renesas: r8a779f0: Fix HSCIF parent clocks clk: renesas: r9a06g032: Repair grave increment error clk: renesas: rzg2l: Don't assume all CPG_MOD clocks support PM clk: renesas: rzg2l: Fix typo in struct rzg2l_cpg_priv kerneldoc clk: renesas: r8a779a0: Fix SD0H clock name clk: renesas: r8a779g0: Add RPC-IF clock clk: renesas: r8a779g0: Add SDHI clocks clk: renesas: r8a779f0: Add SASYNCPER internal clock clk: renesas: r8a779f0: Fix SD0H clock name clk: renesas: r9a07g043: Drop WDT2 clock and reset entry clk: renesas: r9a07g044: Drop WDT2 clock and reset entry clk: renesas: r8a779g0: Add TPU clock clk: renesas: r8a779g0: Add PWM clock clk: renesas: r8a779g0: Add SCIF clocks clk: renesas: r9a07g044: Add MTU3a clock and reset entry ... * clk-amlogic: clk: meson: pll: add pcie lock retry workaround clk: meson: pll: adjust timeout in meson_clk_pll_wait_lock() * clk-allwinner: clk: sunxi-ng: f1c100s: Add IR mod clock clk: sunxi-ng: v3s: Correct the header guard of ccu-sun8i-v3s.h * clk-ti: clk: ti: fix typo in ti_clk_retry_init() code comment clk: ti: dra7-atl: don't allocate `parent_names' variable clk: ti: change ti_clk_register[_omap_hw]() API commit a9fc882f57625761252169c62b19e99578531a9e Merge: 830b3c68c1fb1 7256d1f4618b4 2875a2f3f1835 5e57aaa8b6ec0 fadbafc1b7b7a ff0d3ae04f730 Author: Stephen Boyd Date: Mon Dec 12 11:12:26 2022 -0800 Merge branches 'clk-x86', 'clk-xilinx', 'clk-cleanup', 'clk-mstar' and 'clk-ingenic' into clk-next - Make MxL's CGU driver secure compatible - Support for CPU PLL on MStar/SigmaStar SoCs - Ingenic JZ4755 SoC clk support - Support audio clks on X1000 SoCs * clk-x86: clk: mxl: syscon_node_to_regmap() returns error pointers clk: mxl: Fix a clk entry by adding relevant flags clk: mxl: Add option to override gate clks clk: mxl: Remove redundant spinlocks clk: mxl: Switch from direct readl/writel based IO to regmap based IO * clk-xilinx: clk: xilinx: Drop duplicate depends on COMMON_CLK * clk-cleanup: clk: nomadik: correct struct name kernel-doc warning clk: lmk04832: fix kernel-doc warnings clk: lmk04832: drop superfluous #include clk: lmk04832: drop unnecessary semicolons clk: lmk04832: declare variables as const when possible clk: socfpga: Fix memory leak in socfpga_gate_init() clk: st: Fix memory leak in st_of_quadfs_setup() clk: samsung: Fix memory leak in _samsung_clk_register_pll() clk: visconti: Fix memory leak in visconti_register_pll() clk: Remove a useless include clk: samsung: Fix reference to CLK_OF_DECLARE in comment clk: stm32mp1: Staticize ethrx_src clk: keystone: syscon-clk: Use dev_err_probe() helper clk: bulk: Use dev_err_probe() helper in __clk_bulk_get() clk: cdce925: simplify using devm_regulator_get_enable() * clk-mstar: clk: mstar: msc313 cpupll clk driver * clk-ingenic: clk: Add Ingenic JZ4755 CGU driver dt-bindings: clock: Add Ingenic JZ4755 CGU header dt-bindings: ingenic: Add support for the JZ4755 CGU clk: ingenic: Minor cosmetic fixups for X1000 clk: ingenic: Add X1000 audio clocks dt-bindings: ingenic,x1000-cgu: Add audio clocks clk: ingenic: Add .set_rate_hook() for PLL clocks clk: ingenic: Make PLL clock enable_bit and stable_bit optional clk: ingenic: Make PLL clock "od" field optional commit f10bc40168032962ebee26894bdbdc972cde35bf Merge: 9c2b840a3b446 c4db2d3b70e58 Author: Linus Torvalds Date: Mon Dec 12 11:11:57 2022 -0800 Merge tag 'core-debugobjects-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A single update for debugobjects: Add the object pointer to the debug output for better correlation with other debug facilities" * tag 'core-debugobjects-2022-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Print object pointer in debug_print_object() commit 9c2b840a3b446ec2a7fc1cfb68af481905ec6f5f Merge: 47477c84b8914 45be2ad007a9c Author: Linus Torvalds Date: Mon Dec 12 11:10:02 2022 -0800 Merge tag 'x86-urgent-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Three small x86 fixes which did not make it into 6.1: - Remove a superfluous noinline which prevents GCC-7.3 to optimize a stub function away - Allow uprobes on REP NOP and do not treat them like word-sized branch instructions - Make the VDSO symbol export of __vdso_sgx_enter_enclave() depend on CONFIG_X86_SGX to prevent build failures with newer LLVM versions which rightfully detect that there is no function behind the symbol" * tag 'x86-urgent-2022-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Conditionally export __vdso_sgx_enter_enclave() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/alternative: Remove noinline from __ibt_endbr_seal[_end]() stubs commit 73740235a68d61f5eaee2425a0baaf610f4e4b17 Merge: 0612d748003ce 44fda61d2bcfb Author: Mark Brown Date: Mon Dec 12 19:10:01 2022 +0000 ASoC: SOF: remove unregister calls from shutdown Merge series from Kai Vehmanen : This patchset is an alternative solution to problems reported by Ricardo Ribalda and Zhen Ni , as discussed in - "[PATCH] ALSA: core: Fix deadlock when shutdown a frozen userspace" https://mailman.alsa-project.org/pipermail/alsa-devel/2022-November/209248.html - "[PATCH] ASoc: SOF: Fix sof-audio-pci-intel-tgl shutdown timeout during hibernation" https://mailman.alsa-project.org/pipermail/alsa-devel/2022-December/209685.html It was raised by Oliver Neukum that kernel should not let user-space stall the shutdown process in any scenario and the unregister call in current SOF shutdown code is not right. This series reverts the ASoC SOF patch to unregister clients and the machine drivers at shutdown. To avoid bringing back old bugs, the series includes a patch to fix S5 entry on certain Intel platforms. commit f7f291e14dde32a07b1f0aa06921d28f875a7b54 Author: Paulo Alcantara Date: Sun Dec 11 18:18:55 2022 -0300 cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses. Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 9d91f8108ebfed54284332e04d2073107df18794 Author: Steve French Date: Sun Dec 11 14:44:31 2022 -0600 cifs: print warning when conflicting soft vs. hard mount options specified If the user specifies conflicting hard vs. soft mount options (or nosoft vs. nohard) print a warning to dmesg We were missing a warning when a user e.g. mounted with both "hard,soft" mount options. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 2bfd81043e944af0e52835ef6d9b41795af22341 Author: Steve French Date: Sun Dec 11 13:54:21 2022 -0600 cifs: fix missing display of three mount options Three mount options: "tcpnodelay" and "noautotune" and "noblocksend" were not displayed when passed in on cifs/smb3 mounts (e.g. displayed in /proc/mounts e.g.). No change to defaults so these are not displayed if not specified on mount. Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9544597b5b63ff1674d60e069f93555ab924b62b Author: Steve French Date: Fri Dec 9 16:55:51 2022 -0600 cifs: fix various whitespace errors in headers Fix some extra spaces and a few comments that were unnecessarily split over two lines. These were some trivial issues pointed out by checkpatch) Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit c19204cbd65c12fdcd34fb8f5d645007238ed5cd Author: Steve French Date: Thu Dec 8 16:11:00 2022 -0600 cifs: minor cleanup of some headers checkpatch showed formatting problems with extra spaces, and extra semicolon and some missing blank lines in some cifs headers. Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Germano Percossi Signed-off-by: Steve French commit 47477c84b8914525b427bccbdcded0cf0086f2a1 Merge: 49d07f010c7c6 bb3860cc02c66 Author: Linus Torvalds Date: Mon Dec 12 11:04:08 2022 -0800 Merge tag 's390-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Factor out handle_write() function and simplify 3215 console write operation - When 3170 terminal emulator is connected to the 3215 console driver the boot time could be very long due to limited buffer space or missing operator input. Add con3215_drop command line parameter and con3215_drop sysfs attribute file to instruct the kernel drop console data when such conditions are met - Fix white space errors in 3215 console driver - Move enum paiext_mode definition to a header file and rename it to paievt_mode to indicate this is now used for several events. Rename PAI_MODE_COUNTER to PAI_MODE_COUNTING to make consistent with PAI_MODE_SAMPLING - Simplify the logic of PMU pai_crypto mapped buffer reference counter and make it consistent with PMU pai_ext - Rename PMU pai_crypto mapped buffer structure member users to active_events to make it consistent with PMU pai_ext - Enable HUGETLB_PAGE_OPTIMIZE_VMEMMAP configuration option. This results in saving of 12K per 1M hugetlb page (~1.2%) and 32764K per 2G hugetlb page (~1.6%) - Use generic serial.h, bugs.h, shmparam.h and vga.h header files and scrap s390-specific versions - The generic percpu setup code does not expect the s390-like implementation and emits a warning. To get rid of that warning and provide sane CPU-to-node and CPU-to-CPU distance mappings implementat a minimal version of setup_per_cpu_areas() - Use kstrtobool() instead of strtobool() for re-IPL sysfs device attributes - Avoid unnecessary lookup of a pointer to MSI descriptor when setting IRQ affinity for a PCI device - Get rid of "an incompatible function type cast" warning by changing debug_sprintf_format_fn() function prototype so it matches the debug_format_proc_t function type - Remove unused info_blk_hdr__pcpus() and get_page_state() functions - Get rid of clang "unused unused insn cache ops function" warning by moving s390_insn definition to a private header - Get rid of clang "unused function" warning by making function raw3270_state_final() only available if CONFIG_TN3270_CONSOLE is enabled - Use kstrobool() to parse sclp_con_drop parameter to make it identical to the con3215_drop parameter and allow passing values like "yes" and "true" - Use sysfs_emit() for all SCLP sysfs show functions, which is the current standard way to generate output strings - Make SCLP con_drop sysfs attribute also writable and allow to change its value during runtime. This makes SCLP console drop handling consistent with the 3215 device driver - Virtual and physical addresses are indentical on s390. However, there is still a confusion when pointers are directly casted to physical addresses or vice versa. Use correct address converters virt_to_phys() and phys_to_virt() for s390 channel IO drivers - Support for power managemant has been removed from s390 since quite some time. Remove unused power managemant code from the appldata device driver - Allow memory tools like KASAN see memory accesses from the checksum code. Switch to GENERIC_CSUM if KASAN is enabled, just like x86 does - Add support of ECKD DASDs disks so it could be used as boot and dump devices - Follow checkpatch recommendations and use octal values instead of S_IRUGO and S_IWUSR for dump device attributes in sysfs - Changes to vx-insn.h do not cause a recompile of C files that use asm(".include \"asm/vx-insn.h\"\n") magic to access vector instruction macros from inline assemblies. Add wrapper include header file to avoid this problem - Use vector instruction macros instead of byte patterns to increase register validation routine readability - The current machine check register validation handling does not take into account various scenarios and might lead to killing a wrong user process or potentially ignore corrupted FPU registers. Simplify logic of the machine check handler and stop the whole machine if the previous context was kerenel mode. If the previous context was user mode, kill the current task - Introduce sclp_emergency_printk() function which can be used to emit a message in emergency cases. It is supposed to be used in cases where regular console device drivers may not work anymore, e.g. unrecoverable machine checks Keep the early Service-Call Control Block so it can also be used after initdata has been freed to allow sclp_emergency_printk() implementation - In case a system will be stopped because of an unrecoverable machine check error print the machine check interruption code to give a hint of what went wrong - Move storage error checking from the assembly entry code to C in order to simplify machine check handling. Enter the handler with DAT turned on, which simplifies the entry code even more - The machine check extended save areas are allocated using a private "nmi_save_areas" slab cache which guarantees a required power-of-two alignment. Get rid of that cache in favour of kmalloc() * tag 's390-6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (38 commits) s390/nmi: get rid of private slab cache s390/nmi: move storage error checking back to C, enter with DAT on s390/nmi: print machine check interruption code before stopping system s390/sclp: introduce sclp_emergency_printk() s390/sclp: keep sclp_early_sccb s390/nmi: rework register validation handling s390/nmi: use vector instruction macros instead of byte patterns s390/vx: add vx-insn.h wrapper include file s390/ipl: use octal values instead of S_* macros s390/ipl: add eckd dump support s390/ipl: add eckd support vfio/ccw: identify CCW data addresses as physical vfio/ccw: sort out physical vs virtual pointers usage s390/checksum: support GENERIC_CSUM, enable it for KASAN s390/appldata: remove power management callbacks s390/cio: sort out physical vs virtual pointers usage s390/sclp: allow to change sclp_console_drop during runtime s390/sclp: convert to use sysfs_emit() s390/sclp: use kstrobool() to parse sclp_con_drop parameter s390/3270: make raw3270_state_final() depend on CONFIG_TN3270_CONSOLE ... commit 49d07f010c7c6b09ea2c2ebca67b83b38afa5faf Merge: 5977aa66c47f8 553b20b211c41 Author: Linus Torvalds Date: Mon Dec 12 11:02:19 2022 -0800 Merge tag 'm68k-for-v6.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - remove an unused function involving a non-explictly signed char type - reword a (correct) comment to stop the inflood of (incorrect) patches trying to fix it - defconfig updates * tag 'm68k-for-v6.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.1-rc1 m68k: mac: Reword comment using double "in" m68k: mac: Remove unused rbv_set_video_bpp() commit 5977aa66c47f8e9629e88f1e983951a09801ccef Merge: e6b160bc4daa1 4c587a982603d Author: Linus Torvalds Date: Mon Dec 12 10:59:13 2022 -0800 Merge tag 'mips_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - DT cleanups - fix for early use of kzalloc on mt7621 platform - cleanups and fixes * tag 'mips_6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (21 commits) MIPS: OCTEON: warn only once if deprecated link status is being used MIPS: BCM63xx: Add check for NULL for clk in clk_enable platform/mips: Adjust Kconfig to keep consistency MIPS: OCTEON: cvmx-bootmem: use strscpy() to instead of strncpy() MIPS: mscc: jaguar2: Fix pca9545 i2c-mux node names mips/pci: use devm_platform_ioremap_resource() mips: ralink: mt7621: do not use kzalloc too early mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem MIPS: Restore symbol versions for copy_page_cpu and clear_page_cpu mips: dts: remove label = "cpu" from DSA dt-binding mips: ralink: mt7621: change DSA port labels to generic naming mips: ralink: mt7621: fix phy-mode of external phy on GB-PC2 MIPS: vpe-cmp: fix possible memory leak while module exiting MIPS: vpe-mt: fix possible memory leak while module exiting dt-bindings: mips: brcm: add Broadcom SoCs bindings dt-bindings: mips: add CPU bindings for MIPS architecture mips: dts: brcm: bcm7435: add "interrupt-names" for NAND controller mips: dts: bcm63268: add TWD block timer MIPS: Use "grep -E" instead of "egrep" ... commit 1c0908d8e441631f5b8ba433523cf39339ee2ba0 Author: Mel Gorman Date: Fri Dec 2 10:02:23 2022 +0000 rtmutex: Add acquire semantics for rtmutex lock acquisition slow path Jan Kara reported the following bug triggering on 6.0.5-rt14 running dbench on XFS on arm64. kernel BUG at fs/inode.c:625! Internal error: Oops - BUG: 0 [#1] PREEMPT_RT SMP CPU: 11 PID: 6611 Comm: dbench Tainted: G E 6.0.0-rt14-rt+ #1 pc : clear_inode+0xa0/0xc0 lr : clear_inode+0x38/0xc0 Call trace: clear_inode+0xa0/0xc0 evict+0x160/0x180 iput+0x154/0x240 do_unlinkat+0x184/0x300 __arm64_sys_unlinkat+0x48/0xc0 el0_svc_common.constprop.4+0xe4/0x2c0 do_el0_svc+0xac/0x100 el0_svc+0x78/0x200 el0t_64_sync_handler+0x9c/0xc0 el0t_64_sync+0x19c/0x1a0 It also affects 6.1-rc7-rt5 and affects a preempt-rt fork of 5.14 so this is likely a bug that existed forever and only became visible when ARM support was added to preempt-rt. The same problem does not occur on x86-64 and he also reported that converting sb->s_inode_wblist_lock to raw_spinlock_t makes the problem disappear indicating that the RT spinlock variant is the problem. Which in turn means that RT mutexes on ARM64 and any other weakly ordered architecture are affected by this independent of RT. Will Deacon observed: "I'd be more inclined to be suspicious of the slowpath tbh, as we need to make sure that we have acquire semantics on all paths where the lock can be taken. Looking at the rtmutex code, this really isn't obvious to me -- for example, try_to_take_rt_mutex() appears to be able to return via the 'takeit' label without acquire semantics and it looks like we might be relying on the caller's subsequent _unlock_ of the wait_lock for ordering, but that will give us release semantics which aren't correct." Sebastian Andrzej Siewior prototyped a fix that does work based on that comment but it was a little bit overkill and added some fences that should not be necessary. The lock owner is updated with an IRQ-safe raw spinlock held, but the spin_unlock does not provide acquire semantics which are needed when acquiring a mutex. Adds the necessary acquire semantics for lock owner updates in the slow path acquisition and the waiter bit logic. It successfully completed 10 iterations of the dbench workload while the vanilla kernel fails on the first iteration. [ bigeasy@linutronix.de: Initial prototype fix ] Fixes: 700318d1d7b38 ("locking/rtmutex: Use acquire/release semantics") Fixes: 23f78d4a03c5 ("[PATCH] pi-futex: rt mutex core") Reported-by: Jan Kara Signed-off-by: Mel Gorman Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221202100223.6mevpbl7i6x5udfd@techsingularity.net commit e6b160bc4daa1227695ef807e11097a3e9934d66 Merge: 0ec5a38bf8499 8b997b2bb2c53 Author: Linus Torvalds Date: Mon Dec 12 10:55:53 2022 -0800 Merge tag 'for-linus-6.2-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix memory leaks in error paths - add support for virtio PCI-devices in Xen guests on ARM - two minor fixes * tag 'for-linus-6.2-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() x86/xen: Fix memory leak in xen_init_lock_cpu() x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() xen: fix xen.h build for CONFIG_XEN_PVH=y xen/virtio: Handle PCI devices which Host controller is described in DT xen/virtio: Optimize the setup of "xen-grant-dma" devices commit 0ec5a38bf8499f403f81cb81a0e3a60887d1993c Merge: 7a76117f9fa52 9a8aadcf0b459 Author: Linus Torvalds Date: Mon Dec 12 10:51:55 2022 -0800 Merge tag 'tag-chrome-platform-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New drivers - Driver for ChromeOS human presence sensor Cleanups: - Add missing property in dt-binding example. - Update the availability of properties in dt-binding. - Separate dt-binding for ChromeOS fingerprint sensor. Improvements: - Set PROBE_PREFER_ASYNCHRONOUS for some drivers for shortening boot time. Fixes: - Fix an use-after-free in cros_ec_typec. And minor fixes and cleanups" * tag 'tag-chrome-platform-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_typec: zero out stale pointers platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() platform/chrome: cros_ec: Convert to i2c's .probe_new() platform/chrome: cros_ec_lpc: Force synchronous probe platform/chrome: cros_ec_spi: Set PROBE_PREFER_ASYNCHRONOUS platform/chrome: cros_ec_lightbar: Set PROBE_PREFER_ASYNCHRONOUS platform/chrome: cros_ec_debugfs: Set PROBE_PREFER_ASYNCHRONOUS platform/chrome: cros_ec_lpc: Mark PROBE_PREFER_ASYNCHRONOUS platform/chrome: cros_ec_lpc: Move mec_init to device probe platform/chrome: Use kstrtobool() instead of strtobool() platform/chrome: cros_ec_lpc_mec: remove cros_ec_lpc_mec_destroy() dt-bindings: cros-ec: Add ChromeOS fingerprint binding dt-bindings: cros-ec: Reorganize and enforce property availability platform/chrome: cros_hps_i2c: make remove callback return void platform/chrome: add a driver for HPS commit 7a76117f9fa52afcf244d4f1b8d4ce92f3e5ef99 Merge: 01f3cbb296a9a b0b698b80c56b Author: Linus Torvalds Date: Mon Dec 12 10:47:10 2022 -0800 Merge tag 'platform-drivers-x86-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: - Intel: - PMC: Add support for Meteor Lake - Intel On Demand: various updates - Ideapad-laptop: - Add support for various Fn keys on new models - Fix touchpad on/off handling in a generic way to avoid having to add more and more quirks - Android x86 tablets: - Add support for two more X86 Android tablet models - New Dell WMI DDV driver - Miscellaneous cleanups and small bugfixes * tag 'platform-drivers-x86-v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (52 commits) platform/mellanox: mlxbf-pmc: Fix event typo platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() platform/x86: sony-laptop: Convert to use sysfs_emit_at() API platform/x86/dell: alienware-wmi: Use sysfs_emit() instead of scnprintf() platform/x86: uv_sysfs: Use sysfs_emit() instead of scnprintf() platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: x86-android-tablets: Add Advantech MICA-071 extra button platform/x86: x86-android-tablets: Add Lenovo Yoga Tab 3 (YT3-X90F) charger + fuel-gauge data platform/x86: x86-android-tablets: Add Medion Lifetab S10346 data platform/x86: wireless-hotkey: use ACPI HID as phys platform/x86/intel/hid: Add module-params for 5 button array + SW_TABLET_MODE reporting platform/x86: ideapad-laptop: Make touchpad_ctrl_via_ec a module option platform/x86: ideapad-laptop: Stop writing VPCCMD_W_TOUCHPAD at probe time platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models platform/x86: ideapad-laptop: Only toggle ps2 aux port on/off on select models platform/x86: ideapad-laptop: Do not send KEY_TOUCHPAD* events on probe / resume platform/x86: ideapad-laptop: Refactor ideapad_sync_touchpad_state() tools/arch/x86: intel_sdsi: Add support for reading meter certificates tools/arch/x86: intel_sdsi: Add support for new GUID tools/arch/x86: intel_sdsi: Read more On Demand registers ... commit e291c116f60f3c1ca98090f0f8e7c77e658562fb Merge: 8c9a59939deb4 c3991107a28a5 Author: Dmitry Torokhov Date: Mon Dec 12 10:47:03 2022 -0800 Merge branch 'next' into for-linus Prepare input updates for 6.2 merge window. commit 01f3cbb296a9ad378167c01758c99557b5bc3208 Merge: 8e17b16a2c134 c83ce312081cf Author: Linus Torvalds Date: Mon Dec 12 10:21:03 2022 -0800 Merge tag 'soc-dt-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC DT updates from Arnd Bergmann: "The devicetree changes contain exactly 1000 non-merge changesets, including a number of new arm64 SoC variants from Qualcomm and Apple, as well as the Renesas r9a07g043f/u chip in both arm64 and riscv variants. While we have occasionally merged support for non-arm SoCs in the past, this is now the normal path for riscv devicetree files. The most notable changes, by SoC platform, are: - The Apple T6000 (M1 Pro), T6001 (M1 Max) and T6002 (M1 Ultra) chips now have initial support. This is particularly nice as I am typing this on a T6002 Mac Studio with only a small number of driver patches. - Qualcomm MSM8996 Pro (Snapdragon 821), SM6115 (Snapdragon 662), SM4250 (Snapdragon 460), SM6375 (Snapdragon 695), SDM670 (Snapdragon 670), MSM8976 (Snapdragon 652) and MSM8956 (Snapdragon 650) are all mobile phone chips that are closely related to others we already support. Adding those helps support more phones and we add several models from Sony (Xperia 10 IV, 5 IV, X, and X compact), OnePlus (One, 3, 3T, and Nord N100), Xiaomi (Poco F1, Mi6), Huawei (Watch) and Google (Pixel 3a). There are also new variants of the Herobrine and Trogdor chromebook motherboards. SA8540P is an automotive SoC used in the Qdrive-3 development platform - Rockchips gains no new SoC variants, but a lot of new boards: three mobile gaming systems based on RK3326 Odroid-Go/rg351 family, two more Anbernic gaming systems based on RK3566 and a number of other RK356x based single-board computers. - Renesas RZ/G2UL (r9a07g043) was already supported for arm64, but as the newly added RZ/Five is based on the same design, this now gets reorganized in order to share most of the dts description between the two and add the RZ/Five SMARC EVK board support. Aside from that, there are the usual changes all over the tree: - New boards on other platforms contain two ASpeed BMC users, two Broadcom based Wifi routers, Zyxel NSA310S NAS, the i.MX6 based Kobo Aura2 ebook reader, two i.MX8 based development boards, two Uniphier Pro5 development boards, the STM32MP1 testbench board from DHCOR, the TI K3 based BeagleBone AI-64 board, and the Mediatek Helio X10 based Sony Xperia M5 phone. - The Starfive JH7100 source gets reorganized in order to support the VisionFive V1 board. - Minor updates and cleanups for Intel SoCFPGA, Marvell PXA168, TI, ST, NXP, Apple, Broadcom, Juno, Marvell MVEBU, at91, nuvoton, Tegra, Mediatek, Renesas, Hisilicon, Allwinner, Samsung, ux500, spear, ... The treewide cleanups now have a lot of fixes for cache nodes and other binding violoations. - Somewhat larger sets of reworks for NVIDIA Tegra, Qualcomm and Renesas platforms, adding a lot more on-chip device support - A rework of the way that DTB overlays are built" * tag 'soc-dt-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (979 commits) arm64: dts: apple: t6002: Fix GPU power domains arm64: dts: apple: t600x-pmgr: Fix search & replace typo arm64: dts: apple: Add t8103 L1/L2 cache properties and nodes arm64: dts: apple: Rename dart-sio* to sio-dart* arch: arm64: apple: t600x: Use standard "iommu" node name arch: arm64: apple: t8103: Use standard "iommu" node name ARM: dts: socfpga: Fix pca9548 i2c-mux node name dt-bindings: iio: adc: qcom,spmi-vadc: fix PM8350 define dt-bindings: iio: adc: qcom,spmi-vadc: extend example arm64: dts: qcom: sc8280xp: fix UFS DMA coherency arm64: dts: qcom: sc7280: Add DT for sc7280-herobrine-zombie arm64: dts: qcom: sm8250-sony-xperia-edo: fix no-mmc property for SDHCI arm64: dts: qcom: sdm845-sony-xperia-tama: fix no-mmc property for SDHCI arm64: dts: qcom: sda660-inforce-ifc6560: fix no-mmc property for SDHCI arm64: dts: qcom: sa8155p-adp: fix no-mmc property for SDHCI arm64: dts: qcom: qrb5165-rb: fix no-mmc property for SDHCI arm64: dts: qcom: sm8450: align MMC node names with dtschema arm64: dts: qcom: sc7180-trogdor: use generic node names arm64: dts: qcom: sm8450-hdk: add sound support arm64: dts: qcom: sm8450: add Soundwire and LPASS ... commit 8e17b16a2c13406c56a4d292df3ca083f8729666 Merge: 69700db4212ac 9379885d07c46 Author: Linus Torvalds Date: Mon Dec 12 10:17:08 2022 -0800 Merge tag 'soc-drivers-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Arnd Bergmann: "There are few major updates in the SoC specific drivers, mainly the usual reworks and support for variants of the existing SoC. While this remains Arm centric for the most part, the branch now also contains updates to risc-v and loongarch specific code in drivers/soc/. Notable changes include: - Support for the newly added Qualcomm Snapdragon variants (MSM8956, MSM8976, SM6115, SM4250, SM8150, SA8155 and SM8550) in the soc ID, rpmh, rpm, spm and powerdomain drivers. - Documentation for the somewhat controversial qcom,board-id properties that are required for booting a number of machines - A new SoC identification driver for the loongson-2 (loongarch) platform - memory controller updates for stm32, tegra, and renesas. - a new DT binding to better describe LPDDR2/3/4/5 chips in the memory controller subsystem - Updates for Tegra specific drivers across multiple subsystems, improving support for newer SoCs and better identification - Minor fixes for Broadcom, Freescale, Apple, Renesas, Sifive, TI, Mediatek and Marvell SoC drivers" * tag 'soc-drivers-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (137 commits) soc: qcom: socinfo: Add SM6115 / SM4250 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for SM6115 / SM4250 and variants soc: qcom: socinfo: Add SM8150 and SA8155 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for SM8150 and SA8155 dt-bindings: soc: qcom: apr: document generic qcom,apr compatible soc: qcom: Select REMAP_MMIO for ICC_BWMON driver soc: qcom: Select REMAP_MMIO for LLCC driver soc: qcom: rpmpd: Add SM4250 support dt-bindings: power: rpmpd: Add SM4250 support dt-bindings: soc: qcom: aoss: Add compatible for SM8550 soc: qcom: llcc: Add configuration data for SM8550 dt-bindings: arm: msm: Add LLCC compatible for SM8550 soc: qcom: llcc: Add v4.1 HW version support soc: qcom: socinfo: Add SM8550 ID soc: qcom: rpmh-rsc: Avoid unnecessary checks on irq-done response soc: qcom: rpmh-rsc: Add support for RSC v3 register offsets soc: qcom: rpmhpd: Add SM8550 power domains dt-bindings: power: rpmpd: Add SM8550 to rpmpd binding soc: qcom: socinfo: Add MSM8956/76 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for MSM8956 and MSM8976 ... commit 68c62bee9d081cf815310b3a96e38d94fc16007d Author: Xiubo Li Date: Mon Oct 17 22:17:35 2022 +0800 ceph: try to check caps immediately after async creating finishes We should call the check_caps() again immediately after the async creating finishes in case the MDS is waiting for caps revocation to finish. Link: https://tracker.ceph.com/issues/46904 Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit e4b731ccb0975fd97283e0c0d9841a89063ec31a Author: Xiubo Li Date: Tue Oct 18 09:03:29 2022 +0800 ceph: remove useless session parameter for check_caps() The session parameter makes no sense any more. Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 69700db4212ac784130f63a350b1ede3b7184494 Merge: 5910b842c489e 8b7f4dd738795 Author: Linus Torvalds Date: Mon Dec 12 10:14:52 2022 -0800 Merge tag 'soc-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC code updates from Arnd Bergmann: "This time there are only fairly minor cleanups across the i.MX, ixp4xx, ux500 and renesas platforms. The only notable update is a change to the keystone2 platform to switch switch it over to standard PSCI SMP bringup, which apparently was present in the shipped firmware almost from the start" * tag 'soc-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: ixp4xx: Remove unused debug iomap MAINTAINERS: Add DHCOR to the DH electronic i.MX6 board support ARM: ixp4xx: Remove unused static map MAINTAINERS: adjust ARM/INTEL IXP4XX ARM ARCHITECTURE to ixp4xx clean-up ARM: imx3: Remove unneeded #include ARM: mxs: Remove unneeded #include riscv: Kconfig.socs: Add ARCH_RENESAS kconfig option ARM: ux500: Drop unused register file ARM: ux500: do not directly dereference __iomem arm/mach-ux500: fix repeated words in comments arm64: renesas: Drop selecting GPIOLIB and PINCTRL ARM: shmobile: Drop selecting GPIOLIB and PINCTRL ARM: keystone: Replace platform SMP with PSCI soc: renesas: Kconfig: Explicitly select GPIOLIB and PINCTRL config under SOC_RENESAS commit 5910b842c489ec40866182d1b2acf7d20c2bc83f Merge: 06cff4a58e7df 93b8c91e4cdb5 Author: Linus Torvalds Date: Mon Dec 12 10:10:16 2022 -0800 Merge tag 'soc-defconfig-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Arnd Bergmann: "This contains the ususal arm and arm64 updates to defconfig files, enabling newly added drivers and adapting the files to Kconfig changes, in particular for qualcomm, microchip, and nxp SoC platforms" * tag 'soc-defconfig-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits) arm64: defconfig: Enable Qualcomm SM6115 / SM4250 GCC and Pinctrl arm64: defconfig: Enable Qualcomm SM6115 / SM4250 GCC and Pinctrl ARM: configs: multi_v7: switch to new MICROCHIP_ISC driver ARM: configs: sama5/7: switch to new MICROCHIP_ISC driver ARM: multi_v7_defconfig: enable Type-C UCSI and STM32G0 as modules arm64: defconfig: Enable Renesas R-Car S4-8 Spider Ethernet devices arm: configs: spear6xx: Enable PL110 display controller arm: configs: spear6xx: Refresh defconfig arm64: defconfig: Enable HTE config arm64: defconfig: Enable missing configs for mt8183-jacuzzi-juniper arm64: defconfig: Add Renesas 9-series PCIe clock generator riscv: configs: defconfig: Enable Renesas RZ/Five SoC ARM: imx_v6_v7_defconfig: Enable the cyttsp5 touchscreen arm64: defconfig: Enable Tegra186 timer support arm64: defconfig: build-in Qualcomm SC7180 and SM8450 interconnects arm64: defconfig: Enable Qualcomm QCE crypto arm64: defconfig: Enable TI_TFP410 DVI bridge ARM: configs: at91: sama7: add config for thermal management ARM: configs: at91: sama7: add config for microchip otpc ARM: configs: at91: sama7: use make savedefconfig ... commit 06cff4a58e7dfa018c5f8a6ebdc3ff12745e0bae Merge: 164f59000c19f 5f4c374760b03 Author: Linus Torvalds Date: Mon Dec 12 09:50:05 2022 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "The highlights this time are support for dynamically enabling and disabling Clang's Shadow Call Stack at boot and a long-awaited optimisation to the way in which we handle the SVE register state on system call entry to avoid taking unnecessary traps from userspace. Summary: ACPI: - Enable FPDT support for boot-time profiling - Fix CPU PMU probing to work better with PREEMPT_RT - Update SMMUv3 MSI DeviceID parsing to latest IORT spec - APMT support for probing Arm CoreSight PMU devices CPU features: - Advertise new SVE instructions (v2.1) - Advertise range prefetch instruction - Advertise CSSC ("Common Short Sequence Compression") scalar instructions, adding things like min, max, abs, popcount - Enable DIT (Data Independent Timing) when running in the kernel - More conversion of system register fields over to the generated header CPU misfeatures: - Workaround for Cortex-A715 erratum #2645198 Dynamic SCS: - Support for dynamic shadow call stacks to allow switching at runtime between Clang's SCS implementation and the CPU's pointer authentication feature when it is supported (complete with scary DWARF parser!) Tracing and debug: - Remove static ftrace in favour of, err, dynamic ftrace! - Seperate 'struct ftrace_regs' from 'struct pt_regs' in core ftrace and existing arch code - Introduce and implement FTRACE_WITH_ARGS on arm64 to replace the old FTRACE_WITH_REGS - Extend 'crashkernel=' parameter with default value and fallback to placement above 4G physical if initial (low) allocation fails SVE: - Optimisation to avoid disabling SVE unconditionally on syscall entry and just zeroing the non-shared state on return instead Exceptions: - Rework of undefined instruction handling to avoid serialisation on global lock (this includes emulation of user accesses to the ID registers) Perf and PMU: - Support for TLP filters in Hisilicon's PCIe PMU device - Support for the DDR PMU present in Amlogic Meson G12 SoCs - Support for the terribly-named "CoreSight PMU" architecture from Arm (and Nvidia's implementation of said architecture) Misc: - Tighten up our boot protocol for systems with memory above 52 bits physical - Const-ify static keys to satisty jump label asm constraints - Trivial FFA driver cleanups in preparation for v1.1 support - Export the kernel_neon_* APIs as GPL symbols - Harden our instruction generation routines against instrumentation - A bunch of robustness improvements to our arch-specific selftests - Minor cleanups and fixes all over (kbuild, kprobes, kfence, PMU, ...)" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (151 commits) arm64: kprobes: Return DBG_HOOK_ERROR if kprobes can not handle a BRK arm64: kprobes: Let arch do_page_fault() fix up page fault in user handler arm64: Prohibit instrumentation on arch_stack_walk() arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64: alternatives: add __init/__initconst to some functions/variables arm_pmu: Drop redundant armpmu->map_event() in armpmu_event_init() kselftest/arm64: Allow epoll_wait() to return more than one result kselftest/arm64: Don't drain output while spawning children kselftest/arm64: Hold fp-stress children until they're all spawned arm64/sysreg: Remove duplicate definitions from asm/sysreg.h arm64/sysreg: Convert ID_DFR1_EL1 to automatic generation arm64/sysreg: Convert ID_DFR0_EL1 to automatic generation arm64/sysreg: Convert ID_AFR0_EL1 to automatic generation arm64/sysreg: Convert ID_MMFR5_EL1 to automatic generation arm64/sysreg: Convert MVFR2_EL1 to automatic generation arm64/sysreg: Convert MVFR1_EL1 to automatic generation arm64/sysreg: Convert MVFR0_EL1 to automatic generation arm64/sysreg: Convert ID_PFR2_EL1 to automatic generation arm64/sysreg: Convert ID_PFR1_EL1 to automatic generation arm64/sysreg: Convert ID_PFR0_EL1 to automatic generation ... commit 164f59000c19fa1ee5d09327a8055ec9f9b9905a Merge: 7d62159919c90 5cfe469c2654c Author: Linus Torvalds Date: Mon Dec 12 09:37:09 2022 -0800 Merge tag 'microblaze-v6.2' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze updates from Michal Simek: "Clean up PCI support which was pretty much copied and pasted from PowerPC long time ago for one custom platform which is not available for years. Also, the Xilinx/AMD PCIe team tested Microblaze with IP cores also used on ARM SOCs and clean up Microblaze code" * tag 'microblaze-v6.2' of git://git.monstr.eu/linux-2.6-microblaze: microblaze/PCI: Moving PCI iounmap and dependent code microblaze/PCI: Remove support for Xilinx PCI host bridge microblaze/PCI: Remove unused pci_iobar_pfn() and et al declarations microblaze/PCI: Remove unused sys_pciconfig_iobase() and et al declaration microblaze/PCI: Remove unused pci_address_to_pio() conversion of CPU address to I/O port microblaze/PCI: Remove unused PCI Indirect ops microblaze/PCI: Remove unused PCI BIOS resource allocation microblaze/PCI: Remove unused allocation & free of PCI host bridge structure microblaze/PCI: Remove unused device tree parsing for a host bridge resources microblaze/PCI: Remove unused PCI legacy IO's access on a bus microblaze/PCI: Remove unused PCI bus scan if configured as a host microblaze/PCI: Remove Null PCI config access unused functions microblaze/PCI: Remove unused early_read_config_byte() et al declarations commit 7d62159919c90fbcd9ee808e9f1b776eae990d53 Merge: 43686598b5578 32c97d980e2ee Author: Linus Torvalds Date: Mon Dec 12 09:34:16 2022 -0800 Merge tag 'hyperv-next-signed-20221208' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Drop unregister syscore from hyperv_cleanup to avoid hang (Gaurav Kohli) - Clean up panic path for Hyper-V framebuffer (Guilherme G. Piccoli) - Allow IRQ remapping to work without x2apic (Nuno Das Neves) - Fix comments (Olaf Hering) - Expand hv_vp_assist_page definition (Saurabh Sengar) - Improvement to page reporting (Shradha Gupta) - Make sure TSC clocksource works when Linux runs as the root partition (Stanislav Kinsburskiy) * tag 'hyperv-next-signed-20221208' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Remove unregister syscore call from Hyper-V cleanup iommu/hyper-v: Allow hyperv irq remapping without x2apic clocksource: hyper-v: Add TSC page support for root partition clocksource: hyper-v: Use TSC PFN getter to map vvar page clocksource: hyper-v: Introduce TSC PFN getter clocksource: hyper-v: Introduce a pointer to TSC page x86/hyperv: Expand definition of struct hv_vp_assist_page PCI: hv: update comment in x86 specific hv_arch_irq_unmask hv: fix comment typo in vmbus_channel/low_latency drivers: hv, hyperv_fb: Untangle and refactor Hyper-V panic notifiers video: hyperv_fb: Avoid taking busy spinlock on panic path hv_balloon: Add support for configurable order free page reporting mm/page_reporting: Add checks for page_reporting_order param commit c3ec1e8964fb0ca00c79936160a027bd8b47e140 Merge: d01404fa7b8c7 de57ecc476103 Author: Palmer Dabbelt Date: Mon Dec 12 09:30:37 2022 -0800 Merge patch series "RISC-V: Align the shadow stack" Palmer Dabbelt says: This contains a pair of cleanups that depend on a fix that has already landed upstream. * b4-shazam-merge: RISC-V: Add some comments about the shadow and overflow stacks RISC-V: Align the shadow stack riscv: fix race when vmap stack overflow Link: https://lore.kernel.org/r/20221130023515.20217-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit de57ecc476103179e93fd85091770921f76a19af Author: Palmer Dabbelt Date: Tue Nov 29 18:35:15 2022 -0800 RISC-V: Add some comments about the shadow and overflow stacks It took me a while to page all this back in when trying to review the recent spin_shadow_stack, so I figured I'd just write up some comments. Reviewed-by: Guo Ren Reviewed-by: Jisheng Zhang Link: https://lore.kernel.org/r/20221130023515.20217-2-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit b003b3b77d65133a0011ae3b7b255347438c12f6 Author: Palmer Dabbelt Date: Tue Nov 29 18:35:14 2022 -0800 RISC-V: Align the shadow stack The standard RISC-V ABIs all require 16-byte stack alignment. We're only calling that one function on the shadow stack so I doubt it'd result in a real issue, but might as well keep this lined up. Fixes: 31da94c25aea ("riscv: add VMAP_STACK overflow detection") Reviewed-by: Jisheng Zhang Link: https://lore.kernel.org/r/20221130023515.20217-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 43686598b55785bfc1f961b3731b2302fe08f393 Merge: 893660b0e1c8d eaabc245b02a0 Author: Linus Torvalds Date: Mon Dec 12 09:24:26 2022 -0800 Merge tag 'tpmdd-next-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "A random collection of TPM fixes and one bug fix for trusted keys" * tag 'tpmdd-next-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: st33zp24: remove pointless checks on probe tpm/tpm_crb: Fix error message in __crb_relinquish_locality() tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: acpi: Call acpi_put_table() to fix memory leak tpm: Add flag to use default cancellation policy tpm: tis_i2c: Fix sanity check interrupt enable mask KEYS: trusted: tee: Make registered shm dependency explicit tpm: Avoid function type cast of put_device() tpm: st33zp24: switch to using gpiod API tpm: st33zp24: drop support for platform data commit 893660b0e1c8d127960ae921f55983b435664e15 Merge: 98d0052d0d9dc dc19745ad0e46 Author: Linus Torvalds Date: Mon Dec 12 09:13:06 2022 -0800 Merge tag 'slab-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - SLOB deprecation and SLUB_TINY The SLOB allocator adds maintenance burden and stands in the way of API improvements [1]. Deprecate it by renaming the config option (to make users notice) to CONFIG_SLOB_DEPRECATED with updated help text. SLUB should be used instead as SLAB will be the next on the removal list. Based on reports from a riscv k210 board with 8MB RAM, add a CONFIG_SLUB_TINY option to minimize SLUB's memory usage at the expense of scalability. This has resolved the k210 regression [2] so in case there are no others (that wouldn't be resolvable by further tweaks to SLUB_TINY) plan is to remove SLOB in a few cycles. Existing defconfigs with CONFIG_SLOB are converted to CONFIG_SLUB_TINY. - kmalloc() slub_debug redzone improvements A series from Feng Tang that builds on the tracking or requested size for kmalloc() allocations (for caches with debugging enabled) added in 6.1, to make redzone checks consider the requested size and not the rounded up one, in order to catch more subtle buffer overruns. Includes new slub_kunit test. - struct slab fields reordering to accomodate larger rcu_head RCU folks would like to grow rcu_head with debugging options, which breaks current struct slab layout's assumptions, so reorganize it to make this possible. - Miscellaneous improvements/fixes: - __alloc_size checking compiler workaround (Kees Cook) - Optimize and cleanup SLUB's sysfs init (Rasmus Villemoes) - Make SLAB compatible with PROVE_RAW_LOCK_NESTING (Jiri Kosina) - Correct SLUB's percpu allocation estimates (Baoquan He) - Re-enableS LUB's run-time failslab sysfs control (Alexander Atanasov) - Make tools/vm/slabinfo more user friendly when not run as root (Rong Tao) - Dead code removal in SLUB (Hyeonggon Yoo) * tag 'slab-for-6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (31 commits) mm, slob: rename CONFIG_SLOB to CONFIG_SLOB_DEPRECATED mm, slub: don't aggressively inline with CONFIG_SLUB_TINY mm, slub: remove percpu slabs with CONFIG_SLUB_TINY mm, slub: split out allocations from pre/post hooks mm/slub, kunit: Add a test case for kmalloc redzone check mm/slub, kunit: add SLAB_SKIP_KFENCE flag for cache creation mm, slub: refactor free debug processing mm, slab: ignore SLAB_RECLAIM_ACCOUNT with CONFIG_SLUB_TINY mm, slub: don't create kmalloc-rcl caches with CONFIG_SLUB_TINY mm, slub: lower the default slub_max_order with CONFIG_SLUB_TINY mm, slub: retain no free slabs on partial list with CONFIG_SLUB_TINY mm, slub: disable SYSFS support with CONFIG_SLUB_TINY mm, slub: add CONFIG_SLUB_TINY mm, slab: ignore hardened usercopy parameters when disabled slab: Remove special-casing of const 0 size allocations slab: Clean up SLOB vs kmalloc() definition mm/sl[au]b: rearrange struct slab fields to allow larger rcu_head mm/migrate: make isolate_movable_page() skip slab pages mm/slab: move and adjust kernel-doc for kmem_cache_alloc mm/slub, percpu: correct the calculation of early percpu allocation size ... commit 98d0052d0d9dcd5323833482712b5799ed0bbb0b Merge: 73fa58dca8029 6b2b0d839acaa Author: Linus Torvalds Date: Mon Dec 12 09:01:36 2022 -0800 Merge tag 'printk-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Add NMI-safe SRCU reader API. It uses atomic_inc() instead of this_cpu_inc() on strong load-store architectures. - Introduce new console_list_lock to synchronize a manipulation of the list of registered consoles and their flags. This is a first step in removing the big-kernel-lock-like behavior of console_lock(). This semaphore still serializes console->write() calbacks against: - each other. It primary prevents potential races between early and proper console drivers using the same device. - suspend()/resume() callbacks and init() operations in some drivers. - various other operations in the tty/vt and framebufer susbsystems. It is likely that console_lock() serializes even operations that are not directly conflicting with the console->write() callbacks here. This is the most complicated big-kernel-lock aspect of the console_lock() that will be hard to untangle. - Introduce new console_srcu lock that is used to safely iterate and access the registered console drivers under SRCU read lock. This is a prerequisite for introducing atomic console drivers and console kthreads. It will reduce the complexity of serialization against normal consoles and console_lock(). Also it should remove the risk of deadlock during critical situations, like Oops or panic, when only atomic consoles are registered. - Check whether the console is registered instead of enabled on many locations. It was a historical leftover. - Cleanly force a preferred console in xenfb code instead of a dirty hack. - A lot of code and comment clean ups and improvements. * tag 'printk-for-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: (47 commits) printk: htmldocs: add missing description tty: serial: sh-sci: use setup() callback for early console printk: relieve console_lock of list synchronization duties tty: serial: kgdboc: use console_list_lock to trap exit tty: serial: kgdboc: synchronize tty_find_polling_driver() and register_console() tty: serial: kgdboc: use console_list_lock for list traversal tty: serial: kgdboc: use srcu console list iterator proc: consoles: use console_list_lock for list iteration tty: tty_io: use console_list_lock for list synchronization printk, xen: fbfront: create/use safe function for forcing preferred netconsole: avoid CON_ENABLED misuse to track registration usb: early: xhci-dbc: use console_is_registered() tty: serial: xilinx_uartps: use console_is_registered() tty: serial: samsung_tty: use console_is_registered() tty: serial: pic32_uart: use console_is_registered() tty: serial: earlycon: use console_is_registered() tty: hvc: use console_is_registered() efi: earlycon: use console_is_registered() tty: nfcon: use console_is_registered() serial_core: replace uart_console_enabled() with uart_console_registered() ... commit 73fa58dca80293320f5cfeb06f5b2daeb8d97bd5 Merge: 7fc035058eab3 f2f2494c8aa3c Author: Linus Torvalds Date: Mon Dec 12 08:52:53 2022 -0800 Merge tag 'locks-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "The main change here is to add the new locks_inode_context helper, and convert all of the places that dereference inode->i_flctx directly to use that instead. There is a new helper to indicate whether any locks are held on an inode. This is mostly for Ceph but may be usable elsewhere too. Andi Kleen requested that we print the PID when the LOCK_MAND warning fires, to help track down applications trying to use it. Finally, we added some new warnings to some of the file locking functions that fire when the ->fl_file and filp arguments differ. This helped us find some long-standing bugs in lockd. Patches for those are in Chuck Lever's tree and should be in his v6.2 PR. After that patch, people using NFSv2/v3 locking may see some warnings fire until those go in. Happy Holidays!" * tag 'locks-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: Add process name and pid to locks warning nfsd: use locks_inode_context helper nfs: use locks_inode_context helper lockd: use locks_inode_context helper ksmbd: use locks_inode_context helper cifs: use locks_inode_context helper ceph: use locks_inode_context helper filelock: add a new locks_inode_context accessor function filelock: new helper: vfs_inode_has_locks filelock: WARN_ON_ONCE when ->fl_file and filp don't match commit 7fc035058eab3a485060374d78012708524ca133 Merge: 667161ba0a1c5 6a46bf558803d Author: Linus Torvalds Date: Mon Dec 12 08:42:29 2022 -0800 Merge tag 'execve-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: "Most are small refactorings and bug fixes, but three things stand out: switching timens (which got reverted before) looks solid now, FOLL_FORCE has been removed (no failures seen yet across several weeks in -next), and some whitespace cleanups (which are long overdue). - Add timens support (when switching mm). This version has survived in -next for the entire cycle (Andrei Vagin) - Various small bug fixes, refactoring, and readability improvements (Bernd Edlinger, Rolf Eike Beer, Bo Liu, Li Zetao Liu Shixin) - Remove FOLL_FORCE for stack setup (Kees Cook) - Whitespace cleanups (Rolf Eike Beer, Kees Cook)" * tag 'execve-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_misc: fix shift-out-of-bounds in check_special_flags binfmt: Fix error return code in load_elf_fdpic_binary() exec: Remove FOLL_FORCE for stack setup binfmt_elf: replace IS_ERR() with IS_ERR_VALUE() binfmt_elf: simplify error handling in load_elf_phdrs() binfmt_elf: fix documented return value for load_elf_phdrs() exec: simplify initial stack size expansion binfmt: Fix whitespace issues exec: Add comments on check_unsafe_exec() fs counting ELF uapi: add spaces before '{' selftests/timens: add a test for vfork+exit fs/exec: switch timens when a task gets a new mm commit 667161ba0a1c5badc5c40fc45cf62a6d62883710 Merge: 059c4a341df7d b9069728a70c2 Author: Linus Torvalds Date: Mon Dec 12 08:34:05 2022 -0800 Merge tag 'seccomp-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: - Add missing kerndoc parameter (Randy Dunlap) - Improve seccomp selftest to check CAP_SYS_ADMIN (Gautam Menghani) - Fix allocation leak when cloned thread immediately dies (Kuniyuki Iwashima) * tag 'seccomp-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: document the "filter_count" field seccomp: Move copy_seccomp() to no failure path. selftests/seccomp: Check CAP_SYS_ADMIN capability in the test mode_filter_without_nnp commit 059c4a341df7dbaab0a30a8e5420b619518f8887 Merge: 3a28c2c89f4b4 e6b842741b4f3 Author: Linus Torvalds Date: Mon Dec 12 08:31:13 2022 -0800 Merge tag 'pstore-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: "A small collection of bug fixes, refactorings, and general improvements: - Reporting improvements and return path fixes (Guilherme G. Piccoli, Wang Yufen, Kees Cook) - Clean up kmsg_bytes module parameter usage (Guilherme G. Piccoli) - Add Guilherme to pstore MAINTAINERS entry - Choose friendlier allocation flags (Qiujun Huang, Stephen Boyd)" * tag 'pstore-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP pstore/ram: Fix error return code in ramoops_probe() pstore: Alert on backend write error MAINTAINERS: Update pstore maintainers pstore/ram: Set freed addresses to NULL pstore/ram: Move internal definitions out of kernel-wide include pstore/ram: Move pmsg init earlier pstore/ram: Consolidate kfree() paths efi: pstore: Follow convention for the efi-pstore backend name pstore: Inform unregistered backend names as well pstore: Expose kmsg_bytes as a module parameter pstore: Improve error reporting in case of backend overlap pstore/zone: Use GFP_ATOMIC to allocate zone buffer commit 3a28c2c89f4b412b648761430720d40a8dc326ef Merge: 74dc488b2a1be 0445d1bae1cce Author: Linus Torvalds Date: Mon Dec 12 08:12:27 2022 -0800 Merge tag 'unsigned-char-6.2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux Pull unsigned-char conversion from Jason Donenfeld: "Enable -funsigned-char and fix code affected by that flag. During the 6.1 cycle, several patches already made it into the tree, which were for code that was already broken on at least one architecture, where the naked char had a different sign than the code author anticipated, or were part of some bug fix for an existing bug that this initiative unearthed. These 6.1-era fixes are: 648060902aa3 ("MIPS: pic32: treat port as signed integer") 5c26159c97b3 ("ipvs: use explicitly signed chars") e6cb8769452e ("wifi: airo: do not assign -1 to unsigned char") 937ec9f7d5f2 ("staging: rtl8192e: remove bogus ssid character sign test") 677047383296 ("misc: sgi-gru: use explicitly signed char") 50895a55bcfd ("ALSA: rme9652: use explicitly signed char") ee03c0f200eb ("ALSA: au88x0: use explicitly signed char") 835bed1b8395 ("fbdev: sisfb: use explicitly signed char") 50f19697dd76 ("parisc: Use signed char for hardware path in pdc.h") 66063033f77e ("wifi: rt2x00: use explicitly signed or unsigned types") Regarding patches in this pull: - There is one patch in this pull that should have made it to you during 6.1 ("media: stv0288: use explicitly signed char"), but the maintainer was MIA during the cycle, so it's in here instead. - Two patches fix single architecture code affected by unsigned char ("perf/x86: Make struct p4_event_bind::cntr signed array" and "sparc: sbus: treat CPU index as integer"), while one patch fixes an unused typedef, in case it's ever used in the future ("media: atomisp: make hive_int8 explictly signed"). - Finally, there's the change to actually enable -funsigned-char ("kbuild: treat char as always unsigned") and then the removal of some no longer useful !__CHAR_UNSIGNED__ selftest code ("lib: assume char is unsigned"). The various fixes were found with a combination of diffing objdump output, a large variety of Coccinelle scripts, and plain old grep. In the end, things didn't seem as bad as I feared they would. But of course, it's also possible I missed things. However, this has been in linux-next for basically an entire cycle now, so I'm not overly worried. I've also been daily driving this on my laptop for all of 6.1. Still, this series, and the ones sent for 6.1 don't total in quantity to what I thought it'd be, so I will be on the lookout for breakage. We could receive a few reports that are quickly fixable. Hopefully we won't receive a barrage of reports that would result in a revert. And just maybe we won't receive any reports at all and nobody will even notice. Knock on wood" * tag 'unsigned-char-6.2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux: lib: assume char is unsigned kbuild: treat char as always unsigned media: atomisp: make hive_int8 explictly signed media: stv0288: use explicitly signed char sparc: sbus: treat CPU index as integer perf/x86: Make struct p4_event_bind::cntr signed array commit 74dc488b2a1bee840f3cf29a4262e0b1184a4f5d Merge: f433cf2102fec 4a95be7ed7669 Author: Linus Torvalds Date: Mon Dec 12 08:08:12 2022 -0800 Merge tag 'nolibc.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Further improvements to nolibc testing * tag 'nolibc.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: selftests/nolibc: Always rebuild the sysroot when running a test selftests/nolibc: Add 7 tests for memcmp() commit f433cf2102fec78cf05ece06fb8e24fbfc6a64d8 Merge: 5517a2eaec8f5 144b9152791ff Author: Linus Torvalds Date: Mon Dec 12 08:03:49 2022 -0800 Merge tag 'kcsan.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull KCSAN updates from Paul McKenney: - Add instrumentation for memcpy(), memset(), and memmove() for Clang v16+'s new function names that are used when the -fsanitize=thread argument is given - Fix objtool warnings from KCSAN's volatile instrumentation, and typos in a pair of Kconfig options' help clauses * tag 'kcsan.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: kcsan: Fix trivial typo in Kconfig help comments objtool, kcsan: Add volatile read/write instrumentation to whitelist kcsan: Instrument memcpy/memset/memmove with newer Clang commit 5517a2eaec8f525506867988adc6cfe1c414c90a Merge: 1fab45ab6e823 ee5a86f451f7c Author: Linus Torvalds Date: Mon Dec 12 07:58:41 2022 -0800 Merge tag 'lkmm.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull kernel memory model documentation updates from Paul McKenney: - Update the LKMM documentation, both in English and in Korean * tag 'lkmm.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: docs/memory-barriers.txt/kokr: Fix confusing name of 'data dependency barrier' docs/memory-barriers.txt/kokr: Add memory barrier dma_mb() docs/memory-barriers.txt/kokr: introduce io_stop_wc() and add implementation for ARM64 docs/memory-barriers.txt: Add a missed closing parenthesis tools/memory-model: Weaken ctrl dependency definition in explanation.txt commit 3e12758392bee50135301b0189c064ab80980aca Author: Steven Rostedt (Google) Date: Mon Dec 12 10:37:03 2022 -0500 x86/mm/kmmio: Remove redundant preempt_disable() Now that kmmio uses rcu_read_lock_sched_notrace() there's no reason to call preempt_disable() as the read_lock_sched_notrace() already does that and is redundant. This also removes the preempt_enable_no_resched() as the "no_resched()" portion was bogus as there's no reason to do that. Link: https://lkml.kernel.org/r/20221212103703.7129cc5d@gandalf.local.home Cc: Masami Hiramatsu Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Borislav Petkov Cc: "x86@kernel.org" Cc: Karol Herbst Cc: Pekka Paalanen Cc: Dave Hansen Cc: Andy Lutomirski Cc: Ingo Molnar Signed-off-by: Steven Rostedt (Google) commit 75b15aa0d83ec835082129b62e8cb9a44703ad72 Merge: 7d4b19ab6b899 3a3073b69c76a Author: Rafael J. Wysocki Date: Mon Dec 12 16:54:14 2022 +0100 Merge branch 'thermal-intel' Merge one more Intel thermal control change for 6.2-rc1: - Remove a pointless die_id chec from the Intel HFI thermal control driver (Ricardo Neri). * thermal-intel: thermal: intel: hfi: Remove a pointless die_id check commit 1fab45ab6e823f9d7e5bc9520b2aa6564d6d58a7 Merge: 830b3c68c1fb1 87492c06e68d8 Author: Linus Torvalds Date: Mon Dec 12 07:47:15 2022 -0800 Merge tag 'rcu.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: - Documentation updates. This is the second in a series from an ongoing review of the RCU documentation. - Miscellaneous fixes. - Introduce a default-off Kconfig option that depends on RCU_NOCB_CPU that, on CPUs mentioned in the nohz_full or rcu_nocbs boot-argument CPU lists, causes call_rcu() to introduce delays. These delays result in significant power savings on nearly idle Android and ChromeOS systems. These savings range from a few percent to more than ten percent. This series also includes several commits that change call_rcu() to a new call_rcu_hurry() function that avoids these delays in a few cases, for example, where timely wakeups are required. Several of these are outside of RCU and thus have acks and reviews from the relevant maintainers. - Create an srcu_read_lock_nmisafe() and an srcu_read_unlock_nmisafe() for architectures that support NMIs, but which do not provide NMI-safe this_cpu_inc(). These NMI-safe SRCU functions are required by the upcoming lockless printk() work by John Ogness et al. - Changes providing minor but important increases in torture test coverage for the new RCU polled-grace-period APIs. - Changes to torturescript that avoid redundant kernel builds, thus providing about a 30% speedup for the torture.sh acceptance test. * tag 'rcu.2022.12.02a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (49 commits) net: devinet: Reduce refcount before grace period net: Use call_rcu_hurry() for dst_release() workqueue: Make queue_rcu_work() use call_rcu_hurry() percpu-refcount: Use call_rcu_hurry() for atomic switch scsi/scsi_error: Use call_rcu_hurry() instead of call_rcu() rcu/rcutorture: Use call_rcu_hurry() where needed rcu/rcuscale: Use call_rcu_hurry() for async reader test rcu/sync: Use call_rcu_hurry() instead of call_rcu rcuscale: Add laziness and kfree tests rcu: Shrinker for lazy rcu rcu: Refactor code a bit in rcu_nocb_do_flush_bypass() rcu: Make call_rcu() lazy to save power rcu: Implement lockdep_rcu_enabled for !CONFIG_DEBUG_LOCK_ALLOC srcu: Debug NMI safety even on archs that don't require it srcu: Explain the reason behind the read side critical section on GP start srcu: Warn when NMI-unsafe API is used in NMI arch/s390: Add ARCH_HAS_NMI_SAFE_THIS_CPU_OPS Kconfig option arch/loongarch: Add ARCH_HAS_NMI_SAFE_THIS_CPU_OPS Kconfig option rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() rcu-tasks: Make grace-period-age message human-readable ... commit 0612d748003ce7bcd0d67a8d270900fcdadb1009 Author: Gongjun Song Date: Mon Dec 12 16:55:27 2022 +0800 ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product The unique ID is determined by the ADR pin level of rt1318. ODM changed design, update codec addr to match new design. Fixes: 0050e3d3d43d ("ASoC: Intel: soc-acpi: add SKU 0C11 SoundWire configuration") Signed-off-by: Gongjun Song Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20221212085527.1886168-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 6d94d0090527b1763872275a7ccd44df7219b31e Author: Wang Jingjin Date: Thu Dec 8 14:39:00 2022 +0800 ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() rk_spdif_runtime_resume() may have called clk_prepare_enable() before return from failed branches, add missing clk_disable_unprepare() in this case. Fixes: f874b80e1571 ("ASoC: rockchip: Add rockchip SPDIF transceiver driver") Signed-off-by: Wang Jingjin Link: https://lore.kernel.org/r/20221208063900.4180790-1-wangjingjin1@huawei.com Signed-off-by: Mark Brown commit 9529dc167ffcdfd201b9f0eda71015f174095f7e Author: Marek Szyprowski Date: Fri Dec 9 10:16:57 2022 +0100 ASoC: wm8994: Fix potential deadlock Fix this by dropping wm8994->accdet_lock while calling cancel_delayed_work_sync(&wm8994->mic_work) in wm1811_jackdet_irq(). Fixes: c0cc3f166525 ("ASoC: wm8994: Allow a delay between jack insertion and microphone detect") Signed-off-by: Marek Szyprowski Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20221209091657.1183-1-m.szyprowski@samsung.com Signed-off-by: Mark Brown commit 83f1b7f39af73b01edf098fe3141404670703281 Author: YC Hung Date: Fri Dec 9 11:10:53 2022 +0800 ASoC: mediatek: mt8195: add sof be ops to check audio active In MT8195 SOF design, both DSP and audio driver would access audio registers. Before DSP accesses audio registers, audio power and clock should be enabled. DSP will hang up if DSP access audio register but audio power and clock are disabled. Therefore, we add audio pm runtime active checking before accessing audio registers in SOF BE's callback hw_params function to avoid this situation. Signed-off-by: YC Hung Reviewed-by: AngeloGioacchino Del Regno Acked-by: Curtis Malainey Link: https://lore.kernel.org/r/20221209031053.8444-1-yc.hung@mediatek.com Signed-off-by: Mark Brown commit 44fda61d2bcfb74a942df93959e083a4e8eff75f Author: Kai Vehmanen Date: Fri Dec 9 13:45:29 2022 +0200 ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown" The unregister machine drivers call is not safe to do when kexec is used. Kexec-lite gets blocked with following backtrace: [ 84.943749] Freezing user space processes ... (elapsed 0.111 seconds) done. [ 246.784446] INFO: task kexec-lite:5123 blocked for more than 122 seconds. [ 246.819035] Call Trace: [ 246.821782] [ 246.824186] __schedule+0x5f9/0x1263 [ 246.828231] schedule+0x87/0xc5 [ 246.831779] snd_card_disconnect_sync+0xb5/0x127 ... [ 246.889249] snd_sof_device_shutdown+0xb4/0x150 [ 246.899317] pci_device_shutdown+0x37/0x61 [ 246.903990] device_shutdown+0x14c/0x1d6 [ 246.908391] kernel_kexec+0x45/0xb9 This reverts commit 83bfc7e793b555291785136c3ae86abcdc046887. Reported-by: Ricardo Ribalda Cc: Ricardo Ribalda Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20221209114529.3909192-3-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 2aa2a5ead0ee0a358bf80a2984a641d1bf2adc2a Author: Kai Vehmanen Date: Fri Dec 9 13:45:28 2022 +0200 ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed" If system shutdown has not been completed cleanly, it is possible the DMA stream shutdown has not been done, or was not clean. If this is the case, Intel TGL/ADL HDA platforms may fail to shutdown cleanly due to pending HDA DMA transactions. To avoid this, detect this scenario in the shutdown callback, and perform an additional controller reset. This has been tested to unblock S5 entry if this condition is hit. Co-developed-by: Archana Patni Signed-off-by: Archana Patni Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20221209114529.3909192-2-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit ed6a00471dd444af085164f987e3d5e8145da35a Merge: e0e44513c793c 92e61c2e0cee0 2ed6b4c266699 Author: Rafael J. Wysocki Date: Mon Dec 12 16:31:20 2022 +0100 Merge branches 'pm-devfreq' and 'pm-tools' Merge devfreq updates and cpupower utility updates for 6.2-rc1: - Add a private governor_data for devfreq governors (Kant Fan). - Reorganize devfreq code to use device_match_of_node() and devm_platform_get_and_ioremap_resource() instead of open coding them (ye xingchen, Minghao Chi). - Make cpupower choose base_cpu to display default cpupower details instead of picking CPU 0 (Saket Kumar Bhaskar). - Add Georgian translation to cpupower documentation (Zurab Kargareteli). - Introduce powercap intel-rapl library, powercap-info command, and RAPL monitor into cpupower (Thomas Renninger). * pm-devfreq: PM / devfreq: event: use devm_platform_get_and_ioremap_resource() PM / devfreq: event: Use device_match_of_node() PM / devfreq: Use device_match_of_node() PM/devfreq: governor: Add a private governor_data for governor * pm-tools: cpupower: rapl monitor - shows the used power consumption in uj for each rapl domain cpupower: Introduce powercap intel-rapl library and powercap-info command cpupower: Add Georgian translation tools/cpupower: Choose base_cpu to display default cpupower details commit e0e44513c793c3e8f6ce5eff377065e67853806b Merge: 7680d45a910f7 98e596fc85fe7 9c252ecf30360 68bf66a108583 f9b4dc920d35c Author: Rafael J. Wysocki Date: Mon Dec 12 16:23:36 2022 +0100 Merge branches 'powercap', 'pm-x86', 'pm-opp' and 'pm-misc' Merge power capping code updates, x86-specific power management pdate, operating performance points library updates and miscellaneous power management updates for 6.2-rc1: - Fix compiler warnings with make W=1 in the idle_inject power capping driver (Srinivas Pandruvada). - Use kstrtobool() instead of strtobool() in the power capping sysfs interface (Christophe JAILLET). - Add SCMI Powercap based power capping driver (Cristian Marussi). - Add Emerald Rapids support to the intel-uncore-freq driver (Artem Bityutskiy). - Repair slips in kernel-doc comments in the generic notifier code (Lukas Bulwahn). - Fix several DT issues in the OPP library reorganize code around opp-microvolt- DT property (Viresh Kumar). - Allow any of opp-microvolt, opp-microamp, or opp-microwatt properties to be present without the others present (James Calligeros). - Fix clock-latency-ns property in DT example (Serge Semin). * powercap: powercap: idle_inject: Fix warnings with make W=1 powercap: Use kstrtobool() instead of strtobool() powercap: arm_scmi: Add SCMI Powercap based driver * pm-x86: platform/x86: intel-uncore-freq: add Emerald Rapids support * pm-opp: dt-bindings: opp-v2: Fix clock-latency-ns prop in example OPP: decouple dt properties in opp_parse_supplies() OPP: Simplify opp_parse_supplies() by restructuring it OPP: Parse named opp-microwatt property too dt-bindings: opp: Fix named microwatt property dt-bindings: opp: Fix usage of current in microwatt property * pm-misc: notifier: repair slips in kernel-doc comments commit c1ac03af6ed45d05786c219d102f37eb44880f28 Author: Yang Jihong Date: Tue Nov 29 19:30:09 2022 +0800 tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line print_trace_line may overflow seq_file buffer. If the event is not consumed, the while loop keeps peeking this event, causing a infinite loop. Link: https://lkml.kernel.org/r/20221129113009.182425-1-yangjihong1@huawei.com Cc: Masami Hiramatsu Cc: stable@vger.kernel.org Fixes: 088b1e427dbba ("ftrace: pipe fixes") Signed-off-by: Yang Jihong Signed-off-by: Steven Rostedt (Google) commit 7680d45a910f775402281253610f039277630d0c Merge: 173c6c5af3277 cb51aeec14733 96d4b8e1ad8a3 ae8ac19655e0c Author: Rafael J. Wysocki Date: Mon Dec 12 16:12:09 2022 +0100 Merge branches 'pm-cpuidle', 'pm-sleep' and 'pm-domains' Merge cpuidle changes, updates related to system sleep amd generic power domains code fixes for 6.2-rc1: - Improve kernel messages printed by the cpuidle PCI driver (Ulf Hansson). - Make the DT cpuidle driver return the correct number of parsed idle states, clean it up and clarify a comment in it (Ulf Hansson). - Modify the tasks freezing code to avoid using pr_cont() and refine an error message printed by it (Rafael Wysocki). - Make the hibernation core code complain about memory map mismatches during resume to help diagnostics (Xueqin Luo). - Fix mistake in a kerneldoc comment in the hibernation code (xiongxin). - Reverse the order of performance and enabling operations in the generic power domains code (Abel Vesa). - Power off[on] domains in hibernate .freeze[thaw]_noirq hook of in the generic power domains code (Abel Vesa). - Consolidate genpd_restore_noirq() and genpd_resume_noirq() (Shawn Guo). - Pass generic PM noirq hooks to genpd_finish_suspend() (Shawn Guo). - Drop generic power domain status manipulation during hibernate restore (Shawn Guo). * pm-cpuidle: cpuidle: dt: Clarify a comment and simplify code in dt_init_idle_driver() cpuidle: dt: Return the correct numbers of parsed idle states cpuidle: psci: Extend information in log about OSI/PC mode * pm-sleep: PM: sleep: Refine error message in try_to_freeze_tasks() PM: sleep: Avoid using pr_cont() in the tasks freezing code PM: hibernate: Complain about memory map mismatches during resume PM: hibernate: Fix mistake in kerneldoc comment * pm-domains: PM: domains: Reverse the order of performance and enabling ops PM: domains: Power off[on] domain in hibernate .freeze[thaw]_noirq hook PM: domains: Consolidate genpd_restore_noirq() and genpd_resume_noirq() PM: domains: Pass generic PM noirq hooks to genpd_finish_suspend() PM: domains: Drop genpd status manipulation for hibernate restore commit 173c6c5af3277911763e8c737f0178db9a246d69 Merge: dbfa44782787d 04ac14ad3a1a3 Author: Rafael J. Wysocki Date: Mon Dec 12 15:53:48 2022 +0100 Merge branch 'pm-cpufreq' Merge cpufreq changes for 6.2-rc1: - Generalize of_perf_domain_get_sharing_cpumask phandle format (Hector Martin). - Add new cpufreq driver for Apple SoC CPU P-states (Hector Martin). - Update Qualcomm cpufreq driver, including: * CPU clock provider support, * Generic cleanups or reorganization. * Potential memleak fix. * Fix of the return value of cpufreq_driver->get(). (Manivannan Sadhasivam, Chen Hui). - Update Qualcomm cpufreq driver's DT bindings, including: * Support for CPU clock provider. * Missing cache-related properties fixes. * Support for QDU1000/QRU1000. (Manivannan Sadhasivam, Rob Herring, Melody Olvera). - Add support for ti,am625 SoC and enable build of ti-cpufreq for ARCH_K3 (Dave Gerlach, and Vibhore Vardhan). - Use flexible array to simplify memory allocation in the tegra186 cpufreq driver (Christophe JAILLET). - Convert cpufreq statistics code to use sysfs_emit_at() (ye xingchen). - Allow intel_pstate to use no-HWP mode on Sapphire Rapids (Giovanni Gherdovich). - Add missing pci_dev_put() to the amd_freq_sensitivity cpufreq driver (Xiongfeng Wang). - Initialize the kobj_unregister completion before calling kobject_init_and_add() in the cpufreq core code (Yongqiang Liu). - Defer setting boost MSRs in the ACPI cpufreq driver (Stuart Hayes, Nathan Chancellor). - Make intel_pstate accept initial EPP value of 0x80 (Srinivas Pandruvada). - Make read-only array sys_clk_src in the SPEAr cpufreq driver static (Colin Ian King). - Make array speeds in the longhaul cpufreq driver static (Colin Ian King). - Use str_enabled_disabled() helper in the ACPI cpufreq driver (Andy Shevchenko). - Drop a reference to CVS from cpufreq documentation (Conghui Wang). * pm-cpufreq: (30 commits) cpufreq: Remove CVS version control contents from documentation cpufreq: stats: Convert to use sysfs_emit_at() API cpufreq: ACPI: Only set boost MSRs on supported CPUs dt-bindings: cpufreq: cpufreq-qcom-hw: Add QDU1000/QRU1000 cpufreq cpufreq: tegra186: Use flexible array to simplify memory allocation cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP mode cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() cpufreq: Init completion before kobject_init_and_add() cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states cpufreq: qcom-hw: Add CPU clock provider support dt-bindings: cpufreq: cpufreq-qcom-hw: Add cpufreq clock provider cpufreq: qcom-hw: Fix the frequency returned by cpufreq_driver->get() cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online' and 'ret' cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() arm64: dts: ti: k3-am625-sk: Add 1.4GHz OPP cpufreq: ti: Enable ti-cpufreq for ARCH_K3 arm64: dts: ti: k3-am625: Introduce operating-points table cpufreq: dt-platdev: Blacklist ti,am625 SoC cpufreq: ti-cpufreq: Add support for AM625 dt-bindings: cpufreq: qcom: Add missing cache related properties ... commit 3919430fe93bcfad5e34cdbb4d81cd17b3bbd27a Merge: f5e32344d472f 9c8921555907f Author: Borislav Petkov (AMD) Date: Mon Dec 12 15:40:03 2022 +0100 Merge branches 'edac-ghes' and 'edac-misc' into edac-updates-for-v6.2 Combine all queued EDAC changes for submission into v6.2: * ras/edac-ghes: EDAC/igen6: Return the correct error type when not the MC owner apei/ghes: Use xchg_release() for updating new cache slot instead of cmpxchg() EDAC: Check for GHES preference in the chipset-specific EDAC drivers EDAC/ghes: Make ghes_edac a proper module EDAC/ghes: Prepare to make ghes_edac a proper module EDAC/ghes: Add a notifier for reporting memory errors efi/cper: Export several helpers for ghes_edac to use * ras/edac-misc: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() EDAC/i5400: Fix typo in comment: vaious -> various EDAC/mc_sysfs: Increase legacy channel support to 12 MAINTAINERS: Make Mauro EDAC reviewer MAINTAINERS: Make Manivannan Sadhasivam the maintainer of qcom_edac EDAC/i5000: Mark as BROKEN Signed-off-by: Borislav Petkov (AMD) commit bee74dcbd3908291f4bfff3c81a52d52dcd48814 Merge: 39f26d10120ad 64ee25282610f 6d7d3c287410c 92266c65e0879 62a0ec9dc1dfb Author: Rafael J. Wysocki Date: Mon Dec 12 15:24:15 2022 +0100 Merge branches 'acpi-fan', 'acpi-pcc', 'acpi-misc' and 'pnp' Merge ACPI fan driver fixes, ACPI PCC driver fixes, miscellaneous ACPI cleanups and PNP updates for 6.2-rc1: - Make the ACPI fan driver use sysfs_emit_at() in its sysfs interface code (ye xingchen). - Fix the _FIF package extraction failure handling in the ACPI fan driver (Hanjun Guo). - Fix the PCC mailbox handling error code path (Huisong Li). - Avoid using PCC Opregions if there is no platform interrupt allocated for this purpose (Huisong Li). - Use sysfs_emit() instead of scnprintf() in the ACPI PAD driver and CPPC library (ye xingchen). - Fix some kernel-doc issues in the ACPI GSI processing code (Xiongfeng Wang). - Fix name memory leak in pnp_alloc_dev() (Yang Yingliang). - Do not disable PNP devices on suspend when they cannot be re-enabled on resume (Hans de Goede). * acpi-fan: ACPI: fan: Convert to use sysfs_emit_at() API ACPI: fan: Bail out if extract package failed * acpi-pcc: mailbox: pcc: Reset pcc_chan_count to zero in case of PCC probe failure ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available * acpi-misc: ACPI: use sysfs_emit() instead of scnprintf() ACPI: irq: Fix some kernel-doc issues * pnp: PNP: Do not disable devices on suspend when they cannot be re-enabled on resume PNP: fix name memory leak in pnp_alloc_dev() commit 3bc8edc98bd43540dbe648e4ef91f443d6d20a24 Author: Dan Aloni Date: Mon Dec 12 13:11:06 2022 +0200 nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------ Fixes: a4abc6b12eb1 ("nfsd: Fix svc_xprt refcnt leak when setup callback client failed") Cc: Xiyu Yang Cc: J. Bruce Fields Signed-off-by: Dan Aloni Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 39f26d10120ada8553647d9f61223bda7a22336b Merge: 6f1581810b296 87386ee83dc2b ecc6aaabcedc2 98b0cf207b61e e335beed78ec8 Author: Rafael J. Wysocki Date: Mon Dec 12 15:13:52 2022 +0100 Merge branches 'acpi-apei', 'acpi-x86', 'acpi-battery' and 'acpi-pfrut' Make ACPI APEI updates, x86-specific ACPI updates, ACPI battery driver fix and ACPI PFRU/T driver fixes for 6.2-rc1: - Drop unsetting ACPI APEI driver data on remove (Uwe Kleine-König). - Use xchg_release() instead of cmpxchg() for updating new GHES cache slots (Ard Biesheuvel). - Clean up the ACPI APEI code (Sudeep Holla, Christophe JAILLET, Jay Lu). - Add new I2C device enumeration quirks for Medion Lifetab S10346 and Lenovo Yoga Tab 3 Pro (YT3-X90F) (Hans de Goede). - Make the ACPI battery driver notify user space about adding new battery hooks and removing the existing ones (Armin Wolf). - Modify the pfr_update and pfr_telemetry drivers to use ACPI_FREE() for freeing acpi_object structures to help diagnostics (Wang ShaoBo). * acpi-apei: ACPI: APEI: EINJ: Refactor available_error_type_show() ACPI: APEI: EINJ: Fix formatting errors ACPI: APEI: Remove a useless include ACPI: APEI: Silence missing prototype warnings apei/ghes: Use xchg_release() for updating new cache slot instead of cmpxchg() ACPI: APEI: Drop unsetting driver data on remove * acpi-x86: ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Tab 3 Pro (YT3-X90F) * acpi-battery: ACPI: battery: Call power_supply_changed() when adding hooks * acpi-pfrut: ACPI: pfr_update: use ACPI_FREE() to free acpi_object ACPI: pfr_telemetry: use ACPI_FREE() to free acpi_object commit 6f1581810b2960ffb8e2bbcdde89d523555371da Merge: 45494d77f279d d96d30d836380 f1a70bac90caf b423f240a66ad fb1836c91317e Author: Rafael J. Wysocki Date: Mon Dec 12 15:05:30 2022 +0100 Merge branches 'acpi-pm', 'acpi-processor', 'acpi-ec' and 'acpi-video' Make ACPI power management changes, ACPI processor driver updates, ACPI EC driver quirk and ACPI backlight driver updates for 6.2-rc1: - Print full name paths of ACPI power resources objects during enumeration (Kane Chen). - Eliminate a compiler warning regarding a missing function prototype in the ACPI power management code (Sudeep Holla). - Fix and clean up the ACPI processor driver (Rafael Wysocki, Li Zhong, Colin Ian King, Sudeep Holla). - Add quirk for the HP Pavilion Gaming 15-cx0041ur to the ACPI EC driver (Mia Kanashi). - Add some mew ACPI backlight handling quirks and update some existing ones (Hans de Goede). - Make the ACPI backlight driver prefer the native backlight control over vendor backlight control when possible (Hans de Goede). * acpi-pm: ACPI: PM: Silence missing prototype warning ACPI: PM: Print full name path while adding power resource * acpi-processor: ACPI: processor: perflib: Adjust acpi_processor_notify_smm() return value ACPI: processor: perflib: Rearrange acpi_processor_notify_smm() ACPI: processor: perflib: Rearrange unregistration routine ACPI: processor: perflib: Drop redundant parentheses ACPI: processor: perflib: Adjust white space ACPI: processor: idle: Drop unnecessary statements and parens ACPI: processor: Silence missing prototype warnings ACPI: processor_idle: Silence missing prototype warnings ACPI: processor: throttling: remove variable count ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value * acpi-ec: ACPI: EC: Add quirk for the HP Pavilion Gaming 15-cx0041ur * acpi-video: ACPI: video: Prefer native over vendor ACPI: video: Simplify __acpi_video_get_backlight_type() ACPI: video: Add force_native quirk for Sony Vaio VPCY11S1E ACPI: video: Add force_vendor quirk for Sony Vaio PCG-FRV35 ACPI: video: Change Sony Vaio VPCEH3U1E quirk to force_native ACPI: video: Change GIGABYTE GB-BXBT-2807 quirk to force_none ACPI: video: Add a few bugtracker links to DMI quirks commit 45494d77f279d0420f06376dcf105b23e300c5a4 Merge: 888bc86e7cca2 9256dac0c67ac 3223417d1fc44 062c0e3670c30 82d08d61e3a87 Author: Rafael J. Wysocki Date: Mon Dec 12 14:55:44 2022 +0100 Merge branches 'acpi-scan', 'acpi-bus', 'acpi-tables' and 'acpi-sysfs' Merge ACPI changes related to device enumeration, device object managenet, operation region handling, table parsing and sysfs interface: - Use ZERO_PAGE(0) instead of empty_zero_page in the ACPI device enumeration code (Giulio Benetti). - Change the return type of the ACPI driver remove callback to void and update its users accordingly (Dawei Li). - Add general support for FFH address space type and implement the low- level part of it for ARM64 (Sudeep Holla). - Fix stale comments in the ACPI tables parsing code and make it print more messages related to MADT (Hanjun Guo, Huacai Chen). - Replace invocations of generic library functions with more kernel- specific counterparts in the ACPI sysfs interface (Christophe JAILLET, Xu Panda). * acpi-scan: ACPI: scan: substitute empty_zero_page with helper ZERO_PAGE(0) * acpi-bus: ACPI: FFH: Silence missing prototype warnings ACPI: make remove callback of ACPI driver void ACPI: bus: Fix the _OSC capability check for FFH OpRegion arm64: Add architecture specific ACPI FFH Opregion callbacks ACPI: Implement a generic FFH Opregion handler * acpi-tables: ACPI: tables: Fix the stale comments for acpi_locate_initial_tables() ACPI: tables: Print CORE_PIC information when MADT is parsed * acpi-sysfs: ACPI: sysfs: use sysfs_emit() to instead of scnprintf() ACPI: sysfs: Use kstrtobool() instead of strtobool() commit 888bc86e7cca29de20223ee46e9b770ced2c038e Merge: 57336224da834 470188b09e92d Author: Rafael J. Wysocki Date: Mon Dec 12 14:41:48 2022 +0100 Merge branch 'acpica' Merge ACPICA changes, including bug fixes and cleanups as well as support for some recently defined data structures, for 6.2-rc1: - Make acpi_ex_load_op() match upstream implementation (Rafael Wysocki). - Add support for loong_arch-specific APICs in MADT (Huacai Chen). - Add support for fixed PCIe wake event (Huacai Chen). - Add EBDA pointer sanity checks (Vit Kabele). - Avoid accessing VGA memory when EBDA < 1KiB (Vit Kabele). - Add CCEL table support to both compiler/disassembler (Kuppuswamy Sathyanarayanan). - Add a couple of new UUIDs to the known UUID list (Bob Moore). - Add support for FFH Opregion special context data (Sudeep Holla). - Improve warning message for "invalid ACPI name" (Bob Moore). - Add support for CXL 3.0 structures (CXIMS & RDPAS) in the CEDT table (Alison Schofield). - Prepare IORT support for revision E.e (Robin Murphy). - Finish support for the CDAT table (Bob Moore). - Fix error code path in acpi_ds_call_control_method() (Rafael Wysocki). - Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao). - Update the version of the ACPICA code in the kernel (Bob Moore). * acpica: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() ACPICA: Fix error code path in acpi_ds_call_control_method() ACPICA: Update version to 20221020 ACPICA: Add utcksum.o to the acpidump Makefile Revert "LoongArch: Provisionally add ACPICA data structures" ACPICA: Finish support for the CDAT table ACPICA: IORT: Update for revision E.e ACPICA: Add CXL 3.0 structures (CXIMS & RDPAS) to the CEDT table ACPICA: Improve warning message for "invalid ACPI name" ACPICA: Add support for FFH Opregion special context data ACPICA: Add a couple of new UUIDs to the known UUID list ACPICA: iASL: Add CCEL table to both compiler/disassembler ACPICA: Do not touch VGA memory when EBDA < 1ki_b ACPICA: Check that EBDA pointer is in valid memory ACPICA: Events: Support fixed PCIe wake event ACPICA: MADT: Add loong_arch-specific APICs support ACPICA: Make acpi_ex_load_op() match upstream commit b2b509fb5a1e6af1e630a755b32c4658099df70b Merge: 21af0d557ea93 47bf2b2393ea1 Author: David S. Miller Date: Mon Dec 12 12:11:37 2022 +0000 Merge tag 'linux-can-next-for-6.2-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== linux-can-next-for-6.2-20221212 this is a pull request of 39 patches for net-next/master. The first 2 patches are by me fix a warning and coding style in the kvaser_usb driver. Vivek Yadav's patch sorts the includes of the m_can driver. Biju Das contributes 5 patches for the rcar_canfd driver improve the support for different IP core variants. Jean Delvare's patch for the ctucanfd drops the dependency on COMPILE_TEST. Vincent Mailhol's patch sorts the includes of the etas_es58x driver. Haibo Chen's contributes 2 patches that add i.MX93 support to the flexcan driver. Lad Prabhakar's patch updates the dt-bindings documentation of the rcar_canfd driver. Minghao Chi's patch converts the c_can platform driver to devm_platform_get_and_ioremap_resource(). In the next 7 patches Vincent Mailhol adds devlink support to the etas_es58x driver to report firmware, bootloader and hardware version. Xu Panda's patch converts a strncpy() -> strscpy() in the ucan driver. Ye Bin's patch removes a useless parameter from the AF_CAN protocol. The next 2 patches by Vincent Mailhol and remove unneeded or unused pointers to struct usb_interface in device's priv struct in the ucan and gs_usb driver. Vivek Yadav's patch cleans up the usage of the RAM initialization in the m_can driver. A patch by me add support for SO_MARK to the AF_CAN protocol. Geert Uytterhoeven's patch fixes the number of CAN channels in the rcan_canfd bindings documentation. In the last 11 patches Markus Schneider-Pargmann optimizes the register access in the t_can driver and cleans up the tcan glue driver. ==================== Signed-off-by: David S. Miller commit 22250dbaba99f87574095af894610e9801d74419 Merge: 69af4bcaa08d0 84498d1fb35de Author: Mark Brown Date: Mon Dec 12 11:50:58 2022 +0000 regmap: Merge fix for where we get the number of registers from This didn't get sent for 6.1 since we should do a better fix but that didn't happen in time. commit e3eca2e4f6489ed3143c80ce90bfa7ef7e12ebc7 Merge: 830b3c68c1fb1 ef5bb8e7a7127 bbc4d205d93f5 462e768b55a23 7eb99841f340b f04ae51dd965b 73f5fc5f884ad 21c1f9021f0e7 e5b0feb4361a4 88699c024f922 b169a180bef26 Author: Joerg Roedel Date: Mon Dec 12 12:50:53 2022 +0100 Merge branches 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 's390', 'x86/vt-d', 'x86/amd' and 'core' into next commit 462e768b55a2331324ff72e74706261134369826 Author: Dan Carpenter Date: Wed Dec 7 18:56:09 2022 +0300 iommu/mediatek: Fix forever loop in error handling There is a typo so this loop does i++ where i-- was intended. It will result in looping until the kernel crashes. Fixes: 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse") Signed-off-by: Dan Carpenter Reviewed-by: Yong Wu Link: https://lore.kernel.org/r/Y5C3mTam2nkbaz6o@kili Signed-off-by: Joerg Roedel commit 47bf2b2393ea1aacdefbe4e9d643599e057bb3a2 Merge: 3abcc01c38bc5 39dbb21b6a295 Author: Marc Kleine-Budde Date: Mon Dec 12 12:01:26 2022 +0100 Merge patch series "can: m_can: Optimizations for tcan and peripheral chips" Markus Schneider-Pargmann says: as requested I split the series into two parts. This is the first parts with simple improvements to reduce the number of SPI transfers. The second part will be the rest with coalescing support and more complex optimizations. Changes since v1: https://lore.kernel.org/all/20221116205308.2996556-1-msp@baylibre.com - Fixed register ranges - Added fixes: tag for two patches Link: https://lore.kernel.org/all/20221206115728.1056014-1-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 39dbb21b6a2951a2ce311c93eb09f9ff9b96e7b8 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:28 2022 +0100 can: tcan4x5x: Specify separate read/write ranges Specify exactly which registers are read/writeable in the chip. This is supposed to help detect any violations in the future. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-12-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit ef5778f7084196997e00095c43b12693ef5111d0 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:27 2022 +0100 can: tcan4x5x: Fix register range of first two blocks According to the datasheet 0x10 is the last register in the first block, not register 0x2c. The datasheet lists the last register of the second block as 0x830, not 0x83c. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-11-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 67727a17a6b375d68fe569b77e6516b034b834c0 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:26 2022 +0100 can: tcan4x5x: Fix use of register error status mask TCAN4X5X_ERROR_STATUS is not a status register that needs clearing during interrupt handling. Instead this is a masking register that masks error interrupts. Writing TCAN4X5X_CLEAR_ALL_INT to this register effectively masks everything. Rename the register and mask all error interrupts only once by writing to the register in tcan4x5x_init. Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-10-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 40c9e4f676abbe194541d88e796341c92d5a13c0 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:25 2022 +0100 can: tcan4x5x: Remove invalid write in clear_interrupts Register 0x824 TCAN4X5X_MCAN_INT_REG is a read-only register. Any writes to this register do not have any effect. Remove this write. The m_can driver aldready clears the interrupts in m_can_isr() by writing to M_CAN_IR which is translated to register 0x1050 which is a writable version of this register. Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-9-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit e2f1c8cb020296ddfa255e06b15f071807c2ed73 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:24 2022 +0100 can: m_can: Batch acknowledge rx fifo Instead of acknowledging every item of the fifo, only acknowledge the last item read. This behavior is documented in the datasheet. The new getindex will be the acknowledged item + 1. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-8-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit e3bff5256a0f12a1edc8d79bdef53eb83c2f1fbf Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:23 2022 +0100 can: m_can: Batch acknowledge transmit events Transmit events from the txe fifo can be batch acknowledged by acknowledging the last read txe fifo item. This will save txe_count writes which is important for peripheral chips. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-7-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 6355a3c983e6d6fc998f4223bd2c7ef047e4572b Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:22 2022 +0100 can: m_can: Count read getindex in the driver The getindex gets increased by one every time. We can calculate the correct getindex in the driver and avoid the additional reads of rxfs. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-6-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit d4535b90a76af49d1dd7bc70ad0311a88ac5313d Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:21 2022 +0100 can: m_can: Count TXE FIFO getidx in the driver The getindex simply increases by one for every iteration. There is no need to get the current getidx every time from a register. Instead we can just count and wrap if necessary. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-5-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit fac52bf786e5c302990fa79f2fdde24e84f810b0 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:20 2022 +0100 can: m_can: Read register PSR only on error Only read register PSR if there is an error indicated in irqstatus. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-4-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 57757937974988dc8feb7cf66b17dca72bca813b Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:19 2022 +0100 can: m_can: Avoid reading irqstatus twice For peripheral devices the m_can_rx_handler is called directly after setting cdev->irqstatus. This means we don't have to read the irqstatus again in m_can_rx_handler. Avoid this by adding a parameter that is false for direct calls. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-3-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit c1eaf8b9bd3145d029446c927e1c9ce925dfe6a7 Author: Markus Schneider-Pargmann Date: Tue Dec 6 12:57:18 2022 +0100 can: m_can: Eliminate double read of TXFQS in tx_handler The TXFQS register is read first to check if the fifo is full and then immediately again to get the putidx. This is unnecessary and adds significant overhead if read requests are done over a slow bus, for example SPI with tcan4x5x. Add a variable to store the value of the register. Split the m_can_tx_fifo_full function into two to avoid the hidden m_can_read call if not needed. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20221206115728.1056014-2-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit 3abcc01c38bc5d424635df96e0677e2fbec021de Author: Geert Uytterhoeven Date: Wed Dec 7 17:50:21 2022 +0100 dt-bindings: can: renesas,rcar-canfd: Fix number of channels for R-Car V3U According to the bindings, only two channels are supported. However, R-Car V3U supports eight, leading to "make dtbs" failures: arch/arm64/boot/dts/renesas/r8a779a0-falcon.dtb: can@e6660000: Unevaluated properties are not allowed ('channel2', 'channel3', 'channel4', 'channel5', 'channel6', 'channel7' were unexpected) Update the number of channels to 8 on R-Car V3U. While at it, prevent adding more properties to the channel nodes, as they must contain no other properties than a status property. Fixes: d6254d52d70de530 ("dt-bindings: can: renesas,rcar-canfd: Document r8a779a0 support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/all/7d41d72cd7db2e90bae069ce57dbb672f17500ae.1670431681.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 0826e82b8a32e646b7b32ba8b68ba30812028e47 Author: Marc Kleine-Budde Date: Fri Dec 9 10:10:08 2022 +0100 can: raw: add support for SO_MARK Add support for SO_MARK to the CAN_RAW protocol. This makes it possible to add traffic control filters based on the fwmark. Link: https://lore.kernel.org/all/20221210113653.170346-1-mkl@pengutronix.de Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit eaacfeaca7ad0804b9a6eff7afeba93a87db7638 Author: Vivek Yadav Date: Wed Dec 7 15:36:31 2022 +0530 can: m_can: Call the RAM init directly from m_can_chip_config When we try to access the mcan message ram addresses during the probe, hclk is gated by any other drivers or disabled, because of that probe gets failed. Move the mram init functionality to mcan chip config called by m_can_start from mcan open function, by that time clocks are enabled. Suggested-by: Marc Kleine-Budde Signed-off-by: Vivek Yadav Link: https://lore.kernel.org/all/20221207100632.96200-2-vivek.2311@samsung.com Signed-off-by: Marc Kleine-Budde commit bd4a52bf9d56abaabc6926f68c3cc3528937a864 Merge: f793458bba544 56c56a309e795 Author: Marc Kleine-Budde Date: Mon Dec 12 11:41:58 2022 +0100 Merge patch series "can: usb: remove pointers to struct usb_interface in device's priv structures" Vincent Mailhol says: The gs_can and ucan drivers keep a pointer to struct usb_interface in their private structure. This is not needed. For gs_can the only use is to retrieve struct usb_device, which is already available in gs_usb::udev. For ucan, the field is set but never used. Remove the struct usb_interface fields and clean up. Link: https://lore.kernel.org/all/20221208081142.16936-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 56c56a309e7959c319d3cbd6bd16e598ecd5831c Author: Vincent Mailhol Date: Thu Dec 8 17:11:42 2022 +0900 can: gs_usb: remove gs_can::iface The iface field of struct gs_can is only used to retrieve the usb_device which is already available in gs_can::udev. Replace each occurrence of interface_to_usbdev(dev->iface) with dev->udev. This done, remove gs_can::iface. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221208081142.16936-3-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit f54b101ddeaea68fe7e52e842deb8b7a081bf156 Author: Vincent Mailhol Date: Thu Dec 8 17:11:41 2022 +0900 can: ucan: remove unused ucan_priv::intf Field intf of struct ucan_priv is set but never used. Remove it. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221208081142.16936-2-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit f793458bba544e29657efbfa53b62dc511c6f22c Author: Ye Bin Date: Thu Dec 8 17:09:40 2022 +0800 net: af_can: remove useless parameter 'err' in 'can_rx_register()' Since commit bdfb5765e45b remove NULL-ptr checks from users of can_dev_rcv_lists_find(). 'err' parameter is useless, so remove it. Signed-off-by: Ye Bin Link: https://lore.kernel.org/all/20221208090940.3695670-1-yebin@huaweicloud.com Signed-off-by: Marc Kleine-Budde commit 7fdaf8966aae476deafe11f9a0067ff588615444 Author: Xu Panda Date: Wed Dec 7 09:09:09 2022 +0800 can: ucan: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Link: https://lore.kernel.org/all/202212070909095189693@zte.com.cn Signed-off-by: Marc Kleine-Budde commit 5425094a39caf1cf501a71a0c149604656046acb Merge: 74d95352bdfc4 9f63f96aac927 Author: Marc Kleine-Budde Date: Mon Dec 12 11:40:16 2022 +0100 Merge patch series "can: etas_es58x: report firmware, bootloader and hardware version" Vincent Mailhol says: The goal of this series is to report the firmware version, the bootloader version and the hardware revision of ETAS ES58x devices. These are already reported in the kernel log but this isn't best practice. Remove the kernel log and instead export all these through devlink. The devlink core automatically exports the firmware and the bootloader version to ethtool, so no need to implement the ethtool_ops::get_drvinfo() callback anymore. Patch one and two implement the core support for devlink (at device level) and devlink port (at the network interface level). Patch three export usb_cache_string() and patch four add a new info attribute to devlink.h. Both are prerequisites for patch five. Patch five is the actual goal: it parses the product information from a custom usb string returned by the device and expose them through devlink. Patch six removes the product information from the kernel log. Finally, patch seven add a devlink documentation page with list all the information attributes reported by the driver. * Sample outputs following this series * | $ devlink dev info | usb/1-9:1.1: | serial_number 0108954 | versions: | fixed: | board.rev B012/000 | running: | fw 04.00.01 | fw.bootloader 02.00.00 | $ devlink port show can0 | usb/1-9:1.1/0: type eth netdev can0 flavour physical port 0 splittable false | $ ethtool -i can0 | driver: etas_es58x | version: 6.1.0-rc7+ | firmware-version: 04.00.01 02.00.00 | expansion-rom-version: | bus-info: 1-9:1.1 | supports-statistics: no | supports-test: no | supports-eeprom-access: no | supports-register-dump: no | supports-priv-flags: no * Changelog * v4 -> v5: https://lore.kernel.org/all/20221130174658.29282-1-mailhol.vincent@wanadoo.fr * [PATH 2/7] add devlink port support. This extends devlink to the network interface. * thanks to devlink port, 'ethtool -i' is now able to retrieve the firmware version from devlink. No need to implement the ethtool_ops::get_drvinfo() callback anymore: remove one patch from the series. * [PATCH 4/7] A new patch to add a new info attribute for the bootloader version in devlink.h. This patch was initially sent as a standalone patch here: https://lore.kernel.org/netdev/20221129031406.3849872-1-mailhol.vincent@wanadoo.fr Merging it to this series so that it is both added and used at the same time. * [PATCH 5/7] use the newly info attribute defined in patch 4/7 to report the bootloader version instead of the custom string "bl". * [PATCH 5/7] because the series does not implement ethtool_ops::get_drvinfo() anymore, the two helper functions es58x_sw_version_is_set() and es58x_hw_revision_is_set() are only used in devlink.c. Move them from es58x_core.h to es58x_devlink.c. * [PATCH 5/7] small rework of the helper function es58x_hw_revision_is_set(): it is OK to only check the letter (if the letter is '\0', it will not be possible to print the next numbers). * [PATCH 5/7 and 6/7] add reviewed-by Andrew Lunn tag. * [PATCH 7/7] Now, 'ethtool -i' reports both the firmware version and the bootloader version (this is how the core export the information from devlink to ethtool). Update the documentation to reflect this fact. * Reoder the patches. v3 -> v4: https://lore.kernel.org/all/20221126162211.93322-1-mailhol.vincent@wanadoo.fr * major rework to use devlink instead of sysfs following Andrew's comment. * split the series in 6 patches. * [PATCH 1/6] add Acked-by: Greg Kroah-Hartman v2 -> v3: https://lore.kernel.org/all/20221113040108.68249-1-mailhol.vincent@wanadoo.fr * patch 2/3: do not spam the kernel log anymore with the product number. Instead parse the product information string, extract the firmware version, the bootloadar version and the hardware revision and export them through sysfs. * patch 2/3: rework the parsing in order not to need additional fields in struct es58x_parameters. * patch 3/3: only populate ethtool_drvinfo::fw_version because since commit edaf5df22cb8 ("ethtool: ethtool_get_drvinfo: populate drvinfo fields even if callback exits"), there is no need to populate ethtool_drvinfo::driver and ethtool_drvinfo::bus_info in the driver. v1 -> v2: https://lore.kernel.org/all/20221104171604.24052-1-mailhol.vincent@wanadoo.fr * was a single patch. It is now a series of three patches. * add a first new patch to export usb_cache_string(). * add a second new patch to apply usb_cache_string() to existing code. * add missing check on product info string to prevent a buffer overflow. * add comma on the last entry of struct es58x_parameters. v1: https://lore.kernel.org/all/20221104073659.414147-1-mailhol.vincent@wanadoo.fr Link: https://lore.kernel.org/all/20221130174658.29282-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 9f63f96aac92751e85f8313f59f2c867b88ea453 Author: Vincent Mailhol Date: Thu Dec 1 02:46:58 2022 +0900 Documentation: devlink: add devlink documentation for the etas_es58x driver List all the version information reported by the etas_es58x driver through devlink. Also, update MAINTAINERS with the newly created file. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221130174658.29282-8-mailhol.vincent@wanadoo.fr [mkl: fixed version information table: "bl" -> "fw.bootloader" Signed-off-by: Marc Kleine-Budde commit d8f26fd689dd81da8f4e72f17d1554c4c5b018c2 Author: Vincent Mailhol Date: Thu Dec 1 02:46:57 2022 +0900 can: etas_es58x: remove es58x_get_product_info() Now that the product information are available under devlink, no more need to print them in the kernel log. Remove es58x_get_product_info(). Signed-off-by: Vincent Mailhol Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/all/20221130174658.29282-7-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 9f06631c3f1f0f298536443df85a6837ba4c5f5c Author: Vincent Mailhol Date: Thu Dec 1 02:46:56 2022 +0900 can: etas_es58x: export product information through devlink_ops::info_get() ES58x devices report below product information through a custom usb string: * the firmware version * the bootloader version * the hardware revision Parse this string, store the results in struct es58x_dev, export: * the firmware version through devlink's "fw" name * the bootloader version through devlink's "fw.bootloader" name * the hardware revisionthrough devlink's "board.rev" name Those devlink entries are not critical to use the device, if parsing fails, print an informative log message and continue to probe the device. In addition to that, use usb_device::serial to report the device serial number. Signed-off-by: Vincent Mailhol Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/all/20221130174658.29282-6-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 01d80532295cd359dc43e6bd71860d5515f84372 Author: Vincent Mailhol Date: Thu Dec 1 02:46:55 2022 +0900 net: devlink: add DEVLINK_INFO_VERSION_GENERIC_FW_BOOTLOADER As discussed in [1], abbreviating the bootloader to "bl" might not be well understood. Instead, a bootloader technically being a firmware, name it "fw.bootloader". Add a new macro to devlink.h to formalize this new info attribute name and update the documentation. [1] https://lore.kernel.org/netdev/20221128142723.2f826d20@kernel.org/ Suggested-by: Jakub Kicinski Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221130174658.29282-5-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 74d95352bdfc4ed1eb72ef9d69e06ed2d6891ff7 Author: Minghao Chi Date: Fri Nov 11 14:43:00 2022 +0800 can: c_can: use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Link: https://lore.kernel.org/all/202211111443005202576@zte.com.cn Signed-off-by: Marc Kleine-Budde commit 983055bf839745ec2812fc55cacd96888aa0d7a6 Author: Vincent Mailhol Date: Thu Dec 1 02:46:54 2022 +0900 USB: core: export usb_cache_string() usb_cache_string() can also be useful for the drivers so export it. Signed-off-by: Vincent Mailhol Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/all/20221130174658.29282-4-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 5237ff4e7d3d60e19c0625169361eb40cd435f6d Author: Lad Prabhakar Date: Tue Nov 15 12:38:11 2022 +0000 dt-bindings: can: renesas,rcar-canfd: Document RZ/Five SoC The CANFD block on the RZ/Five SoC is identical to one found on the RZ/G2UL SoC. "renesas,r9a07g043-canfd" compatible string will be used on the RZ/Five SoC so to make this clear, update the comment to include RZ/Five SoC. No driver changes are required as generic compatible string "renesas,rzg2l-canfd" will be used as a fallback on RZ/Five SoC. Signed-off-by: Lad Prabhakar Acked-by: Rob Herring Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221115123811.1182922-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 594a25e1ffc59fd1ef9a6760a1eb2ef6bbd4cfc1 Author: Vincent Mailhol Date: Thu Dec 1 02:46:53 2022 +0900 can: etas_es58x: add devlink port support Add support for devlink port which extends the devlink support to the network interface level. For now, the etas_es58x driver will only rely on the default features that devlink port has to offer and not implement additional feature ones. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221130174658.29282-3-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit a21cee59b41695957f2eeb3943e345e8a68732c4 Author: Haibo Chen Date: Tue Nov 22 19:32:31 2022 +0800 dt-bindings: can: fsl,flexcan: add imx93 compatible Add a new compatible string for imx93. Signed-off-by: Haibo Chen Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/all/1669116752-4260-2-git-send-email-haibo.chen@nxp.com Signed-off-by: Marc Kleine-Budde commit 2c4a1efcf6ab37abef8b593a4c0dda43557504c8 Author: Vincent Mailhol Date: Thu Dec 1 02:46:52 2022 +0900 can: etas_es58x: add devlink support Add basic support for devlink at the device level. The callbacks of struct devlink_ops will be implemented next. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221130174658.29282-2-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 8cb53b485f18732c1e0671a0e826063de47650a6 Author: Haibo Chen Date: Tue Nov 22 19:32:30 2022 +0800 can: flexcan: add auto stop mode for IMX93 to support wakeup IMX93 do not contain a GPR to config the stop mode, it will set the flexcan into stop mode automatically once the ARM core go into low power mode (WFI instruct) and gate off the flexcan related clock automatically. But to let these logic work as expect, before ARM core go into low power mode, need to make sure the flexcan related clock keep on. To support stop mode and wakeup feature on imx93, this patch add a new fsl_imx93_devtype_data to separate from imx8mp. Signed-off-by: Haibo Chen Link: https://lore.kernel.org/all/1669116752-4260-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Marc Kleine-Budde commit 8fd9323ef7210b90d1d209dd4f0d65a8411b60e1 Author: Vincent Mailhol Date: Sun Nov 27 01:05:25 2022 +0900 can: etas_es58x: sort the includes by alphabetic order Follow the best practices, reorder the includes. While doing so, bump up copyright year of each modified files. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20221126160525.87036-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 005c54278b3dd38f6045a2450a8c988cc7d3def2 Author: Jean Delvare Date: Thu Nov 24 14:16:04 2022 +0100 can: ctucanfd: Drop obsolete dependency on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. It is actually better to always build such drivers with OF enabled, so that the test builds are closer to how each driver will actually be built on its intended target. Building them without OF may not test much as the compiler will optimize out potentially large parts of the code. In the worst case, this could even pop false positive warnings. Dropping COMPILE_TEST here improves the quality of our testing and avoids wasting time on non-existent issues. Signed-off-by: Jean Delvare Cc: Pavel Pisa Cc: Ondrej Ille Acked-by: Pavel Pisa Link: https://lore.kernel.org/all/20221124141604.4265225f@endymion.delvare Signed-off-by: Marc Kleine-Budde commit a59d65e1be4dadb640bacd109417a248a996bb82 Merge: 09451f244eabb ea6ff7792203a Author: Marc Kleine-Budde Date: Mon Dec 12 11:37:56 2022 +0100 Merge patch series "R-Car CAN FD driver enhancements" Biju Das says: The CAN FD IP found on RZ/G2L SoC has some HW features different to that of R-Car. For example, it has multiple resets, dedicated channel tx and error interrupts, separate global rx and error interrupts compared to shared irq for R-Car. it does not s ECC error flag registers and clk post divider present on R-Car. Similarly, R-Car V3U has 8 channels whereas other SoCs has only 2 channels. Currently all the HW differences are handled by comparing with chip_id enum. This patch series aims to replace chip_id with struct rcar_canfd_hw_info to handle the HW feature differences and driver data present on both IPs. The changes are trivial and tested on RZ/G2L SMARC EVK. This patch series depend upon [1]. [1] https://lore.kernel.org/all/20221025155657.1426948-1-biju.das.jz@bp.renesas.com changes since v2: https://lore.kernel.org/all/20221026131732.1843105-1-biju.das.jz@bp.renesas.com * Replaced data type of max_channels from unsigned int->u8 to save memory. * Replaced data type of postdiv from unsigned int->u8 to save memory. changes since v1: https://lore.kernel.org/all/20221022104357.1276740-1-biju.das.jz@bp.renesas.com * Updated commit description for R-Car V3U SoC detection using driver data. * Replaced data type of max_channels from u32->unsigned int. * Replaced multi_global_irqs->shared_global_irqs to make it positive checks. * Replaced clk_postdiv->postdiv driver data variable. * Simplified the calcualtion for fcan_freq. * Replaced info->has_gerfl to gpriv->info->has_gerfl and wrapped the ECC error flag checks inside a single if statement. * Added Rb tag from Geert patch#1,#2,#3 and #5 Link: https://lore.kernel.org/all/20221027082158.95895-1-biju.das.jz@bp.renesas.com [mkl: only take patches 1...5 to avoid merge conflict] Signed-off-by: Marc Kleine-Budde commit 21af0d557ea932e50094a48adb20e356e2f6ffef Merge: a2d40ce7acdbf ebddb14049006 Author: David S. Miller Date: Mon Dec 12 10:14:03 2022 +0000 Merge branch 'ovs-tc-dedup' Xin Long says: ==================== net: eliminate the duplicate code in the ct nat functions of ovs and tc The changes in the patchset: "net: add helper support in tc act_ct for ovs offloading" had moved some common ct code used by both OVS and TC into netfilter. There are still some big functions pretty similar defined and used in each of OVS and TC. It is not good to maintain such big function in 2 places. This patchset is to extract the functions for NAT processing from OVS and TC to netfilter. To make this change clear and safe, this patchset gets the common code out of OVS and TC step by step: The patch 1-4 make some minor changes in OVS and TC to make the NAT code of them completely the same, then the patch 5 moves the common code to the netfilter and exports one function called by each of OVS and TC. v1->v2: - Create nf_nat_ovs.c to include the nat functions, as Pablo suggested. v2->v3: - fix a typo in subject of patch 2/5, as Marcelo noticed. - fix in openvswitch to keep OVS ct nat and TC ct nat consistent in patch 3/5 instead of in tc, as Marcelo noticed. - use BIT(var) macro instead of (1 << var) in patch 5/5, as Marcelo suggested. - use ifdef in netfilter/Makefile to build nf_nat_ovs only when OVS or TC ct action is enabled in patch 5/5, as Marcelo suggested. v3->v4: - add NF_NAT_OVS in netfilter/Kconfig and add select NF_NAT_OVS in OVS and TC Kconfig instead of using ifdef in netfilter/Makefile, as Pablo suggested. ==================== Signed-off-by: David S. Miller commit ebddb1404900657b7f03a56ee4c34a9d218c4030 Author: Xin Long Date: Thu Dec 8 11:56:12 2022 -0500 net: move the nat function to nf_nat_ovs for ovs and tc There are two nat functions are nearly the same in both OVS and TC code, (ovs_)ct_nat_execute() and ovs_ct_nat/tcf_ct_act_nat(). This patch creates nf_nat_ovs.c under netfilter and moves them there then exports nf_ct_nat() so that it can be shared by both OVS and TC, and keeps the nat (type) check and nat flag update in OVS and TC's own place, as these parts are different between OVS and TC. Note that in OVS nat function it was using skb->protocol to get the proto as it already skips vlans in key_extract(), while it doesn't in TC, and TC has to call skb_protocol() to get proto. So in nf_ct_nat_execute(), we keep using skb_protocol() which works for both OVS and TC contrack. Signed-off-by: Xin Long Acked-by: Aaron Conole Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 0564c3e51bc7bb200e76d0cad2d7067cc77cb83e Author: Xin Long Date: Thu Dec 8 11:56:11 2022 -0500 net: sched: update the nat flag for icmp error packets in ct_nat_execute In ovs_ct_nat_execute(), the packet flow key nat flags are updated when it processes ICMP(v6) error packets translation successfully. In ct_nat_execute() when processing ICMP(v6) error packets translation successfully, it should have done the same in ct_nat_execute() to set post_ct_s/dnat flag, which will be used to update flow key nat flags in OVS module later. Reviewed-by: Saeed Mahameed Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 2b85144ab36e0e870f59b5ae55e299179eb8cdb8 Author: Xin Long Date: Thu Dec 8 11:56:10 2022 -0500 openvswitch: return NF_DROP when fails to add nat ext in ovs_ct_nat When it fails to allocate nat ext, the packet should be dropped, like the memory allocation failures in other places in ovs_ct_nat(). This patch changes to return NF_DROP when fails to add nat ext before doing NAT in ovs_ct_nat(), also it would keep consistent with tc action ct' processing in tcf_ct_act_nat(). Signed-off-by: Xin Long Acked-by: Aaron Conole Signed-off-by: David S. Miller commit 7795928921332fdd52c33eab73f1280d5e58678a Author: Xin Long Date: Thu Dec 8 11:56:09 2022 -0500 openvswitch: return NF_ACCEPT when OVS_CT_NAT is not set in info nat Either OVS_CT_SRC_NAT or OVS_CT_DST_NAT is set, OVS_CT_NAT must be set in info->nat. Thus, if OVS_CT_NAT is not set in info->nat, it will definitely not do NAT but returns NF_ACCEPT in ovs_ct_nat(). This patch changes nothing funcational but only makes this return earlier in ovs_ct_nat() to keep consistent with TC's processing in tcf_ct_act_nat(). Reviewed-by: Saeed Mahameed Acked-by: Aaron Conole Signed-off-by: Xin Long Signed-off-by: David S. Miller commit bf14f4923d516d77320500461c0692c9d4480c30 Author: Xin Long Date: Thu Dec 8 11:56:08 2022 -0500 openvswitch: delete the unncessary skb_pull_rcsum call in ovs_ct_nat_execute The calls to ovs_ct_nat_execute() are as below: ovs_ct_execute() ovs_ct_lookup() __ovs_ct_lookup() ovs_ct_nat() ovs_ct_nat_execute() ovs_ct_commit() __ovs_ct_lookup() ovs_ct_nat() ovs_ct_nat_execute() and since skb_pull_rcsum() and skb_push_rcsum() are already called in ovs_ct_execute(), there's no need to do it again in ovs_ct_nat_execute(). Reviewed-by: Saeed Mahameed Acked-by: Aaron Conole Signed-off-by: Xin Long Signed-off-by: David S. Miller commit f8ab263d4d48e6dab752029bf562f20a2ee630ed Author: Tom Lendacky Date: Thu Dec 8 10:22:25 2022 -0600 net: amd-xgbe: Check only the minimum speed for active/passive cables There are cables that exist that can support speeds in excess of 10GbE. The driver, however, restricts the EEPROM advertised nominal bitrate to a specific range, which can prevent usage of cables that can support, for example, up to 25GbE. Rather than checking that an active or passive cable supports a specific range, only check for a minimum supported speed. Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") Signed-off-by: Tom Lendacky Signed-off-by: David S. Miller commit 4998006c73afe44e2f639d55bd331c6c26eb039f Author: Tom Lendacky Date: Thu Dec 8 10:22:24 2022 -0600 net: amd-xgbe: Fix logic around active and passive cables SFP+ active and passive cables are copper cables with fixed SFP+ end connectors. Due to a misinterpretation of this, SFP+ active cables could end up not being recognized, causing the driver to fail to establish a connection. Introduce a new enum in SFP+ cable types, XGBE_SFP_CABLE_FIBER, that is the default cable type, and handle active and passive cables when they are specifically detected. Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") Signed-off-by: Tom Lendacky Signed-off-by: David S. Miller commit 73e341e0281a35274629e9be27eae2f9b1b492bf Author: Yang Yingliang Date: Thu Dec 8 23:01:58 2022 +0800 af_unix: call proto_unregister() in the error path in af_unix_init() If register unix_stream_proto returns error, unix_dgram_proto needs be unregistered. Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") Signed-off-by: Yang Yingliang Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 526682b458b1b56d2e0db027df535cb5cdcfde59 Author: Richard Gobert Date: Thu Dec 8 15:54:46 2022 +0100 net: setsockopt: fix IPV6_UNICAST_IF option for connected sockets Change the behaviour of ip6_datagram_connect to consider the interface set by the IPV6_UNICAST_IF socket option, similarly to udpv6_sendmsg. This change is the IPv6 counterpart of the fix for IP_UNICAST_IF. The tests introduced by that patch showed that the incorrect behavior is present in IPv6 as well. This patch fixes the broken test. Reported-by: kernel test robot Link: https://lore.kernel.org/r/202210062117.c7eef1a3-oliver.sang@intel.com Fixes: 0e4d354762ce ("net-next: Fix IP_UNICAST_IF option behavior for connected sockets") Signed-off-by: Richard Gobert Reviewed-by: David Ahern Signed-off-by: David S. Miller commit a2d40ce7acdbf4641235ee8be4b4d338746c03b5 Author: Xu Panda Date: Fri Dec 9 15:37:29 2022 +0800 myri10ge: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit f6b759f56d1e2e3333a14936830e2377cbc9539e Author: Xu Panda Date: Fri Dec 9 15:34:49 2022 +0800 liquidio: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 94d30e8933382184b257e94ac0d020d3f56ed614 Author: Xu Panda Date: Fri Dec 9 15:33:25 2022 +0800 hns: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 1b1661f68b5f2b8ead9de3510cf6c1c7751863a4 Merge: 5fe02e046e642 6151d105dfce8 Author: David S. Miller Date: Mon Dec 12 09:56:17 2022 +0000 Merge branch 'net-dev_kfree_skb_irq' Yang Yingliang says: ==================== net: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call consume_skb() from hardware interrupt context or with interrupts being disabled. This patchset replace dev_kfree_skb() with dev_kfree_skb_irq/dev_consume_skb_irq() under spin_lock_irqsave() in some drivers, or move dev_kfree_skb() after spin_unlock_irqrestore(). v2 -> v3: Update commit message, and change to use dev_kfree_skb_irq() in patch #1, #3. v1 -> v2: patch #2 Move dev_kfree_skb() after spin_unlock_irqrestore() ==================== Signed-off-by: David S. Miller commit 6151d105dfce8c23edf30eed35e97f3d9b96a35c Author: Yang Yingliang Date: Thu Dec 8 22:21:47 2022 +0800 net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In these two cases, dev_kfree_skb() is called consume the xmited SKB, so replace it with dev_consume_skb_irq(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 3727f742915f04f6fc550b80cf406999bd4e90d0 Author: Yang Yingliang Date: Thu Dec 8 22:21:46 2022 +0800 hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In scc_discard_buffers(), dev_kfree_skb() is called to discard the SKBs, so replace it with dev_kfree_skb_irq(). In scc_net_tx(), dev_kfree_skb() is called to drop the SKB that exceed queue length, so replace it with dev_kfree_skb_irq(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit f07fadcbee2a5e84caa67c7c445424200bffb60b Author: Yang Yingliang Date: Thu Dec 8 22:21:45 2022 +0800 net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. In this case, the lock is used to protected 'bp', so we can move dev_kfree_skb() after the spin_unlock_irqrestore(). Fixes: 4796417417a6 ("dnet: Dave DNET ethernet controller driver (updated)") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit d1678bf45f21fa5ae4a456f821858679556ea5f8 Author: Yang Yingliang Date: Thu Dec 8 22:21:44 2022 +0800 net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In this case, dev_kfree_skb() is called in xemaclite_tx_timeout() to drop the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 5fe02e046e6422c4adfdbc50206ec7186077da24 Author: Yang Yingliang Date: Thu Dec 8 21:37:35 2022 +0800 net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In this case, dev_kfree_skb() is called in bmac_tx_timeout() to drop the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 3dfe3486c1cd4f82b466b7d307f23777137b8acc Author: Yang Yingliang Date: Thu Dec 8 21:37:34 2022 +0800 net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In this case, dev_kfree_skb() is called in mace_tx_timeout() to drop the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 3cf7203ca620682165706f70a1b12b5194607dce Author: Hangbin Liu Date: Thu Dec 8 20:04:52 2022 +0800 net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g. #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62 [exception RIP: vxlan_ecn_decapsulate+0x3b] RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246 RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000 RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700 RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700 R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan] #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507 #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45 #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807 #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951 #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139 #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3 #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3 Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh Fix this by waiting for all sk_user_data reader to finish before releasing the sock. Reported-by: Jianlin Shi Suggested-by: Jakub Sitnicki Fixes: 6a93cc905274 ("udp-tunnel: Add a few more UDP tunnel APIs") Signed-off-by: Hangbin Liu Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 2f623aaf9f31de968dea6169849706a2f9be444c Author: Li Zetao Date: Thu Dec 8 20:05:40 2022 +0800 net: farsync: Fix kmemleak when rmmods farsync There are two memory leaks reported by kmemleak: unreferenced object 0xffff888114b20200 (size 128): comm "modprobe", pid 4846, jiffies 4295146524 (age 401.345s) hex dump (first 32 bytes): e0 62 57 09 81 88 ff ff e0 62 57 09 81 88 ff ff .bW......bW..... 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc_trace+0x22/0x60 [] __hw_addr_add_ex+0x198/0x6c0 [] dev_addr_init+0x13d/0x230 [] alloc_netdev_mqs+0x10d/0xe50 [] alloc_hdlcdev+0x2e/0x80 [] fst_add_one+0x601/0x10e0 [farsync] ... unreferenced object 0xffff88810b85b000 (size 1024): comm "modprobe", pid 4846, jiffies 4295146523 (age 401.346s) hex dump (first 32 bytes): 00 00 b0 02 00 c9 ff ff 00 70 0a 00 00 c9 ff ff .........p...... 00 00 00 f2 00 00 00 f3 0a 00 00 00 02 00 00 00 ................ backtrace: [] kmalloc_trace+0x22/0x60 [] fst_add_one+0x154/0x10e0 [farsync] [] local_pci_probe+0xd3/0x170 ... The root cause is traced to the netdev and fst_card_info are not freed when removes one fst in fst_remove_one(), which may trigger oom if repeated insmod and rmmod module. Fix it by adding free_netdev() and kfree() in fst_remove_one(), just as the operations on the error handling path in fst_add_one(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Li Zetao Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 6cee96e09df54ae17784c0f38a49e0ed8229b825 Author: Yang Yingliang Date: Thu Dec 8 20:01:21 2022 +0800 ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled. It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal. In this case, dev_kfree_skb() is called in free_tx_buffers() to drop the SKBs in tx buffers, when the card is down, so replace it with dev_kfree_skb_irq() here. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 6d534ee057b62ca9332b988619323ee99c7847c1 Author: Michael Sit Wei Hong Date: Thu Dec 8 17:03:15 2022 +0800 net: stmmac: Add check for taprio basetime configuration Adds a boundary check to prevent negative basetime input from user while configuring taprio. Signed-off-by: Michael Sit Wei Hong Signed-off-by: Lai Peter Jun Ann Signed-off-by: David S. Miller commit b0b698b80c56b0712f0d4346d51bf0363ba03068 Author: James Hurley Date: Fri Dec 9 09:35:19 2022 -0500 platform/mellanox: mlxbf-pmc: Fix event typo Had a duplicate event typo, so just fixed the 1 character typo. Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Signed-off-by: James Hurley Reviewed-by: David Thompson Reviewed-by: Shravan Kumar Ramani Link: https://lore.kernel.org/r/aadacdbbd3186c55e74ea9456fe011b77938eb6c.1670535330.git.jahurley@nvidia.com Signed-off-by: Hans de Goede commit 93c60b597493d8875584385c90aa7933e92bf375 Merge: dd8b3a802b64a 418044e1de306 Author: David S. Miller Date: Mon Dec 12 09:29:57 2022 +0000 Merge branch 'tun-vnet-uso' Andrew Melnychenko says: ==================== TUN/VirtioNet USO features support. Added new offloads for TUN devices TUN_F_USO4 and TUN_F_USO6. Technically they enable NETIF_F_GSO_UDP_L4 (and only if USO4 & USO6 are set simultaneously). It allows the transmission of large UDP packets. UDP Segmentation Offload (USO/GSO_UDP_L4) - ability to split UDP packets into several segments. It's similar to UFO, except it doesn't use IP fragmentation. The drivers may push big packets and the NIC will split them(or assemble them in case of receive), but in the case of VirtioNet we just pass big UDP to the host. So we are freeing the driver from doing the unnecessary job of splitting. The same thing for several guests on one host, we can pass big packets between guests. Different features USO4 and USO6 are required for qemu where Windows guests can enable disable USO receives for IPv4 and IPv6 separately. On the other side, Linux can't really differentiate USO4 and USO6, for now. For now, to enable USO for TUN it requires enabling USO4 and USO6 together. In the future, there would be a mechanism to control UDP_L4 GSO separately. New types for virtio-net already in virtio-net specification: https://github.com/oasis-tcs/virtio-spec/issues/120 Test it WIP Qemu https://github.com/daynix/qemu/tree/USOv3 Changes since v4 & RFC: * Fixed typo and refactored. * Tun USO offload refactored. * Add support for guest-to-guest segmentation offload (thx Jason). ==================== Signed-off-by: David S. Miller commit 418044e1de3063a6c50df964bdfca7eecd7ec6e5 Author: Andrew Melnychenko Date: Wed Dec 7 13:35:58 2022 +0200 drivers/net/virtio_net.c: Added USO support. Now, it possible to enable GSO_UDP_L4("tx-udp-segmentation") for VirtioNet. Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit 860b7f27b8f78564ca5a2f607e0820b2d352a562 Author: Andrew Melnychenko Date: Wed Dec 7 13:35:57 2022 +0200 linux/virtio_net.h: Support USO offload in vnet header. Now, it's possible to convert USO vnet packets from/to skb. Added support for GSO_UDP_L4 offload. Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit 34061b348ae912b9783fae7fabae69d46977a036 Author: Andrew Melnychenko Date: Wed Dec 7 13:35:56 2022 +0200 uapi/linux/virtio_net.h: Added USO types. Added new GSO type for USO: VIRTIO_NET_HDR_GSO_UDP_L4. Feature VIRTIO_NET_F_HOST_USO allows to enable NETIF_F_GSO_UDP_L4. Separated VIRTIO_NET_F_GUEST_USO4 & VIRTIO_NET_F_GUEST_USO6 features required for Windows guests. Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit 399e0827642f6a8bcae24277fe08e80e7e4bb891 Author: Andrew Melnychenko Date: Wed Dec 7 13:35:55 2022 +0200 driver/net/tun: Added features for USO. Added support for USO4 and USO6. For now, to "enable" USO, it's required to set both USO4 and USO6 simultaneously. USO enables NETIF_F_GSO_UDP_L4. Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit b22bbdd17a5af2cc99cf42048970b9355dcbec8b Author: Andrew Melnychenko Date: Wed Dec 7 13:35:54 2022 +0200 uapi/linux/if_tun.h: Added new offload types for USO4/6. Added 2 additional offlloads for USO(IPv4 & IPv6). Separate offloads are required for Windows VM guests, g.e. Windows may set USO rx only for IPv4. Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit 1fd54773c26787b9aea80e2f62c7d0780ea444d0 Author: Andrew Melnychenko Date: Wed Dec 7 13:35:53 2022 +0200 udp: allow header check for dodgy GSO_UDP_L4 packets. Allow UDP_L4 for robust packets. Signed-off-by: Jason Wang Signed-off-by: Andrew Melnychenko Signed-off-by: David S. Miller commit 3e39f7971d75cafe1c90dec60526ad45484657c0 Author: Marek Vasut Date: Sun Dec 11 21:51:23 2022 +0100 dt-bindings: rtc: m41t80: Convert text schema to YAML one Convert the m41t80 text schema to YAML schema. Add "#clock-cells" requirement, which is required by clock-output-names. Signed-off-by: Marek Vasut Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221211205124.23823-1-marex@denx.de Signed-off-by: Alexandre Belloni commit aff234839f8b80ac101e6c2f14d0e44b236efa48 Author: James Clark Date: Fri Dec 9 16:44:46 2022 +0000 KVM: arm64: PMU: Fix PMCR_EL0 reset value ARMV8_PMU_PMCR_N_MASK is an unshifted value which results in the wrong reset value for PMCR_EL0, so shift it to fix it. This fixes the following error when running qemu: $ qemu-system-aarch64 -cpu host -machine type=virt,accel=kvm -kernel ... target/arm/helper.c:1813: pmevcntr_rawwrite: Assertion `counter < pmu_num_counters(env)' failed. Fixes: 292e8f149476 ("KVM: arm64: PMU: Simplify PMCR_EL0 reset handling") Signed-off-by: James Clark Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221209164446.1972014-2-james.clark@arm.com commit 12b677f2c697d61e5ddbcb6c1650050a39392f54 Author: Zhengchao Shao Date: Fri Dec 9 17:29:29 2022 +0800 ipc: fix memory leak in init_mqueue_fs() When setup_mq_sysctls() failed in init_mqueue_fs(), mqueue_inode_cachep is not released. In order to fix this issue, the release path is reordered. Link: https://lkml.kernel.org/r/20221209092929.1978875-1-shaozhengchao@huawei.com Fixes: dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") Signed-off-by: Zhengchao Shao Cc: Alexey Gladkov Cc: "Eric W. Biederman" Cc: Jingyu Wang Cc: Muchun Song Cc: Roman Gushchin Cc: Waiman Long Cc: Wei Yongjun Cc: YueHaibing Cc: Yu Zhe Cc: Manfred Spraul Cc: Davidlohr Bueso Signed-off-by: Andrew Morton commit 9f2b5debc07073e6dfdd774e3594d0224b991927 Author: Aditya Garg Date: Wed Dec 7 03:05:40 2022 +0000 hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount Despite specifying UID and GID in mount command, the specified UID and GID were not being assigned. This patch fixes this issue. Link: https://lkml.kernel.org/r/C0264BF5-059C-45CF-B8DA-3A3BD2C803A2@live.com Signed-off-by: Aditya Garg Reviewed-by: Viacheslav Dubeyko Cc: Signed-off-by: Andrew Morton commit d5b6e6eba3af11cb2a2791fa36a2524990fcde1a Author: Cai Xinchen Date: Sat Dec 3 08:57:21 2022 +0000 rapidio: devices: fix missing put_device in mport_cdev_open When kfifo_alloc fails, the refcount of chdev->dev is left incremental. We should use put_device(&chdev->dev) to decrease the ref count of chdev->dev to avoid refcount leak. Link: https://lkml.kernel.org/r/20221203085721.13146-1-caixinchen1@huawei.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: Cai Xinchen Cc: Alexandre Bounine Cc: Dan Carpenter Cc: Jakob Koschel Cc: John Hubbard Cc: Matt Porter Cc: Wang Weiyang Cc: Yang Yingliang Signed-off-by: Andrew Morton commit 204c2f535d05d52bd7334629557087f9983e6879 Author: Rong Tao Date: Sat Dec 3 18:25:21 2022 +0800 kcov: fix spelling typos in comments Fix the typo of 'suport' in kcov.h Link: https://lkml.kernel.org/r/tencent_922CA94B789587D79FD154445D035AA19E07@qq.com Signed-off-by: Rong Tao Reviewed-by: Dmitry Vyukov Cc: Andrey Konovalov Signed-off-by: Andrew Morton commit c53ed55cb275344086e32a7080a6b19cb183650b Author: ZhangPeng Date: Fri Dec 2 03:00:38 2022 +0000 hfs: Fix OOB Write in hfs_asc2mac Syzbot reported a OOB Write bug: loop0: detected capacity change from 0 to 64 ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 Write of size 1 at addr ffff88801848314e by task syz-executor391/3632 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 If in->len is much larger than HFS_NAMELEN(31) which is the maximum length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In that case, when the dst reaches the boundary, the srclen is still greater than 0, which causes a OOB write. Fix this by adding a check on dstlen in while() before writing to dst address. Link: https://lkml.kernel.org/r/20221202030038.1391945-1-zhangpeng362@huawei.com Fixes: 328b92278650 ("[PATCH] hfs: NLS support") Signed-off-by: ZhangPeng Reviewed-by: Viacheslav Dubeyko Reported-by: Signed-off-by: Andrew Morton commit 8d824e69d9f3fa3121b2dda25053bae71e2460d2 Author: ZhangPeng Date: Wed Nov 30 06:59:59 2022 +0000 hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 write_inode fs/fs-writeback.c:1440 [inline] If the input inode of hfs_write_inode() is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAMELEN(31) which is the maximum length of an HFS filename OOB read occurred: hfs_write_inode() hfs_brec_find() __hfs_brec_find() hfs_cat_keycmp() hfs_strcmp() # OOB read occurred due to len is too large Fix this by adding a Check on len in hfs_write_inode() before calling hfs_brec_find(). Link: https://lkml.kernel.org/r/20221130065959.2168236-1-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reported-by: Cc: Damien Le Moal Cc: Ira Weiny Cc: Jeff Layton Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Nanyong Sun Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit 4d8586e04602fe42f0a782d2005956f8b6302678 Author: Gavrilov Ilia Date: Tue Nov 29 09:23:38 2022 +0000 relay: fix type mismatch when allocating memory in relay_create_buf() The 'padding' field of the 'rchan_buf' structure is an array of 'size_t' elements, but the memory is allocated for an array of 'size_t *' elements. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru Fixes: b86ff981a825 ("[PATCH] relay: migrate from relayfs to a generic relay API") Signed-off-by: Ilia.Gavrilov Cc: Colin Ian King Cc: Jens Axboe Cc: wuchi Signed-off-by: Andrew Morton commit c9a934c7d88413a35861387a11e901554810b122 Author: Alexey Asemov Date: Sun Nov 27 09:46:38 2022 +0300 ocfs2: always read both high and low parts of dinode link count When filesystem is using indexed-dirs feature, maximum link count values can spill over to i_links_count_hi, up to OCFS2_DX_LINK_MAX links. ocfs2_read_links_count() checks for OCFS2_INDEXED_DIR_FL flag in dinode, but this flag is only valid for directories so for files the check causes high part of the link count not being read back from file dinodes resulting in wrong link count value when file has >65535 links. As ocfs2_set_links_count() always writes both high and low parts of link count, the flag check on reading may be removed. Link: https://lkml.kernel.org/r/cbfca02b-b39f-89de-e1a8-904a6c60407e@alex-at.net Signed-off-by: Alexey Asemov Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton commit eca36e43ee63114468e41a778b33b6886b9c5f6a Author: Christophe JAILLET Date: Sun Nov 27 17:07:32 2022 +0100 io-mapping: move some code within the include guarded section It is spurious to have some code out-side the include guard in a .h file. Fix it. Link: https://lkml.kernel.org/r/4dbaf427d4300edba6c6bbfaf4d57493b9bec6ee.1669565241.git.christophe.jaillet@wanadoo.fr Fixes: 1fbaf8fc12a0 ("mm: add a io_mapping_map_user helper") Signed-off-by: Christophe JAILLET Signed-off-by: Andrew Morton commit 6fcd4267a840d0536b8e5334ad5f31e4105fce85 Author: Anders Roxell Date: Mon Nov 28 11:43:58 2022 +0100 kernel: kcsan: kcsan_test: build without structleak plugin Building kcsan_test with structleak plugin enabled makes the stack frame size to grow. kernel/kcsan/kcsan_test.c:704:1: error: the frame size of 3296 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Turn off the structleak plugin checks for kcsan_test. Link: https://lkml.kernel.org/r/20221128104358.2660634-1-anders.roxell@linaro.org Signed-off-by: Anders Roxell Suggested-by: Arnd Bergmann Acked-by: Marco Elver Cc: Arnd Bergmann Cc: David Gow Cc: Jason A. Donenfeld Cc: Kees Cook Signed-off-by: Andrew Morton commit 5370079c326f80bbc55853a1b2be8e92d75f070d Author: Iskren Chernev Date: Thu Nov 24 13:43:56 2022 +0200 mailmap: update email for Iskren Chernev I'm sunsetting my gmail account and moving to personal domain. Link: https://lkml.kernel.org/r/20221124114356.2187901-1-me@iskren.info Signed-off-by: Iskren Chernev Acked-by: Iskren Chernev Signed-off-by: Andrew Morton commit fd4e60bf0ef8eb9edcfa12dda39e8b6ee9060492 Author: Zhang Qilong Date: Thu Nov 24 22:01:54 2022 +0800 eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD Commit ee62c6b2dc93 ("eventfd: change int to __u64 in eventfd_signal()") forgot to change int to __u64 in the CONFIG_EVENTFD=n stub function. Link: https://lkml.kernel.org/r/20221124140154.104680-1-zhangqilong3@huawei.com Fixes: ee62c6b2dc93 ("eventfd: change int to __u64 in eventfd_signal()") Signed-off-by: Zhang Qilong Cc: Dylan Yudaken Cc: Jens Axboe Cc: Sha Zhengju Signed-off-by: Andrew Morton commit 02d7d89f816951e0862147d751b1150d67aaebdd Author: Wang Weiyang Date: Wed Nov 23 17:51:47 2022 +0800 rapidio: fix possible UAF when kfifo_alloc() fails If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free priv. But priv is still in the chdev->file_list, then list traversal may cause UAF. This fixes the following smatch warning: drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list Link: https://lkml.kernel.org/r/20221123095147.52408-1-wangweiyang2@huawei.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: Wang Weiyang Cc: Alexandre Bounine Cc: Dan Carpenter Cc: Jakob Koschel Cc: John Hubbard Cc: Matt Porter Cc: Yang Yingliang Signed-off-by: Andrew Morton commit 3f0dad0105133ffcfa13eb0cd980fa347bcf31d7 Author: Xu Panda Date: Tue Nov 22 08:53:25 2022 +0800 relay: use strscpy() is more robust and safer The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Link: https://lkml.kernel.org/r/202211220853259244666@zte.com.cn Signed-off-by: Xu Panda Signed-off-by: Yang Yang Cc: Colin Ian King Cc: Jens Axboe Cc: wuchi Signed-off-by: Andrew Morton commit c47454823bd4e3ab34ed3f795afd4479ab938a3f Author: Linus Torvalds Date: Tue Dec 6 11:15:09 2022 -0800 mm: mmu_gather: allow more than one batch of delayed rmaps Commit 5df397dec7c4 ("mm: delay page_remove_rmap() until after the TLB has been flushed") limited the page batching for the mmu gather operation when a dirty shared page needed to delay rmap removal until after the TLB had been flushed. It did so because it needs to walk that array of pages while still holding the page table lock, and our mmu_gather infrastructure allows for batching quite a lot of pages. We may have thousands on pages queued up for freeing, and we wanted to walk only the last batch if we then added a dirty page to the queue. However, when I limited it to one batch, I didn't think of the degenerate case of the special first batch that is embedded on-stack in the mmu_gather structure (called "local") and that only has eight entries. So with the right pattern, that "limit delayed rmap to just one batch" will trigger over and over in that first small batch, and we'll waste a lot of time flushing TLB's every eight pages. And those right patterns are trivially triggered by just having a shared mappings with lots of adjacent dirty pages. Like the 'page_fault3' subtest of the 'will-it-scale' benchmark, that just maps a shared area, dirties all pages, and unmaps it. Rinse and repeat. We still want to limit the batching, but to fix this (easily triggered) degenerate case, just expand the "only one batch" logic to instead be "only one batch that isn't the special first on-stack ('local') batch". That way, when we need to flush the delayed rmaps, we can still limit our walk to just the last batch - and that first small one. Link: https://lkml.kernel.org/r/CAHk-=whkL5aM1fR7kYUmhHQHBcMUc-bDoFP7EwYjTxy64DGtvw@mail.gmail.com Fixes: 5df397dec7c4 ("mm: delay page_remove_rmap() until after the TLB has been flushed") Signed-off-by: Linus Torvalds Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202212051534.852804af-yujie.liu@intel.com Tested-by: Huang, Ying Tested-by: Hugh Dickins Cc: Feng Tang Cc: Johannes Weiner Cc: Nadav Amit Cc: Xing Zhengjun Cc: "Yin, Fengwei" Signed-off-by: Andrew Morton commit c7cdf94e9cd7a03549e61b0f85949959191b8a10 Author: Wang Yong Date: Wed Dec 7 07:40:11 2022 +0000 mm: fix typo in struct pglist_data code comment change "stat" to "start". Link: https://lkml.kernel.org/r/20221207074011.GA151242@cloud Fixes: c959924b0dc5 ("memory tiering: adjust hot threshold automatically") Signed-off-by: Wang Yong Reviewed-by: "Huang, Ying" Signed-off-by: Andrew Morton commit 5478afc55a2104caaef5b78c7c1f9acb9ec1f92a Author: Alexander Potapenko Date: Mon Dec 5 15:57:40 2022 +0100 kmsan: fix memcpy tests Recent Clang changes may cause it to delete calls of memcpy(), if the source is an uninitialized volatile local. This happens because passing a pointer to a volatile local into memcpy() discards the volatile qualifier, giving the compiler a free hand to optimize the memcpy() call away. Use OPTIMIZER_HIDE_VAR() to hide the uninitialized var from the too-smart compiler. Link: https://lkml.kernel.org/r/20221205145740.694038-1-glider@google.com Signed-off-by: Alexander Potapenko Suggested-by: Marco Elver Reviewed-by: Marco Elver Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit de2e5171433126d340573cb7d0d4fcac084ab2a0 Author: Kefeng Wang Date: Mon Dec 5 22:03:27 2022 +0800 mm: add cond_resched() in swapin_walk_pmd_entry() When handling MADV_WILLNEED in madvise(), a soflockup may occurr in swapin_walk_pmd_entry() if swapping in lots of memory on a slow device. Add a cond_resched() to avoid the possible softlockup. Link: https://lkml.kernel.org/r/20221205140327.72304-1-wangkefeng.wang@huawei.com Fixes: 1998cc048901 ("mm: make madvise(MADV_WILLNEED) support swap file prefetch") Signed-off-by: Kefeng Wang Cc: Shaohua Li Cc: Hugh Dickins Cc: Rik van Riel Signed-off-by: Andrew Morton commit 8614d6c5eda005ad72b37afeaae2879d7c101b18 Author: Jason A. Donenfeld Date: Mon Dec 5 18:30:07 2022 +0100 mm: do not show fs mm pc for VM_LOCKONFAULT pages When VM_LOCKONFAULT was added, /proc/PID/smaps wasn't hooked up to it, so looking at /proc/PID/smaps, it shows '??' instead of something intelligable. This can be reached by userspace by simply calling `mlock2(..., MLOCK_ONFAULT);`. Fix this by adding "lf" to denote VM_LOCKONFAULT. Link: https://lkml.kernel.org/r/20221205173007.580210-1-Jason@zx2c4.com Fixes: de60f5f10c58 ("mm: introduce VM_LOCKONFAULT") Signed-off-by: Jason A. Donenfeld Acked-by: Vlastimil Babka Cc: Eric B Munson Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton commit 9d789c3b4170574baa4242dd8cae5988cf97d48d Author: David Hildenbrand Date: Mon Dec 5 20:37:16 2022 +0100 selftests/vm: ksm_functional_tests: fixes for 32bit The test currently fails on 32bit. Fixing the "-1ull" vs. "-1ul" seems to make the test pass and the compiler happy. Note: This test is not in mm-stable yet. This fix should be squashed into "selftests/vm: add KSM unmerge tests". Link: https://lkml.kernel.org/r/20221205193716.276024-5-david@redhat.com Signed-off-by: David Hildenbrand Cc: Shuah Khan Cc: Yang Li Signed-off-by: Andrew Morton commit 380969fe5aacdea661d3f9ab32e84327e8624ae2 Author: David Hildenbrand Date: Mon Dec 5 20:37:15 2022 +0100 selftests/vm: cow: fix compile warning on 32bit The compiler complains about the conversion of a pointer to an int of different width. Link: https://lkml.kernel.org/r/20221205193716.276024-4-david@redhat.com Fixes: 6f1405efc61b ("selftests/vm: anon_cow: add R/O longterm tests via gup_test") Signed-off-by: David Hildenbrand Cc: Shuah Khan Cc: Yang Li Signed-off-by: Andrew Morton commit d88825f22b8f1cad8acb429b6bf0a54c85d7b93f Author: David Hildenbrand Date: Mon Dec 5 20:37:14 2022 +0100 selftests/vm: madv_populate: fix missing MADV_POPULATE_(READ|WRITE) definitions The tests fail to compile in some environments (e.g., Debian 11.5 on x86). Let's simply conditionally define MADV_POPULATE_(READ|WRITE) if not already defined, similar to how the khugepaged.c test handles it. Link: https://lkml.kernel.org/r/20221205193716.276024-3-david@redhat.com Fixes: 39b2e5cae43d ("selftests/vm: make MADV_POPULATE_(READ|WRITE) use in-tree headers") Signed-off-by: David Hildenbrand Cc: Shuah Khan Cc: Yang Li Signed-off-by: Andrew Morton commit a0ac9b3598fac36907bd1baec28c99656d2ed0b6 Author: David Hildenbrand Date: Mon Dec 5 20:37:13 2022 +0100 mm/gup_test: fix PIN_LONGTERM_TEST_READ with highmem Patch series "selftests/vm: fix some tests on 32bit". I finally had the time to run some of the selftests written by me (especially "cow") on x86 PAE. I found some unexpected "surprises" :) With these changes, and with [1] on top of mm-unstable, the "cow" tests and the "ksm_functional_tests" compile and pass as expected (expected failures with hugetlb in the "cow" tests). "madv_populate" has one expected test failure -- x86 does not support softdirty tracking. #1-#3 fix commits with stable commit ids. #4 fixes a test that is not in mm-stable yet. A note that there are many other compile errors/warnings when compiling on 32bit and with older Linux headers ... something for another day. [1] https://lkml.kernel.org/r/20221205150857.167583-1-david@redhat.com This patch (of 4): ... we have to kmap()/kunmap(), otherwise this won't work as expected with highmem. Link: https://lkml.kernel.org/r/20221205193716.276024-1-david@redhat.com Link: https://lkml.kernel.org/r/20221205193716.276024-2-david@redhat.com Fixes: c77369b437f9 ("mm/gup_test: start/stop/read functionality for PIN LONGTERM test") Signed-off-by: David Hildenbrand Cc: Shuah Khan , Cc: Yang Li Signed-off-by: Andrew Morton commit 6287b7dae80944bfa37784a8f9d6861a4facaa6e Author: Hugh Dickins Date: Sun Dec 4 17:57:07 2022 -0800 mm,thp,rmap: fix races between updates of subpages_mapcount Commit 4b51634cd16a, introducing the COMPOUND_MAPPED bit, paid attention to the impossibility of subpages_mapcount ever appearing negative; but did not attend to those races in which it can momentarily appear larger than thought possible. These arise from how page_remove_rmap() first decrements page->_mapcount or compound_mapcount, then, if that transition goes negative (logical 0), decrements subpages_mapcount. The initial decrement lets a racing page_add_*_rmap() reincrement _mapcount or compound_mapcount immediately, and then in rare cases its corresponding increment of subpages_mapcount may be completed before page_remove_rmap()'s decrement. There could even (with increasing unlikelihood) be a series of increments intermixed with the decrements. In practice, checking subpages_mapcount with a temporary WARN on range, has caught values of 0x1000000 (2*COMPOUND_MAPPED, when move_pages() was using remove_migration_pmd()) and 0x800201 (do_huge_pmd_wp_page() using __split_huge_pmd()): page_add_anon_rmap() racing page_remove_rmap(), as predicted. I certainly found it harder to reason about than when bit_spin_locked, but the easy case gives a clue to how to handle the harder case. The easy case being the three !(nr & COMPOUND_MAPPED) checks, which should obviously be replaced by (nr < COMPOUND_MAPPED) checks - to count a page as compound mapped, even while the bit in that position is 0. The harder case is when trying to decide how many subpages are newly covered or uncovered, when compound map is first added or last removed: not knowing all that racily happened between first and second atomic ops. But the easy way to handle that, is again to count the page as compound mapped all the while that its subpages_mapcount indicates so - ignoring the _mapcount or compound_mapcount transition while it is on the way to being reversed. Link: https://lkml.kernel.org/r/4388158-3092-a960-ff2d-55f2b0fe4ef8@google.com Fixes: 4b51634cd16a ("mm,thp,rmap: subpages_mapcount COMPOUND_MAPPED if PMD-mapped") Signed-off-by: Hugh Dickins Cc: David Hildenbrand Cc: James Houghton Cc: Johannes Weiner Cc: John Hubbard Cc: "Kirill A . Shutemov" Cc: Linus Torvalds Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mike Kravetz Cc: Mina Almasry Cc: Muchun Song Cc: Naoya Horiguchi Cc: Peter Xu Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c449deb2b99ff2458214ed4a3526277bc9e40757 Author: Hugh Dickins Date: Sun Dec 4 17:01:03 2022 -0800 mm: memcg: fix swapcached stat accounting I'd been worried by high "swapcached" counts in memcg OOM reports, thought we had a problem freeing swapcache, but it was just the accounting that was wrong. Two issues: 1. When __remove_mapping() removes swapcache, __delete_from_swap_cache() relies on memcg_data for the right counts to be updated; but that had already been reset by mem_cgroup_swapout(). Swap those calls around - mem_cgroup_swapout() does not require the swapcached flag to be set. 6.1 commit ac35a4902374 ("mm: multi-gen LRU: minimal implementation") already made a similar swap for workingset_eviction(), but not for this. 2. memcg's "swapcached" count was added for memcg v2 stats, but displayed on OOM even for memcg v1: so mem_cgroup_move_account() ought to move it. Link: https://lkml.kernel.org/r/b8b96ee0-1e1e-85f8-df97-c82a11d7cd14@google.com Fixes: b6038942480e ("mm: memcg: add swapcache stat for memcg v2") Signed-off-by: Hugh Dickins Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Michal Hocko Cc: Roman Gushchin Cc: Yu Zhao Signed-off-by: Andrew Morton commit 12a5d3955227b0d7e04fb793ccceeb2a1dd275c5 Author: Mina Almasry Date: Fri Dec 2 14:35:31 2022 -0800 mm: add nodes= arg to memory.reclaim The nodes= arg instructs the kernel to only scan the given nodes for proactive reclaim. For example use cases, consider a 2 tier memory system: nodes 0,1 -> top tier nodes 2,3 -> second tier $ echo "1m nodes=0" > memory.reclaim This instructs the kernel to attempt to reclaim 1m memory from node 0. Since node 0 is a top tier node, demotion will be attempted first. This is useful to direct proactive reclaim to specific nodes that are under pressure. $ echo "1m nodes=2,3" > memory.reclaim This instructs the kernel to attempt to reclaim 1m memory in the second tier, since this tier of memory has no demotion targets the memory will be reclaimed. $ echo "1m nodes=0,1" > memory.reclaim Instructs the kernel to reclaim memory from the top tier nodes, which can be desirable according to the userspace policy if there is pressure on the top tiers. Since these nodes have demotion targets, the kernel will attempt demotion first. Since commit 3f1509c57b1b ("Revert "mm/vmscan: never demote for memcg reclaim""), the proactive reclaim interface memory.reclaim does both reclaim and demotion. Reclaim and demotion incur different latency costs to the jobs in the cgroup. Demoted memory would still be addressable by the userspace at a higher latency, but reclaimed memory would need to incur a pagefault. The 'nodes' arg is useful to allow the userspace to control demotion and reclaim independently according to its policy: if the memory.reclaim is called on a node with demotion targets, it will attempt demotion first; if it is called on a node without demotion targets, it will only attempt reclaim. Link: https://lkml.kernel.org/r/20221202223533.1785418-1-almasrymina@google.com Signed-off-by: Mina Almasry Acked-by: Michal Hocko Acked-by: Shakeel Butt Acked-by: Muchun Song Cc: Bagas Sanjaya Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Roman Gushchin Cc: Tejun Heo Cc: Wei Xu Cc: Yang Shi Cc: Yosry Ahmed Cc: zefan li Signed-off-by: Andrew Morton commit 6b426d071419a40f61fe41fe1bd9e1b4fa5aeb37 Author: Mina Almasry Date: Thu Dec 1 15:33:17 2022 -0800 mm: disable top-tier fallback to reclaim on proactive reclaim Reclaiming directly from top tier nodes breaks the aging pipeline of memory tiers. If we have a RAM -> CXL -> storage hierarchy, we should demote from RAM to CXL and from CXL to storage. If we reclaim a page from RAM, it means we 'demote' it directly from RAM to storage, bypassing potentially a huge amount of pages colder than it in CXL. However disabling reclaim from top tier nodes entirely would cause ooms in edge scenarios where lower tier memory is unreclaimable for whatever reason, e.g. memory being mlocked() or too hot to reclaim. In these cases we would rather the job run with a performance regression rather than it oom altogether. However, we can disable reclaim from top tier nodes for proactive reclaim. That reclaim is not real memory pressure, and we don't have any cause to be breaking the aging pipeline. [akpm@linux-foundation.org: restore comment layout, per Ying Huang] Link: https://lkml.kernel.org/r/20221201233317.1394958-1-almasrymina@google.com Signed-off-by: Mina Almasry Reviewed-by: "Huang, Ying" Reviewed-by: Yang Shi Cc: Greg Thelen Cc: Shakeel Butt Cc: Tim Chen Cc: Wei Xu Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 1c74697776e17619e485a40cf8cfdb4bf18fd18e Author: Yosry Ahmed Date: Fri Dec 2 03:15:12 2022 +0000 selftests: cgroup: make sure reclaim target memcg is unprotected Make sure that we ignore protection of a memcg that is the target of memcg reclaim. Link: https://lkml.kernel.org/r/20221202031512.1365483-4-yosryahmed@google.com Signed-off-by: Yosry Ahmed Reviewed-by: Roman Gushchin Cc: Chris Down Cc: David Rientjes Cc: Johannes Weiner Cc: Matthew Wilcox Cc: Michal Hocko Cc: Muchun Song Cc: Shakeel Butt Cc: Tejun Heo Cc: Vasily Averin Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit e5d64edac64531375716fabe35c9e0a502ca2894 Author: Yosry Ahmed Date: Fri Dec 2 03:15:11 2022 +0000 selftests: cgroup: refactor proactive reclaim code to reclaim_until() Refactor the code that drives writing to memory.reclaim (retrying, error handling, etc) from test_memcg_reclaim() to a helper called reclaim_until(), which proactively reclaims from a memcg until its usage reaches a certain value. While we are at it, refactor and simplify the reclaim loop. This will be used in a following patch in another test. Link: https://lkml.kernel.org/r/20221202031512.1365483-3-yosryahmed@google.com Signed-off-by: Yosry Ahmed Suggested-by: Roman Gushchin Reviewed-by: Roman Gushchin Cc: Chris Down Cc: David Rientjes Cc: Johannes Weiner Cc: Matthew Wilcox Cc: Michal Hocko Cc: Muchun Song Cc: Shakeel Butt Cc: Tejun Heo Cc: Vasily Averin Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit adb8213014b25c7f1d75d5b219becaadcd695efb Author: Yosry Ahmed Date: Fri Dec 2 03:15:10 2022 +0000 mm: memcg: fix stale protection of reclaim target memcg Patch series "mm: memcg: fix protection of reclaim target memcg", v3. This series fixes a bug in calculating the protection of the reclaim target memcg where we end up using stale effective protection values from the last reclaim operation, instead of completely ignoring the protection of the reclaim target as intended. More detailed explanation and examples in patch 1, which includes the fix. Patches 2 & 3 introduce a selftest case that catches the bug. This patch (of 3): When we are doing memcg reclaim, the intended behavior is that we ignore any protection (memory.min, memory.low) of the target memcg (but not its children). Ever since the patch pointed to by the "Fixes" tag, we actually read a stale value for the target memcg protection when deciding whether to skip the memcg or not because it is protected. If the stale value happens to be high enough, we don't reclaim from the target memcg. Essentially, in some cases we may falsely skip reclaiming from the target memcg of reclaim because we read a stale protection value from last time we reclaimed from it. During reclaim, mem_cgroup_calculate_protection() is used to determine the effective protection (emin and elow) values of a memcg. The protection of the reclaim target is ignored, but we cannot set their effective protection to 0 due to a limitation of the current implementation (see comment in mem_cgroup_protection()). Instead, we leave their effective protection values unchaged, and later ignore it in mem_cgroup_protection(). However, mem_cgroup_protection() is called later in shrink_lruvec()->get_scan_count(), which is after the mem_cgroup_below_{min/low}() checks in shrink_node_memcgs(). As a result, the stale effective protection values of the target memcg may lead us to skip reclaiming from the target memcg entirely, before calling shrink_lruvec(). This can be even worse with recursive protection, where the stale target memcg protection can be higher than its standalone protection. See two examples below (a similar version of example (a) is added to test_memcontrol in a later patch). (a) A simple example with proactive reclaim is as follows. Consider the following hierarchy: ROOT | A | B (memory.min = 10M) Consider the following scenario: - B has memory.current = 10M. - The system undergoes global reclaim (or memcg reclaim in A). - In shrink_node_memcgs(): - mem_cgroup_calculate_protection() calculates the effective min (emin) of B as 10M. - mem_cgroup_below_min() returns true for B, we do not reclaim from B. - Now if we want to reclaim 5M from B using proactive reclaim (memory.reclaim), we should be able to, as the protection of the target memcg should be ignored. - In shrink_node_memcgs(): - mem_cgroup_calculate_protection() immediately returns for B without doing anything, as B is the target memcg, relying on mem_cgroup_protection() to ignore B's stale effective min (still 10M). - mem_cgroup_below_min() reads the stale effective min for B and we skip it instead of ignoring its protection as intended, as we never reach mem_cgroup_protection(). (b) An more complex example with recursive protection is as follows. Consider the following hierarchy with memory_recursiveprot: ROOT | A (memory.min = 50M) | B (memory.min = 10M, memory.high = 40M) Consider the following scenario: - B has memory.current = 35M. - The system undergoes global reclaim (target memcg is NULL). - B will have an effective min of 50M (all of A's unclaimed protection). - B will not be reclaimed from. - Now allocate 10M more memory in B, pushing it above it's high limit. - The system undergoes memcg reclaim from B (target memcg is B). - Like example (a), we do nothing in mem_cgroup_calculate_protection(), then call mem_cgroup_below_min(), which will read the stale effective min for B (50M) and skip it. In this case, it's even worse because we are not just considering B's standalone protection (10M), but we are reading a much higher stale protection (50M) which will cause us to not reclaim from B at all. This is an artifact of commit 45c7f7e1ef17 ("mm, memcg: decouple e{low,min} state mutations from protection checks") which made mem_cgroup_calculate_protection() only change the state without returning any value. Before that commit, we used to return MEMCG_PROT_NONE for the target memcg, which would cause us to skip the mem_cgroup_below_{min/low}() checks. After that commit we do not return anything and we end up checking the min & low effective protections for the target memcg, which are stale. Update mem_cgroup_supports_protection() to also check if we are reclaiming from the target, and rename it to mem_cgroup_unprotected() (now returns true if we should not protect the memcg, much simpler logic). Link: https://lkml.kernel.org/r/20221202031512.1365483-1-yosryahmed@google.com Link: https://lkml.kernel.org/r/20221202031512.1365483-2-yosryahmed@google.com Fixes: 45c7f7e1ef17 ("mm, memcg: decouple e{low,min} state mutations from protection checks") Signed-off-by: Yosry Ahmed Reviewed-by: Roman Gushchin Cc: Chris Down Cc: David Rientjes Cc: Johannes Weiner Cc: Matthew Wilcox Cc: Michal Hocko Cc: Muchun Song Cc: Shakeel Butt Cc: Tejun Heo Cc: Vasily Averin Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit 675eaca1f441acd4f0d403d71036b100cd49036a Author: Alistair Popple Date: Fri Dec 2 15:53:39 2022 +1100 mm/mmap: properly unaccount memory on mas_preallocate() failure security_vm_enough_memory_mm() accounts memory via a call to vm_acct_memory(). Therefore any subsequent failures should unaccount for this memory prior to returning the error. Link: https://lkml.kernel.org/r/20221202045339.2999017-1-apopple@nvidia.com Fixes: 28c5609fb236 ("mm/mmap: preallocate maple nodes for brk vma expansion") Signed-off-by: Alistair Popple Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 1bda9dad5aa0199c8592bac32b91afbf8ea236ff Author: Christoph Hellwig Date: Fri Dec 2 11:26:44 2022 +0100 omfs: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and remove the ->writepage implementation. Link: https://lkml.kernel.org/r/20221202102644.770505-8-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Bob Copeland Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit 2274c3b281bb47e6980ae42fb8dc93b7a38192d5 Author: Christoph Hellwig Date: Fri Dec 2 11:26:43 2022 +0100 jfs: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and remove the ->writepage implementation. Link: https://lkml.kernel.org/r/20221202102644.770505-7-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Dave Kleikamp Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit cd2e6024260de27a523e0af6ee47a20a6b8b8aa8 Author: Christoph Hellwig Date: Fri Dec 2 11:26:42 2022 +0100 hpfs: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and remove the ->writepage implementation. Link: https://lkml.kernel.org/r/20221202102644.770505-6-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit 12f9b9a73dc603e658bf24eed2777cecdaf4103e Author: Christoph Hellwig Date: Fri Dec 2 11:26:41 2022 +0100 hfsplus: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and stop wiring up ->writepage for hfsplus_aops. Link: https://lkml.kernel.org/r/20221202102644.770505-5-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit ba195d9f14829690b8e4f67549960d83169a314e Author: Christoph Hellwig Date: Fri Dec 2 11:26:40 2022 +0100 hfs: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and stop wiring up ->writepage for hfs_aops. Link: https://lkml.kernel.org/r/20221202102644.770505-4-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit ee649af0d9a60ea61a5dad99ef5d6b4aa346f0a0 Author: Christoph Hellwig Date: Fri Dec 2 11:26:39 2022 +0100 fat: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and remove the ->writepage implementation. Link: https://lkml.kernel.org/r/20221202102644.770505-3-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit a11774122180a782b327b0a9a5091d99c91a4db7 Author: Christoph Hellwig Date: Fri Dec 2 11:26:38 2022 +0100 extfat: remove ->writepage Patch series "start removing writepage instances v2". The VM doesn't need or want ->writepage for writeback and is fine with just having ->writepages as long as ->migrate_folio is implemented. This series removes all ->writepage instances that use block_write_full_page directly and also have a plain mpage_writepages based ->writepages. This patch (of 7): ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Set ->migrate_folio to the generic buffer_head based helper, and remove the ->writepage implementation. Link: https://lkml.kernel.org/r/20221202102644.770505-1-hch@lst.de Link: https://lkml.kernel.org/r/20221202102644.770505-2-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Namjae Jeon Acked-by: Johannes Weiner Cc: Bob Copeland Cc: Dave Kleikamp Cc: Jan Kara Cc: Mikulas Patocka Cc: OGAWA Hirofumi Cc: Sungjong Seo Signed-off-by: Andrew Morton commit ac4b2901a112e4dcee1455c96d89ef83cc7aa545 Author: Deyan Wang Date: Thu Dec 1 21:50:45 2022 +0800 mm/page_alloc: update comments in __free_pages_ok() Add a comment to explain why we call get_pfnblock_migratetype() twice in __free_pages_ok(). Link: https://lkml.kernel.org/r/20221201135045.31663-1-wonder_rock@126.com Signed-off-by: Deyan Wang Signed-off-by: Andrew Morton commit 480017957d6380d3336a8e80ad90f70415bb86f7 Author: Shiyang Ruan Date: Thu Dec 1 15:32:53 2022 +0000 xfs: remove restrictions for fsdax and reflink Since the basic function for fsdax and reflink has been implemented, remove the restrictions of them for widly test. Link: https://lkml.kernel.org/r/1669908773-207-1-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit d984648e428bf88cbd94ebe346c73632cb92fffb Author: Shiyang Ruan Date: Thu Dec 1 15:32:33 2022 +0000 fsdax,xfs: port unshare to fsdax Implement unshare in fsdax mode: copy data from srcmap to iomap. Link: https://lkml.kernel.org/r/1669908753-169-1-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit 64e6edc185da7e101e867c4732c097fedb1da08e Author: Shiyang Ruan Date: Thu Dec 1 15:32:10 2022 +0000 xfs: use dax ops for zero and truncate in fsdax mode Zero and truncate on a dax file may execute CoW. So use dax ops which contains end work for CoW. Link: https://lkml.kernel.org/r/1669908730-131-1-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit 0e79e3736d54bb8efbc9fb29cc3b54a132783565 Author: Shiyang Ruan Date: Thu Dec 1 15:31:41 2022 +0000 fsdax: dedupe: iter two files at the same time The iomap_iter() on a range of one file may loop more than once. In this case, the inner dst_iter can update its iomap but the outer src_iter can't. This may cause the wrong remapping in filesystem. Let them called at the same time. Link: https://lkml.kernel.org/r/1669908701-93-1-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit c6f0b395b2110aa26a134a9a395875b1ec0a5aae Author: Shiyang Ruan Date: Thu Dec 1 15:28:54 2022 +0000 fsdax,xfs: set the shared flag when file extent is shared If a dax page is shared, mapread at different offsets can also trigger page fault on same dax page. So, change the flag from "cow" to "shared". And get the shared flag from filesystem when read. Link: https://lkml.kernel.org/r/1669908538-55-5-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit 708dfad2eb4169324189782edd6d3763237e0489 Author: Shiyang Ruan Date: Thu Dec 1 15:28:53 2022 +0000 fsdax: zero the edges if source is HOLE or UNWRITTEN If srcmap contains invalid data, such as HOLE and UNWRITTEN, the dest page should be zeroed. Otherwise, since it's a pmem, old data may remains on the dest page, the result of CoW will be incorrect. The function name is also not easy to understand, rename it to "dax_iomap_copy_around()", which means it copies data around the range. [akpm@linux-foundation.org: update dax_iomap_copy_around() kerneldoc, per Darrick] Link: https://lkml.kernel.org/r/1669973145-318-1-git-send-email-ruansy.fnst@fujitsu.com Link: https://lkml.kernel.org/r/1669908538-55-4-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Reviewed-by: Allison Henderson Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit f80e1668888f34c0764822e74953c997daf2ccdb Author: Shiyang Ruan Date: Thu Dec 1 15:28:52 2022 +0000 fsdax: invalidate pages when CoW CoW changes the share state of a dax page, but the share count of the page isn't updated. The next time access this page, it should have been a newly accessed, but old association exists. So, we need to clear the share state when CoW happens, in both dax_iomap_rw() and dax_zero_iter(). Link: https://lkml.kernel.org/r/1669908538-55-3-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Alistair Popple Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: John Hubbard Signed-off-by: Andrew Morton commit 169004265860327182ecf92297b25b6271e81e96 Author: Shiyang Ruan Date: Thu Dec 1 15:28:51 2022 +0000 fsdax: introduce page->share for fsdax in reflink mode Patch series "fsdax,xfs: fix warning messages", v2. Many testcases failed in dax+reflink mode with warning message in dmesg. Such as generic/051,075,127. The warning message is like this: [ 775.509337] ------------[ cut here ]------------ [ 775.509636] WARNING: CPU: 1 PID: 16815 at fs/dax.c:386 dax_insert_entry.cold+0x2e/0x69 [ 775.510151] Modules linked in: auth_rpcgss oid_registry nfsv4 algif_hash af_alg af_packet nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink ip6table_filter ip6_tables iptable_filter ip_tables x_tables dax_pmem nd_pmem nd_btt sch_fq_codel configfs xfs libcrc32c fuse [ 775.524288] CPU: 1 PID: 16815 Comm: fsx Kdump: loaded Tainted: G W 6.1.0-rc4+ #164 eb34e4ee4200c7cbbb47de2b1892c5a3e027fd6d [ 775.524904] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.0-3-3 04/01/2014 [ 775.525460] RIP: 0010:dax_insert_entry.cold+0x2e/0x69 [ 775.525797] Code: c7 c7 18 eb e0 81 48 89 4c 24 20 48 89 54 24 10 e8 73 6d ff ff 48 83 7d 18 00 48 8b 54 24 10 48 8b 4c 24 20 0f 84 e3 e9 b9 ff <0f> 0b e9 dc e9 b9 ff 48 c7 c6 a0 20 c3 81 48 c7 c7 f0 ea e0 81 48 [ 775.526708] RSP: 0000:ffffc90001d57b30 EFLAGS: 00010082 [ 775.527042] RAX: 000000000000002a RBX: 0000000000000000 RCX: 0000000000000042 [ 775.527396] RDX: ffffea000a0f6c80 RSI: ffffffff81dfab1b RDI: 00000000ffffffff [ 775.527819] RBP: ffffea000a0f6c40 R08: 0000000000000000 R09: ffffffff820625e0 [ 775.528241] R10: ffffc90001d579d8 R11: ffffffff820d2628 R12: ffff88815fc98320 [ 775.528598] R13: ffffc90001d57c18 R14: 0000000000000000 R15: 0000000000000001 [ 775.528997] FS: 00007f39fc75d740(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000 [ 775.529474] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 775.529800] CR2: 00007f39fc772040 CR3: 0000000107eb6001 CR4: 00000000003706e0 [ 775.530214] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 775.530592] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 775.531002] Call Trace: [ 775.531230] [ 775.531444] dax_fault_iter+0x267/0x6c0 [ 775.531719] dax_iomap_pte_fault+0x198/0x3d0 [ 775.532002] __xfs_filemap_fault+0x24a/0x2d0 [xfs aa8d25411432b306d9554da38096f4ebb86bdfe7] [ 775.532603] __do_fault+0x30/0x1e0 [ 775.532903] do_fault+0x314/0x6c0 [ 775.533166] __handle_mm_fault+0x646/0x1250 [ 775.533480] handle_mm_fault+0xc1/0x230 [ 775.533810] do_user_addr_fault+0x1ac/0x610 [ 775.534110] exc_page_fault+0x63/0x140 [ 775.534389] asm_exc_page_fault+0x22/0x30 [ 775.534678] RIP: 0033:0x7f39fc55820a [ 775.534950] Code: 00 01 00 00 00 74 99 83 f9 c0 0f 87 7b fe ff ff c5 fe 6f 4e 20 48 29 fe 48 83 c7 3f 49 8d 0c 10 48 83 e7 c0 48 01 fe 48 29 f9 a4 c4 c1 7e 7f 00 c4 c1 7e 7f 48 20 c5 f8 77 c3 0f 1f 44 00 00 [ 775.535839] RSP: 002b:00007ffc66a08118 EFLAGS: 00010202 [ 775.536157] RAX: 00007f39fc772001 RBX: 0000000000042001 RCX: 00000000000063c1 [ 775.536537] RDX: 0000000000006400 RSI: 00007f39fac42050 RDI: 00007f39fc772040 [ 775.536919] RBP: 0000000000006400 R08: 00007f39fc772001 R09: 0000000000042000 [ 775.537304] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 775.537694] R13: 00007f39fc772000 R14: 0000000000006401 R15: 0000000000000003 [ 775.538086] [ 775.538333] ---[ end trace 0000000000000000 ]--- This also affects dax+noreflink mode if we run the test after a dax+reflink test. So, the most urgent thing is solving the warning messages. With these fixes, most warning messages in dax_associate_entry() are gone. But honestly, generic/388 will randomly failed with the warning. The case shutdown the xfs when fsstress is running, and do it for many times. I think the reason is that dax pages in use are not able to be invalidated in time when fs is shutdown. The next time dax page to be associated, it still remains the mapping value set last time. I'll keep on solving it. The warning message in dax_writeback_one() can also be fixed because of the dax unshare. This patch (of 8): fsdax page is used not only when CoW, but also mapread. To make the it easily understood, use 'share' to indicate that the dax page is shared by more than one extent. And add helper functions to use it. Also, the flag needs to be renamed to PAGE_MAPPING_DAX_SHARED. [ruansy.fnst@fujitsu.com: rename several functions] Link: https://lkml.kernel.org/r/1669972991-246-1-git-send-email-ruansy.fnst@fujitsu.com [ruansy.fnst@fujitsu.com: v2.2] Link: https://lkml.kernel.org/r/1670381359-53-1-git-send-email-ruansy.fnst@fujitsu.com Link: https://lkml.kernel.org/r/1669908538-55-1-git-send-email-ruansy.fnst@fujitsu.com Link: https://lkml.kernel.org/r/1669908538-55-2-git-send-email-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Allison Henderson Reviewed-by: Darrick J. Wong Cc: Dan Williams Cc: Dave Chinner Cc: Jason Gunthorpe Cc: Alistair Popple Cc: John Hubbard Signed-off-by: Andrew Morton commit 0b7623bdf89b9f6d320784e929acb78291aaf5f6 Author: SeongJae Park Date: Thu Dec 1 17:08:34 2022 +0000 selftests/damon: test removed scheme sysfs dir access bug A DAMON sysfs user could start DAMON with a scheme, remove the sysfs directory for the scheme, and then ask stats or schemes tried regions update. The related logic were not aware of the already removed directory situation, so it was able to results in invalid memory accesses. The fix has made with commit 8468b486612c ("mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed"), though. Add a selftest to prevent such kinds of bugs from being introduced again. Link: https://lkml.kernel.org/r/20221201170834.62823-1-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit c8c7016f50c85688d71feea2dba1bd955d5f5358 Author: Andrey Konovalov Date: Wed Nov 30 16:02:03 2022 +0100 kasan: fail non-kasan KUnit tests on KASAN reports After the recent changes done to KUnit-enabled KASAN tests, non-KASAN KUnit tests stopped being failed when KASAN report is detected. Recover that property by failing the currently running non-KASAN KUnit test when KASAN detects and prints a report for a bad memory access. Note that if the bad accesses happened in a kernel thread that doesn't have a reference to the currently running KUnit-test available via current->kunit_test, the test won't be failed. This is a limitation of KUnit, which doesn't yet provide a thread-agnostic way to find the reference to the currenly running test. Link: https://lkml.kernel.org/r/7be29a8ea967cee6b7e48d3d5a242d1d0bd96851.1669820505.git.andreyknvl@google.com Fixes: 49d9977ac909 ("kasan: check CONFIG_KASAN_KUNIT_TEST instead of CONFIG_KUNIT") Fixes: 7ce0ea19d50e ("kasan: switch kunit tests to console tracepoints") Signed-off-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: David Gow Cc: Dmitry Vyukov Cc: Marco Elver Signed-off-by: Andrew Morton commit 19fc1a7e8b2b3b0e18fbea84ee26517e1b0f1a6e Author: Sidhartha Kumar Date: Tue Nov 29 14:50:39 2022 -0800 mm/hugetlb: change hugetlb allocation functions to return a folio Many hugetlb allocation helper functions have now been converting to folios, update their higher level callers to be compatible with folios. alloc_pool_huge_page is reorganized to avoid a smatch warning reporting the folio variable is uninitialized. [sidhartha.kumar@oracle.com: update alloc_and_dissolve_hugetlb_folio comments] Link: https://lkml.kernel.org/r/20221206233512.146535-1-sidhartha.kumar@oracle.com Link: https://lkml.kernel.org/r/20221129225039.82257-11-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reported-by: Wei Chen Suggested-by: John Hubbard Suggested-by: Rasmus Villemoes Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Tarun Sahu Signed-off-by: Andrew Morton commit d1c6095572d0cf00c0cd30378639ff9387b34edd Author: Sidhartha Kumar Date: Tue Nov 29 14:50:38 2022 -0800 mm/hugetlb: convert hugetlb prep functions to folios Convert prep_new_huge_page() and __prep_compound_gigantic_page() to folios. Link: https://lkml.kernel.org/r/20221129225039.82257-10-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 7f325a8d25631e68cd75afaeaf330187e45e0eb5 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:37 2022 -0800 mm/hugetlb: convert free_gigantic_page() to folios Convert callers of free_gigantic_page() to use folios, function is then renamed to free_gigantic_folio(). Link: https://lkml.kernel.org/r/20221129225039.82257-9-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 240d67a86ecb0fa18863821a0cb55783ad50ef30 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:36 2022 -0800 mm/hugetlb: convert enqueue_huge_page() to folios Convert callers of enqueue_huge_page() to pass in a folio, function is renamed to enqueue_hugetlb_folio(). Link: https://lkml.kernel.org/r/20221129225039.82257-8-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 2f6c57d696abcd2d27d07b8506d5e6bcc060e77a Author: Sidhartha Kumar Date: Tue Nov 29 14:50:35 2022 -0800 mm/hugetlb: convert add_hugetlb_page() to folios and add hugetlb_cma_folio() Convert add_hugetlb_page() to take in a folio, also convert hugetlb_cma_page() to take in a folio. Link: https://lkml.kernel.org/r/20221129225039.82257-7-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit d6ef19e25df2aa50f932a78c368d7bb710eaaa1b Author: Sidhartha Kumar Date: Tue Nov 29 14:50:34 2022 -0800 mm/hugetlb: convert update_and_free_page() to folios Make more progress on converting the free_huge_page() destructor to operate on folios by converting update_and_free_page() to folios. Link: https://lkml.kernel.org/r/20221129225039.82257-6-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar \ Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit cfd5082b514765f873504cc60a50cce30738bfd3 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:33 2022 -0800 mm/hugetlb: convert remove_hugetlb_page() to folios Removes page_folio() call by converting callers to directly pass a folio into __remove_hugetlb_page(). Link: https://lkml.kernel.org/r/20221129225039.82257-5-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 1a7cdab59b22465b850501e3897a3f3aa01670d8 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:32 2022 -0800 mm/hugetlb: convert dissolve_free_huge_page() to folios Removes compound_head() call by using a folio rather than a head page. Link: https://lkml.kernel.org/r/20221129225039.82257-4-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 911565b8285381e62d3bfd0cae2889a022737c37 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:31 2022 -0800 mm/hugetlb: convert destroy_compound_gigantic_page() to folios Convert page operations within __destroy_compound_gigantic_page() to the corresponding folio operations. Link: https://lkml.kernel.org/r/20221129225039.82257-3-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Muchun Song Cc: Rasmus Villemoes Cc: Tarun Sahu Cc: Wei Chen Signed-off-by: Andrew Morton commit 9fd330582b2fe43c49ebcd02b2480f051f85aad4 Author: Sidhartha Kumar Date: Tue Nov 29 14:50:30 2022 -0800 mm: add folio dtor and order setter functions Patch series "convert core hugetlb functions to folios", v5. ============== OVERVIEW =========================== Now that many hugetlb helper functions that deal with hugetlb specific flags[1] and hugetlb cgroups[2] are converted to folios, higher level allocation, prep, and freeing functions within hugetlb can also be converted to operate in folios. Patch 1 of this series implements the wrapper functions around setting the compound destructor and compound order for a folio. Besides the user added in patch 1, patch 2 and patch 9 also use these helper functions. Patches 2-10 convert the higher level hugetlb functions to folios. ============== TESTING =========================== LTP: Ran 10 back to back rounds of the LTP hugetlb test suite. Gigantic Huge Pages: Test allocation and freeing via hugeadm commands: hugeadm --pool-pages-min 1GB:10 hugeadm --pool-pages-min 1GB:0 Demote: Demote 1 1GB hugepages to 512 2MB hugepages echo 1 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages echo 1 > /sys/kernel/mm/hugepages/hugepages-1048576kB/demote cat /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages # 512 cat /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages # 0 [1] https://lore.kernel.org/lkml/20220922154207.1575343-1-sidhartha.kumar@oracle.com/ [2] https://lore.kernel.org/linux-mm/20221101223059.460937-1-sidhartha.kumar@oracle.com/ This patch (of 10): Add folio equivalents for set_compound_order() and set_compound_page_dtor(). Also remove extra new-lines introduced by mm/hugetlb: convert move_hugetlb_state() to folios and mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios. [sidhartha.kumar@oracle.com: clarify folio_set_compound_order() zero support] Link: https://lkml.kernel.org/r/20221207223731.32784-1-sidhartha.kumar@oracle.com Link: https://lkml.kernel.org/r/20221129225039.82257-1-sidhartha.kumar@oracle.com Link: https://lkml.kernel.org/r/20221129225039.82257-2-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Suggested-by: Mike Kravetz Suggested-by: Muchun Song Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Mina Almasry Cc: Tarun Sahu Cc: Rasmus Villemoes Cc: Wei Chen Signed-off-by: Andrew Morton commit 6e1ca48d0669b0f5efcbaa051b23cd8e651a1614 Author: Vishal Moola (Oracle) Date: Tue Nov 1 10:53:26 2022 -0700 folio-compat: remove lru_cache_add() There are no longer any callers of lru_cache_add(), so remove it. This saves 79 bytes of kernel text. Also cleanup some comments such that they reference the new folio_add_lru() instead. Link: https://lkml.kernel.org/r/20221101175326.13265-6-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Miklos Szeredi Signed-off-by: Andrew Morton commit 284a344ed19dc92526024d062b30f90774fea50f Author: Vishal Moola (Oracle) Date: Tue Nov 1 10:53:25 2022 -0700 khugepage: replace lru_cache_add() with folio_add_lru() Replaces some calls with their folio equivalents. This is in preparation for the removal of lru_cache_add(). This replaces 3 calls to compound_head() with 1. Link: https://lkml.kernel.org/r/20221101175326.13265-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Miklos Szeredi Signed-off-by: Andrew Morton commit 28965f0f8be62e1ed8296fe0240b5d5dc064b681 Author: Vishal Moola (Oracle) Date: Tue Nov 1 10:53:24 2022 -0700 userfaultfd: replace lru_cache functions with folio_add functions Replaces lru_cache_add() and lru_cache_add_inactive_or_unevictable() with folio_add_lru() and folio_add_lru_vma(). This is in preparation for the removal of lru_cache_add(). Link: https://lkml.kernel.org/r/20221101175326.13265-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Miklos Szeredi Signed-off-by: Andrew Morton commit 063aaad792eef49a11d7575dc9914b43c0fa3792 Author: Vishal Moola (Oracle) Date: Tue Nov 1 10:53:23 2022 -0700 fuse: convert fuse_try_move_page() to use folios Converts the function to try to move folios instead of pages. Also converts fuse_check_page() to fuse_get_folio() since this is its only caller. This change removes 15 calls to compound_head(). Link: https://lkml.kernel.org/r/20221101175326.13265-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: Miklos Szeredi Cc: Matthew Wilcox (Oracle) Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 3720dd6dcac38d03424d6ba38107f39af5318bcf Author: Vishal Moola (Oracle) Date: Tue Nov 1 10:53:22 2022 -0700 filemap: convert replace_page_cache_page() to replace_page_cache_folio() Patch series "Removing the lru_cache_add() wrapper". This patchset replaces all calls of lru_cache_add() with the folio equivalent: folio_add_lru(). This is allows us to get rid of the wrapper The series passes xfstests and the userfaultfd selftests. This patch (of 5): Eliminates 7 calls to compound_head(). Link: https://lkml.kernel.org/r/20221101175326.13265-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20221101175326.13265-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Miklos Szeredi Signed-off-by: Andrew Morton commit c5a303a51b9ca85b52250fd8d92bf4918fbbdf0d Author: Feiyang Chen Date: Thu Oct 27 20:52:53 2022 +0800 LoongArch: enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP The feature of minimizing overhead of struct page associated with each HugeTLB page is implemented on x86_64. However, the infrastructure of this feature is already there, so just select ARCH_WANT_HUGETLB_PAGE_ OPTIMIZE_VMEMMAP is enough to enable this feature for LoongArch. Link: https://lkml.kernel.org/r/20221027125253.3458989-5-chenhuacai@loongson.cn Signed-off-by: Feiyang Chen Signed-off-by: Huacai Chen Reviewed-by: Philippe Mathieu-Daudé Acked-by: Muchun Song Reviewed-by: Arnd Bergmann Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Dinh Nguyen Cc: Guo Ren Cc: Jiaxun Yang Cc: Min Zhou Cc: Peter Zijlstra Cc: Thomas Bogendoerfer Cc: Will Deacon Cc: Xuefeng Li Cc: Xuerui Wang Signed-off-by: Andrew Morton commit 2045a3b8911b6ee64dd9b522d61abc468ecdcdb5 Author: Feiyang Chen Date: Thu Oct 27 20:52:52 2022 +0800 mm/sparse-vmemmap: generalise vmemmap_populate_hugepages() Generalise vmemmap_populate_hugepages() so ARM64 & X86 & LoongArch can share its implementation. Link: https://lkml.kernel.org/r/20221027125253.3458989-4-chenhuacai@loongson.cn Signed-off-by: Feiyang Chen Signed-off-by: Huacai Chen Acked-by: Will Deacon Acked-by: Dave Hansen Reviewed-by: Arnd Bergmann Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dinh Nguyen Cc: Guo Ren Cc: Jiaxun Yang Cc: Min Zhou Cc: Peter Zijlstra Cc: Philippe Mathieu-Daudé Cc: Thomas Bogendoerfer Cc: Xuefeng Li Cc: Xuerui Wang Cc: Muchun Song Signed-off-by: Andrew Morton commit 7b09f5af01ede480cbe7abcb281cf17550a46ff5 Author: Feiyang Chen Date: Thu Oct 27 20:52:51 2022 +0800 LoongArch: add sparse memory vmemmap support Add sparse memory vmemmap support for LoongArch. SPARSEMEM_VMEMMAP uses a virtually mapped memmap to optimise pfn_to_page and page_to_pfn operations. This is the most efficient option when sufficient kernel resources are available. Link: https://lkml.kernel.org/r/20221027125253.3458989-3-chenhuacai@loongson.cn Signed-off-by: Min Zhou Signed-off-by: Feiyang Chen Signed-off-by: Huacai Chen Reviewed-by: Arnd Bergmann Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Dinh Nguyen Cc: Guo Ren Cc: Jiaxun Yang Cc: Peter Zijlstra Cc: Philippe Mathieu-Daudé Cc: Thomas Bogendoerfer Cc: Will Deacon Cc: Xuefeng Li Cc: Xuerui Wang Cc: Muchun Song Signed-off-by: Andrew Morton commit 22c4e80466eb88cff283ed50a5d0b0ff1654d0c3 Author: Feiyang Chen Date: Thu Oct 27 20:52:50 2022 +0800 MIPS&LoongArch&NIOS2: adjust prototypes of p?d_init() Patch series "mm/sparse-vmemmap: Generalise helpers and enable for LoongArch", v14. This series is in order to enable sparse-vmemmap for LoongArch. But LoongArch cannot use generic helpers directly because MIPS&LoongArch need to call pgd_init()/pud_init()/pmd_init() when populating page tables. So we adjust the prototypes of p?d_init() to make generic helpers can call them, then enable sparse-vmemmap with generic helpers, and to be further, generalise vmemmap_populate_hugepages() for ARM64, X86 and LoongArch. This patch (of 4): We are preparing to add sparse vmemmap support to LoongArch. MIPS and LoongArch need to call pgd_init()/pud_init()/pmd_init() when populating page tables, so adjust their prototypes to make generic helpers can call them. NIOS2 declares pmd_init() but doesn't use, just remove it to avoid build errors. Link: https://lkml.kernel.org/r/20221027125253.3458989-1-chenhuacai@loongson.cn Link: https://lkml.kernel.org/r/20221027125253.3458989-2-chenhuacai@loongson.cn Signed-off-by: Feiyang Chen Signed-off-by: Huacai Chen Reviewed-by: Jiaxun Yang Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Arnd Bergmann Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Dinh Nguyen Cc: Guo Ren Cc: Peter Zijlstra Cc: Thomas Bogendoerfer Cc: Will Deacon Cc: Xuefeng Li Cc: Xuerui Wang Cc: Min Zhou Cc: Muchun Song Signed-off-by: Andrew Morton commit 85716a80c16dd6b6d1aaed87cd4b91c9b1d9b9b2 Author: Alexander Potapenko Date: Mon Nov 28 10:45:41 2022 +0100 kmsan: allow using __msan_instrument_asm_store() inside runtime In certain cases (e.g. when handling a softirq) __msan_instrument_asm_store(&var, sizeof(var)) may be called with from within KMSAN runtime, but later the value of @var is used with !kmsan_in_runtime(), leading to false positives. Because kmsan_internal_unpoison_memory() doesn't take locks, it should be fine to call it without kmsan_in_runtime() checks, which fixes the mentioned false positives. Link: https://lkml.kernel.org/r/20221128094541.2645890-2-glider@google.com Signed-off-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Eric Biggers Cc: Ingo Molnar Cc: Marco Elver Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton commit 1e8e4a7cc2fa3017b1daf02612e095d51924ce1e Author: Alexander Potapenko Date: Mon Nov 28 10:45:40 2022 +0100 lockdep: allow instrumenting lockdep.c with KMSAN Lockdep and KMSAN used to play badly together, causing deadlocks when KMSAN instrumentation of lockdep.c called lockdep functions recursively. Looks like this is no more the case, and a kernel can run (yet slower) with both KMSAN and lockdep enabled. This patch should fix false positives on wq_head->lock->dep_map, which KMSAN used to consider uninitialized because of lockdep.c not being instrumented. Link: https://lore.kernel.org/lkml/Y3b9AAEKp2Vr3e6O@sol.localdomain/ Link: https://lkml.kernel.org/r/20221128094541.2645890-1-glider@google.com Signed-off-by: Alexander Potapenko Reported-by: Eric Biggers Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Marco Elver Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton commit d3a89233583bf8edab18ac09732759c71dbe0173 Author: zhang songyi Date: Mon Nov 28 21:07:43 2022 +0800 include/linux/pgtable.h: : remove redundant pte variable Return value from ptep_get_and_clear_full() directly instead of taking this in another redundant variable. Link: https://lkml.kernel.org/r/202211282107437343474@zte.com.cn Signed-off-by: zhang songyi Signed-off-by: Andrew Morton commit 3cd629e5775397103e0428f62ce64747741dbfe5 Author: Brian Foster Date: Mon Nov 28 10:56:32 2022 -0500 mm/fadvise: use LLONG_MAX instead of -1 for eof generic_fadvise() sets endbyte = -1 to specify end of file (i.e. if length == 0 is passed from userspace). Most other callers to filemap_fdatawrite_range() use LLONG_MAX for this purpose, particularly if they also call fdatawait_range() (which requires end >= start). For example, sync_file_range(), vfs_fsync() (where the range is passed down through per-fs ->fsync() callbacks), filemap_flush(), etc. generic_fadvise() does not currently wait on writeback, but fix the call up to be consistent with other callers. Link: https://lkml.kernel.org/r/20221128155632.3950447-3-bfoster@redhat.com Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton commit feeb9b26952367bc1171592ee476f95aa81ee588 Author: Brian Foster Date: Mon Nov 28 10:56:31 2022 -0500 filemap: skip write and wait if end offset precedes start Patch series "filemap: skip write and wait if end offset precedes start", v2. A fix for the odd write and wait behavior described in the patch 1 commit log. Technically patch 1 could simply remove the check rather than lift it into the callers, but this seemed a bit more user friendly to me. Patch 2 is appended after observation that fadvise() interacted poorly with the v1 patch. This is no longer a problem with v2, making patch 2 purely a cleanup. This series survived both fstests and ltp regression runs without observable problems. I had (end < start) warning checks in each relevant function, with fadvise() being the only caller that triggered them. That said, I dropped the warnings after testing because there seemed to much potential for noise from the various other callers. This patch (of 2): A call to file[map]_write_and_wait_range() with an end offset that precedes the start offset but happens to land in the same page can trigger writeback submission but fails to wait on the submitted page. Writeback submission occurs because __filemap_fdatawrite_range() passes both offsets down into write_cache_pages(), which rounds down to page indexes before it starts processing writeback. However, __filemap_fdatawait_range() immediately returns if the byte-granular end offset precedes the start offset. This behavior was observed in the form of unpredictable latency from a frequent write and wait call with incorrect parameters. The behavior gave the impression that the fdatawait path might occasionally fail to wait on writeback, but further investigation showed the latency was from write_cache_pages() waiting on writeback state to clear for a page already under writeback. Therefore, this indicated that fdatawait actually never waits on writeback in this particular situation. The byte granular check in __filemap_fdatawait_range() goes all the way back to the old wait_on_page_writeback() helper. It originally used page offsets and so would have waited in this problematic case. That changed to byte granularity file offsets in commit 94004ed726f3 ("kill wait_on_page_writeback_range"), which subtly changed this behavior. The check itself has become somewhat redundant since the error checking code that used to follow the wait loop (at the time of the aforementioned commit) has now been removed and lifted into the higher level callers. Therefore, we can restore historical fdatawait behavior by simply removing the check. Since the current fdatawait behavior has been in place for quite some time and is consistent with other interfaces that use file offsets, instead lift the check into the file[map]_write_and_wait_range() helpers to provide consistent behavior between the write and wait. Link: https://lkml.kernel.org/r/20221128155632.3950447-1-bfoster@redhat.com Link: https://lkml.kernel.org/r/20221128155632.3950447-2-bfoster@redhat.com Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton commit 9997bc017549acd6425e32300eff28424ffeeb6b Author: Nhat Pham Date: Mon Nov 28 11:16:15 2022 -0800 zsmalloc: implement writeback mechanism for zsmalloc This commit adds the writeback mechanism for zsmalloc, analogous to the zbud allocator. Zsmalloc will attempt to determine the coldest zspage (i.e least recently used) in the pool, and attempt to write back all the stored compressed objects via the pool's evict handler. Link: https://lkml.kernel.org/r/20221128191616.1261026-7-nphamcs@gmail.com Signed-off-by: Nhat Pham Acked-by: Johannes Weiner Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Minchan Kim Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit bd0fded29689a762e6a749a1258a59cc2b99a18a Author: Nhat Pham Date: Mon Nov 28 11:16:14 2022 -0800 zsmalloc: add zpool_ops field to zs_pool to store evict handlers This adds a new field to zs_pool to store evict handlers for writeback, analogous to the zbud allocator. Link: https://lkml.kernel.org/r/20221128191616.1261026-6-nphamcs@gmail.com Signed-off-by: Nhat Pham Acked-by: Minchan Kim Acked-by: Johannes Weiner Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 64f768c6b32e1957e2b65b70e97cb4cb62344bc4 Author: Nhat Pham Date: Mon Nov 28 11:16:13 2022 -0800 zsmalloc: add a LRU to zs_pool to keep track of zspages in LRU order This helps determines the coldest zspages as candidates for writeback. Link: https://lkml.kernel.org/r/20221128191616.1261026-5-nphamcs@gmail.com Signed-off-by: Nhat Pham Acked-by: Johannes Weiner Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Minchan Kim Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit c0547d0b6a4b637db05406b90ba82e1b2e71de56 Author: Nhat Pham Date: Mon Nov 28 11:16:12 2022 -0800 zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks Currently, zsmalloc has a hierarchy of locks, which includes a pool-level migrate_lock, and a lock for each size class. We have to obtain both locks in the hotpath in most cases anyway, except for zs_malloc. This exception will no longer exist when we introduce a LRU into the zs_pool for the new writeback functionality - we will need to obtain a pool-level lock to synchronize LRU handling even in zs_malloc. In preparation for zsmalloc writeback, consolidate these locks into a single pool-level lock, which drastically reduces the complexity of synchronization in zsmalloc. We have also benchmarked the lock consolidation to see the performance effect of this change on zram. First, we ran a synthetic FS workload on a server machine with 36 cores (same machine for all runs), using fs_mark -d ../zram1mnt -s 100000 -n 2500 -t 32 -k before and after for btrfs and ext4 on zram (FS usage is 80%). Here is the result (unit is file/second): With lock consolidation (btrfs): Average: 13520.2, Median: 13531.0, Stddev: 137.5961482019028 Without lock consolidation (btrfs): Average: 13487.2, Median: 13575.0, Stddev: 309.08283679298665 With lock consolidation (ext4): Average: 16824.4, Median: 16839.0, Stddev: 89.97388510006668 Without lock consolidation (ext4) Average: 16958.0, Median: 16986.0, Stddev: 194.7370021336469 As you can see, we observe a 0.3% regression for btrfs, and a 0.9% regression for ext4. This is a small, barely measurable difference in my opinion. For a more realistic scenario, we also tries building the kernel on zram. Here is the time it takes (in seconds): With lock consolidation (btrfs): real Average: 319.6, Median: 320.0, Stddev: 0.8944271909999159 user Average: 6894.2, Median: 6895.0, Stddev: 25.528415540334656 sys Average: 521.4, Median: 522.0, Stddev: 1.51657508881031 Without lock consolidation (btrfs): real Average: 319.8, Median: 320.0, Stddev: 0.8366600265340756 user Average: 6896.6, Median: 6899.0, Stddev: 16.04057355583023 sys Average: 520.6, Median: 521.0, Stddev: 1.140175425099138 With lock consolidation (ext4): real Average: 320.0, Median: 319.0, Stddev: 1.4142135623730951 user Average: 6896.8, Median: 6878.0, Stddev: 28.621670111997307 sys Average: 521.2, Median: 521.0, Stddev: 1.7888543819998317 Without lock consolidation (ext4) real Average: 319.6, Median: 319.0, Stddev: 0.8944271909999159 user Average: 6886.2, Median: 6887.0, Stddev: 16.93221781102523 sys Average: 520.4, Median: 520.0, Stddev: 1.140175425099138 The difference is entirely within the noise of a typical run on zram. This hardly justifies the complexity of maintaining both the pool lock and the class lock. In fact, for writeback, we would need to introduce yet another lock to prevent data races on the pool's LRU, further complicating the lock handling logic. IMHO, it is just better to collapse all of these into a single pool-level lock. Link: https://lkml.kernel.org/r/20221128191616.1261026-4-nphamcs@gmail.com Signed-off-by: Nhat Pham Suggested-by: Johannes Weiner Acked-by: Minchan Kim Acked-by: Johannes Weiner Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 6a05aa30109d5cd4bebfb89415c58fa4599ef875 Author: Johannes Weiner Date: Mon Nov 28 11:16:11 2022 -0800 zpool: clean out dead code There is a lot of provision for flexibility that isn't actually needed or used. Zswap (the only zpool user) always passes zpool_ops with an .evict method set. The backends who reclaim only do so for zswap, so they can also directly call zpool_ops without indirection or checks. Finally, there is no need to check the retries parameters and bail with -EINVAL in the reclaim function, when that's called just a few lines below with a hard-coded 8. There is no need to duplicate the evictable and sleep_mapped attrs from the driver in zpool_ops. Link: https://lkml.kernel.org/r/20221128191616.1261026-3-nphamcs@gmail.com Reviewed-by: Sergey Senozhatsky Signed-off-by: Johannes Weiner Signed-off-by: Nhat Pham Cc: Dan Streetman Cc: Minchan Kim Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 6b3379e8dcbea09b7e27bf0eea2f53fd15a164ac Author: Johannes Weiner Date: Mon Nov 28 11:16:10 2022 -0800 zswap: fix writeback lock ordering for zsmalloc Patch series "Implement writeback for zsmalloc", v7. Unlike other zswap allocators such as zbud or z3fold, zsmalloc currently lacks the writeback mechanism. This means that when the zswap pool is full, it will simply reject further allocations, and the pages will be written directly to swap. This series of patches implements writeback for zsmalloc. When the zswap pool becomes full, zsmalloc will attempt to evict all the compressed objects in the least-recently used zspages. This patch (of 6): zswap's customary lock order is tree->lock before pool->lock, because the tree->lock protects the entries' refcount, and the free callbacks in the backends acquire their respective pool locks to dispatch the backing object. zsmalloc's map callback takes the pool lock, so zswap must not grab the tree->lock while a handle is mapped. This currently only happens during writeback, which isn't implemented for zsmalloc. In preparation for it, move the tree->lock section out of the mapped entry section Link: https://lkml.kernel.org/r/20221128191616.1261026-1-nphamcs@gmail.com Link: https://lkml.kernel.org/r/20221128191616.1261026-2-nphamcs@gmail.com Signed-off-by: Johannes Weiner Signed-off-by: Nhat Pham Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Minchan Kim Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Signed-off-by: Andrew Morton commit fd3b1bc3c86ee11ba77421b00c70280605b521c6 Author: Pavankumar Kondeti Date: Wed Nov 9 10:48:36 2022 +0530 mm/madvise: fix madvise_pageout for private file mappings When MADV_PAGEOUT is called on a private file mapping VMA region, we bail out early if the process is neither owner nor write capable of the file. However, this VMA may have both private/shared clean pages and private dirty pages. The opportunity of paging out the private dirty pages (Anon pages) is missed. Fix this behavior by allowing private file mappings pageout further and perform the file access check along with PageAnon() during page walk. We observe ~10% improvement in zram usage, thus leaving more available memory on a 4GB RAM system running Android. [quic_pkondeti@quicinc.com: v2] Link: https://lkml.kernel.org/r/1669962597-27724-1-git-send-email-quic_pkondeti@quicinc.com Link: https://lkml.kernel.org/r/1667971116-12900-1-git-send-email-quic_pkondeti@quicinc.com Signed-off-by: Pavankumar Kondeti Cc: Charan Teja Kalla Cc: Minchan Kim Cc: Suren Baghdasaryan Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 4c9473e87e75a2a77ccd02e55c91ffe6a52b5df6 Author: Gautam Menghani Date: Wed Oct 26 10:52:18 2022 +0530 mm/khugepaged: add tracepoint to collapse_file() "mm_khugepaged_collapse_file" for capturing is_shmem. Currently, is_shmem is not being captured. Capturing is_shmem is useful as it can indicate if tmpfs is being used as a backing store instead of persistent storage. Add the tracepoint in collapse_file() named "mm_khugepaged_collapse_file" for capturing is_shmem. [gautammenghani201@gmail.com: swap is_shmem and addr to save space, per Steven Rostedt] Link: https://lkml.kernel.org/r/20221202201807.182829-1-gautammenghani201@gmail.com Link: https://lkml.kernel.org/r/20221026052218.148234-1-gautammenghani201@gmail.com Signed-off-by: Gautam Menghani Reviewed-by: Steven Rostedt (Google) [tracing] Cc: David Hildenbrand Cc: Masami Hiramatsu (Google) Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit f7355e99d9f71fcde093193fd4b569a648ba5ce3 Author: David Hildenbrand Date: Fri Oct 21 12:11:41 2022 +0200 mm/gup: remove FOLL_MIGRATION Fortunately, the last user (KSM) is gone, so let's just remove this rather special code from generic GUP handling -- especially because KSM never required the PMD handling as KSM only deals with individual base pages. [akpm@linux-foundation.org: fix merge snafu]Link: https://lkml.kernel.org/r/20221021101141.84170-10-david@redhat.com Signed-off-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d7c0e68dab98f0f5a2af501eaefeb90cc855fc80 Author: David Hildenbrand Date: Fri Oct 21 12:11:40 2022 +0200 mm/ksm: convert break_ksm() to use walk_page_range_vma() FOLL_MIGRATION exists only for the purpose of break_ksm(), and actually, there is not even the need to wait for the migration to finish, we only want to know if we're dealing with a KSM page. Using follow_page() just to identify a KSM page overcomplicates GUP code. Let's use walk_page_range_vma() instead, because we don't actually care about the page itself, we only need to know a single property -- no need to even grab a reference. So, get rid of follow_page() usage such that we can get rid of FOLL_MIGRATION now and eventually be able to get rid of follow_page() in the future. In my setup (AMD Ryzen 9 3900X), running the KSM selftest to test unmerge performance on 2 GiB (taskset 0x8 ./ksm_tests -D -s 2048), this results in a performance degradation of ~2% (old: ~5010 MiB/s, new: ~4900 MiB/s). I don't think we particularly care for now. Interestingly, the benchmark reduction is due to the single callback. Adding a second callback (e.g., pud_entry()) reduces the benchmark by another 100-200 MiB/s. Link: https://lkml.kernel.org/r/20221021101141.84170-9-david@redhat.com Signed-off-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e07cda5f232fac4de0925d8a4c92e51e41fa2f6e Author: David Hildenbrand Date: Fri Oct 21 12:11:39 2022 +0200 mm/pagewalk: add walk_page_range_vma() Let's add walk_page_range_vma(), which is similar to walk_page_vma(), however, is only interested in a subset of the VMA range. To be used in KSM code to stop using follow_page() next. Link: https://lkml.kernel.org/r/20221021101141.84170-8-david@redhat.com Signed-off-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6cce3314b928b2db7d5f48171e18314226551c3f Author: David Hildenbrand Date: Fri Oct 21 12:11:37 2022 +0200 mm/ksm: fix KSM COW breaking with userfaultfd-wp via FAULT_FLAG_UNSHARE Let's stop breaking COW via a fake write fault and let's use FAULT_FLAG_UNSHARE instead. This avoids any wrong side effects of the fake write fault, such as mapping the PTE writable and marking the pte dirty/softdirty. Consequently, we will no longer trigger a fake write fault and break COW without any such side-effects. Also, this fixes KSM interaction with userfaultfd-wp: when we have a KSM page that's write-protected by userfaultfd, break_ksm()->handle_mm_fault() will fail with VM_FAULT_SIGBUS and will simply return in break_ksm() with 0 instead of actually breaking COW. For now, the KSM unmerge tests can trigger that: $ sudo ./ksm_functional_tests TAP version 13 1..3 # [RUN] test_unmerge ok 1 Pages were unmerged # [RUN] test_unmerge_discarded ok 2 Pages were unmerged # [RUN] test_unmerge_uffd_wp not ok 3 Pages were unmerged Bail out! 1 out of 3 tests failed # Planned tests != run tests (2 != 3) # Totals: pass:2 fail:1 xfail:0 xpass:0 skip:0 error:0 The warning in dmesg also indicates this wrong handling: [ 230.096368] FAULT_FLAG_ALLOW_RETRY missing 881 [ 230.100822] CPU: 1 PID: 1643 Comm: ksm-uffd-wp [...] [ 230.110124] Hardware name: [...] [ 230.117775] Call Trace: [ 230.120227] [ 230.122334] dump_stack_lvl+0x44/0x5c [ 230.126010] handle_userfault.cold+0x14/0x19 [ 230.130281] ? tlb_finish_mmu+0x65/0x170 [ 230.134207] ? uffd_wp_range+0x65/0xa0 [ 230.137959] ? _raw_spin_unlock+0x15/0x30 [ 230.141972] ? do_wp_page+0x50/0x590 [ 230.145551] __handle_mm_fault+0x9f5/0xf50 [ 230.149652] ? mmput+0x1f/0x40 [ 230.152712] handle_mm_fault+0xb9/0x2a0 [ 230.156550] break_ksm+0x141/0x180 [ 230.159964] unmerge_ksm_pages+0x60/0x90 [ 230.163890] ksm_madvise+0x3c/0xb0 [ 230.167295] do_madvise.part.0+0x10c/0xeb0 [ 230.171396] ? do_syscall_64+0x67/0x80 [ 230.175157] __x64_sys_madvise+0x5a/0x70 [ 230.179082] do_syscall_64+0x58/0x80 [ 230.182661] ? do_syscall_64+0x67/0x80 [ 230.186413] entry_SYSCALL_64_after_hwframe+0x63/0xcd This is primarily a fix for KSM+userfaultfd-wp, however, the fake write fault was always questionable. As this fix is not easy to backport and it's not very critical, let's not cc stable. Link: https://lkml.kernel.org/r/20221021101141.84170-6-david@redhat.com Fixes: 529b930b87d9 ("userfaultfd: wp: hook userfault handler to write protection fault") Signed-off-by: David Hildenbrand Acked-by: Peter Xu Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cb8d863313436339fb60f7dd5131af2e5854621e Author: David Hildenbrand Date: Fri Oct 21 12:11:35 2022 +0200 mm: remove VM_FAULT_WRITE All users -- GUP and KSM -- are gone, let's just remove it. Link: https://lkml.kernel.org/r/20221021101141.84170-4-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Peter Xu Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 58f595c6659198e1ad0ed431a408ddd79b21e579 Author: David Hildenbrand Date: Fri Oct 21 12:11:34 2022 +0200 mm/ksm: simplify break_ksm() to not rely on VM_FAULT_WRITE Now that GUP no longer requires VM_FAULT_WRITE, break_ksm() is the sole remaining user of VM_FAULT_WRITE. As we also want to stop triggering a fake write fault and instead use FAULT_FLAG_UNSHARE -- similar to GUP-triggered unsharing when taking a R/O pin on a shared anonymous page (including KSM pages), let's stop relying on VM_FAULT_WRITE. Let's rework break_ksm() to not rely on the return value of handle_mm_fault() anymore to figure out whether COW-breaking was successful. Simply perform another follow_page() lookup to verify the result. While this makes break_ksm() slightly less efficient, we can simplify handle_mm_fault() a little and easily switch to FAULT_FLAG_UNSHARE without introducing similar KSM-specific behavior for FAULT_FLAG_UNSHARE. In my setup (AMD Ryzen 9 3900X), running the KSM selftest to test unmerge performance on 2 GiB (taskset 0x8 ./ksm_tests -D -s 2048), this results in a performance degradation of ~4% -- 5% (old: ~5250 MiB/s, new: ~5010 MiB/s). I don't think that we particularly care about that performance drop when unmerging. If it ever turns out to be an actual performance issue, we can think about a better alternative for FAULT_FLAG_UNSHARE -- let's just keep it simple for now. Link: https://lkml.kernel.org/r/20221021101141.84170-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Peter Xu Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5036880efdad976165c817dcb6a1c8c24fb16caa Author: David Hildenbrand Date: Fri Oct 21 12:11:33 2022 +0200 selftests/vm: add test to measure MADV_UNMERGEABLE performance Let's add a test to measure performance of KSM breaking not triggered via COW, but triggered by disabling KSM on an area filled with KSM pages via MADV_UNMERGEABLE. Link: https://lkml.kernel.org/r/20221021101141.84170-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Peter Xu Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c31783eeae7b22dc3f6edde7339de6112959225d Author: David Hildenbrand Date: Fri Oct 21 12:11:38 2022 +0200 mm/pagewalk: don't trigger test_walk() in walk_page_vma() As Peter points out, the caller passes a single VMA and can just do that check itself. And in fact, no existing users rely on test_walk() getting called. So let's just remove it and make the implementation slightly more efficient. Link: https://lkml.kernel.org/r/20221021101141.84170-7-david@redhat.com Signed-off-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 93fb70aa5904c2577fab8100fa990ecfa4f5b4c7 Author: David Hildenbrand Date: Fri Oct 21 12:11:36 2022 +0200 selftests/vm: add KSM unmerge tests Patch series "mm/ksm: break_ksm() cleanups and fixes", v2. This series cleans up and fixes break_ksm(). In summary, we no longer use fake write faults to break COW but instead FAULT_FLAG_UNSHARE. Further, we move away from using follow_page() --- that we can hopefully remove completely at one point --- and use new walk_page_range_vma() instead. Fortunately, we can get rid of VM_FAULT_WRITE and FOLL_MIGRATION in common code now. Extend the existing ksm tests by an unmerge benchmark, and a some new unmerge tests. Also, add a selftest to measure MADV_UNMERGEABLE performance. In my setup (AMD Ryzen 9 3900X), running the KSM selftest to test unmerge performance on 2 GiB (taskset 0x8 ./ksm_tests -D -s 2048), this results in a performance degradation of ~6% -- 7% (old: ~5250 MiB/s, new: ~4900 MiB/s). I don't think we particularly care for now, but it's good to be aware of the implication. This patch (of 9): Let's add three unmerge tests (MADV_UNMERGEABLE unmerging all pages in the range). test_unmerge(): basic unmerge tests test_unmerge_discarded(): have some pte_none() entries in the range test_unmerge_uffd_wp(): protect the merged pages using uffd-wp ksm_tests.c currently contains a mixture of benchmarks and tests, whereby each test is carried out by executing the ksm_tests binary with specific parameters. Let's add new ksm_functional_tests.c that performs multiple, smaller functional tests all at once. Link: https://lkml.kernel.org/r/20221021101141.84170-1-david@redhat.com Link: https://lkml.kernel.org/r/20221021101141.84170-5-david@redhat.com Signed-off-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 85463321e726fe59873bbc21f2f480747810aef8 Author: Joel Savitz Date: Tue Oct 18 19:12:22 2022 -0400 selftests/vm: enable running select groups of tests Our memory management kernel CI testing at Red Hat uses the VM selftests and we have run into two problems: First, our LTP tests overlap with the VM selftests. We want to avoid unhelpful redundancy in our testing practices. Second, we have observed the current run_vmtests.sh to report overall failure/ambiguous results in the case that a machine lacks the necessary hardware to perform one or more of the tests. E.g. ksm tests that require more than one numa node. We want to be able to run the vm selftests suitable to particular hardware. Add the ability to run one or more groups of vm tests via run_vmtests.sh instead of simply all-or-none in order to solve these problems. Preserve existing default behavior of running all tests when the script is invoked with no arguments. Documentation of test groups is included in the patch as follows: # ./run_vmtests.sh [ -h || --help ] usage: ./tools/testing/selftests/vm/run_vmtests.sh [ -h | -t ""] -t: specify specific categories to tests to run -h: display this message The default behavior is to run all tests. Alternatively, specific groups tests can be run by passing a string to the -t argument containing one or more of the following categories separated by spaces: - mmap tests for mmap(2) - gup_test tests for gup using gup_test interface - userfaultfd tests for userfaultfd(2) - compaction a test for the patch "Allow compaction of unevictable pages" - mlock tests for mlock(2) - mremap tests for mremap(2) - hugevm tests for very large virtual address space - vmalloc vmalloc smoke tests - hmm hmm smoke tests - madv_populate test memadvise(2) MADV_POPULATE_{READ,WRITE} options - memfd_secret test memfd_secret(2) - process_mrelease test process_mrelease(2) - ksm ksm tests that do not require >=2 NUMA nodes - ksm_numa ksm tests that require >=2 NUMA nodes - pkey memory protection key tests - soft_dirty test soft dirty page bit semantics - anon_cow test anonymous copy-on-write semantics example: ./run_vmtests.sh -t "hmm mmap ksm" Link: https://lkml.kernel.org/r/20221018231222.1884715-1-jsavitz@redhat.com Signed-off-by: Joel Savitz Cc: Joel Savitz Cc: Nico Pache Cc: Shuah Khan Signed-off-by: Andrew Morton commit f7cde96710a4362dca199458d3de04f631178453 Author: Yuezhang Mo Date: Mon Mar 28 16:37:58 2022 +0800 exfat: remove i_size_write() from __exfat_truncate() The file/directory size is updated into inode by i_size_write() before __exfat_truncate() is called, so it is redundant to re-update by i_size_write() in __exfat_truncate(). Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit e981917b3fae689e9372647a38746444205bb905 Author: Yuezhang Mo Date: Thu Nov 17 10:36:21 2022 +0800 exfat: remove argument 'size' from exfat_truncate() argument 'size' is not used in exfat_truncate(), remove it. Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 72880cb5f157514d797d5f6ab3184bbde671a18a Author: Yuezhang Mo Date: Sun Apr 10 16:12:14 2022 +0800 exfat: remove unnecessary arguments from exfat_find_dir_entry() This commit removes argument 'num_entries' and 'type' from exfat_find_dir_entry(). Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 015c0d4f6b1e65857de88279f07d7ecc5e305137 Author: Yuezhang Mo Date: Mon Aug 15 10:15:16 2022 +0800 exfat: remove unneeded codes from __exfat_rename() The code gets the dentry, but the dentry is not used, remove the code. Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 088f1343d9108c16fca064951d85e6de9f5cab42 Author: Yuezhang Mo Date: Tue Aug 16 16:55:06 2022 +0800 exfat: remove call ilog2() from exfat_readdir() There is no need to call ilog2() for the conversions between cluster and dentry in exfat_readdir(), because these conversions can be replaced with EXFAT_DEN_TO_CLU()/EXFAT_CLU_TO_DEN(). Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit f3fe3954c09f97d8227d9d2edc807796a8b228ab Author: Yuezhang Mo Date: Thu Mar 17 19:39:20 2022 +0800 exfat: replace magic numbers with Macros Code refinement, no functional changes. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 3b9681acb0ef739343d8cfd35e054aab9597f1dc Author: Yuezhang Mo Date: Thu Mar 17 18:12:40 2022 +0800 exfat: rename exfat_free_dentry_set() to exfat_put_dentry_set() Since struct exfat_entry_set_cache is allocated from stack, no need to free, so rename exfat_free_dentry_set() to exfat_put_dentry_set(). After renaming, the new function pair is exfat_get_dentry_set()/exfat_put_dentry_set(). Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 20914ff6dd56dd6b548bf5dd90bff09ef89999e4 Author: Yuezhang Mo Date: Thu Nov 17 11:37:13 2022 +0800 exfat: move exfat_entry_set_cache from heap to stack The size of struct exfat_entry_set_cache is only 56 bytes on 64-bit system, and allocating from stack is more efficient than allocating from heap. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit a3ff29a95fde16906304455aa8c0bd84eb770258 Author: Yuezhang Mo Date: Wed Nov 9 13:50:22 2022 +0800 exfat: support dynamic allocate bh for exfat_entry_set_cache In special cases, a file or a directory may occupied more than 19 directory entries, pre-allocating 3 bh is not enough. Such as - Support vendor secondary directory entry in the future. - Since file directory entry is damaged, the SecondaryCount field is bigger than 18. So this commit supports dynamic allocation of bh. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit f83d8a3b532097276266b5e81073ea46e27b17ab Author: Yuezhang Mo Date: Thu Apr 7 15:55:56 2022 +0800 exfat: reduce the size of exfat_entry_set_cache In normal, there are 19 directory entries at most for a file or a directory. - A file directory entry - A stream extension directory entry - 1~17 file name directory entry So the directory entries are in 3 sectors at most, it is enough for struct exfat_entry_set_cache to pre-allocate 3 bh. This commit changes the size of struct exfat_entry_set_cache as: Before After 32-bit system 88 32 bytes 64-bit system 168 48 bytes Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit e298c8a818a3e517582e60c412f4a41b3a1647c5 Author: Yuezhang Mo Date: Mon Nov 7 17:22:13 2022 +0900 exfat: hint the empty entry which at the end of cluster chain After traversing all directory entries, hint the empty directory entry no matter whether or not there are enough empty directory entries. After this commit, hint the empty directory entries like this: 1. Hint the deleted directory entries if enough; 2. Hint the deleted and unused directory entries which at the end of the cluster chain no matter whether enough or not(Add by this commit); 3. If no any empty directory entries, hint the empty directory entries in the new cluster(Add by this commit). This avoids repeated traversal of directory entries, reduces CPU usage, and improves the performance of creating files and directories(especially on low-performance CPUs). Test create 5000 files in a class 4 SD card on imx6q-sabrelite with: for ((i=0;i<5;i++)); do sync time (for ((j=1;j<=1000;j++)); do touch file$((i*1000+j)); done) done The more files, the more performance improvements. Before After Improvement 1~1000 25.360s 22.168s 14.40% 1001~2000 38.242s 28.72ss 33.15% 2001~3000 49.134s 35.037s 40.23% 3001~4000 62.042s 41.624s 49.05% 4001~5000 73.629s 46.772s 57.42% Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit ff39899be80b9d90d5e13775eb9fd150338b6e15 Author: Yuezhang Mo Date: Thu Jul 21 09:59:32 2022 +0800 exfat: simplify empty entry hint This commit adds exfat_set_empty_hint()/exfat_reset_empty_hint() to reduce code complexity and make code more readable. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 13959373e9c9021cc80730c7bd1242e07b10b328 Author: Nicholas Piggin Date: Thu Dec 8 22:32:25 2022 +1000 powerpc/qspinlock: Fix 32-bit build Some 32-bit configurations don't pull in the spin_begin/end/relax definitions. Fix is to restore a lost include. Reported-by: kernel test robot Fixes: 84990b169557 ("powerpc/qspinlock: add mcs queueing for contended waiters") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/oe-kbuild-all/202212050224.i7uh9fOh-lkp@intel.com Link: https://lore.kernel.org/r/20221208123225.1566113-1-npiggin@gmail.com commit 580f9896e088b399fc79f1421e56a1b68f0450b5 Author: Rob Herring Date: Wed Dec 7 14:43:27 2022 -0600 dt-bindings: leds: Add missing references to common LED schema 'led' nodes should have a reference to LED common.yaml schema. Add it where missing and drop any duplicate properties. Acked-by: Lee Jones Acked-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221207204327.2810001-2-robh@kernel.org Signed-off-by: Rob Herring commit 121164481b79d93824eed464117d331a002f5d75 Author: Rob Herring Date: Wed Dec 7 14:43:26 2022 -0600 dt-bindings: leds: intel,lgm: Add missing 'led-gpios' property The example has 'led-gpio' properties, but that's not documented. As the 'gpio' form is deprecated, add 'led-gpios' to the schema and update the example. Reviewed-by: Krzysztof Kozlowski Acked-by: Lee Jones Link: https://lore.kernel.org/r/20221207204327.2810001-1-robh@kernel.org Signed-off-by: Rob Herring commit ee9d7a0e754568180a2f8ebc4aad226278a9116f Author: ruanjinjie Date: Sun Dec 11 10:33:37 2022 +0800 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() When kmalloc() fail to allocate memory in kasprintf(), fn_1 or fn_2 will be NULL, and strcmp() will cause null pointer dereference. Fixes: 2fe0e8769df9 ("of: overlay: check prevents multiple fragments touching same property") Signed-off-by: ruanjinjie Link: https://lore.kernel.org/r/20221211023337.592266-1-ruanjinjie@huawei.com Signed-off-by: Rob Herring commit c2d12e85336f6d4172fb2bab5935027c446d7343 Author: Alexandre Belloni Date: Sun Dec 11 23:35:53 2022 +0100 rtc: pcf85063: fix pcf85063_clkout_control pcf85063_clkout_control reads the wrong register but then update the correct one. Reported-by: Janne Terho Fixes: 8c229ab6048b ("rtc: pcf85063: Add pcf85063 clkout control to common clock framework") Link: https://lore.kernel.org/r/20221211223553.59955-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 103c14db61a24cc0cd344dc5d93d264a36687c35 Author: Alexandre Belloni Date: Sun Dec 11 22:57:55 2022 +0100 rtc: rx6110: fix warning with !OF rx6110_spi_of_match is not used when !OF, leading to a warning: >> drivers/rtc/rtc-rx6110.c:384:34: warning: 'rx6110_spi_of_match' defined but not used [-Wunused-const-variable=] 384 | static const struct of_device_id rx6110_spi_of_match[] = { | ^~~~~~~~~~~~~~~~~~~ Reported-by: kernel test robot Link: https://lore.kernel.org/r/20221211215756.54002-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 08dcf0732cb4d97b85493d9f60470e48eebf87fe Author: Alexandre Belloni Date: Sun Dec 11 21:55:38 2022 +0100 MAINTAINERS: mark I3C DRIVER FOR SYNOPSYS DESIGNWARE orphan Vitor left Synopsys and the email address is now bouncing. Link: https://lore.kernel.org/r/20221211205539.19353-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 672825cd2823a0cee4687ce80fef5b702ff3caa3 Author: Jack Chen Date: Wed Dec 7 15:50:59 2022 -0500 i3c: export SETDASA method Because not all I3C drivers have the hot-join feature ready, and especially not all I3C devices support hot-join feature, exporting SETDASA method could be useful. With this function, the I3C controller could perform a DAA to I3C devices when users decide to turn these I3C devices off and on again during run-time. Tested: This change has been tested with turnning off an I3C device and turning on it again during run-time. The device driver calls SETDASA method to perform DAA to the device. And communication between I3C controller and device is set up again correctly. Signed-off-by: Jack Chen Link: https://lore.kernel.org/r/20221207205059.3848851-1-zenghuchen@google.com Signed-off-by: Alexandre Belloni commit 01744ce9f07f0b76b0b2d30adba2a7c104f1ff2a Author: Naveen Krishna Chatradhi Date: Mon Dec 5 10:54:13 2022 +0000 i3c: Correct the macro module_i3c_i2c_driver Present definition for module_i3c_i2c_driver uses only the 1st argument i.e., struct i3c_driver. Irrespective of CONFIG_I3C being enabled/disabled, struct i2c_driver is never passed to module_driver() Passing struct i2c_driver as the 4th argument works. Signed-off-by: Akshay Gupta Signed-off-by: Naveen Krishna Chatradhi Link: https://lore.kernel.org/r/20221205105413.937704-1-naveenkrishna.chatradhi@amd.com Signed-off-by: Alexandre Belloni commit 2e830ccc21eb67a4c2490279d907e5e9199e5156 Author: Sebastian Reichel Date: Thu Oct 20 22:42:41 2022 +0200 rtc: rk808: reduce 'struct rk808' usage Reduce usage of 'struct rk808' (driver data of the parent MFD), so that only the chip variant field is still being accessed directly. This allows restructuring the MFD driver to support SPI based PMICs. Acked-by: Alexandre Belloni Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20221020204251.108565-4-sebastian.reichel@collabora.com Signed-off-by: Alexandre Belloni commit 21b8a1dd56a163825e5749b303858fb902ebf198 Author: Kees Cook Date: Fri Dec 2 10:45:30 2022 -0800 rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. msc313_rtc_probe() was passing clk_disable_unprepare() directly, which did not have matching prototypes for devm_add_action_or_reset()'s callback argument. Refactor to use devm_clk_get_enabled() instead. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Suggested-by: Christophe JAILLET Cc: Daniel Palmer Cc: Romain Perier Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: linux-arm-kernel@lists.infradead.org Cc: linux-rtc@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Daniel Palmer Tested-by: Daniel Palmer Link: https://lore.kernel.org/r/20221202184525.gonna.423-kees@kernel.org Signed-off-by: Alexandre Belloni commit ac3a2585f018f10039b4a856dcb122da88c1c1c9 Author: Jeff Layton Date: Sun Dec 11 06:19:33 2022 -0500 nfsd: rework refcounting in filecache The filecache refcounting is a bit non-standard for something searchable by RCU, in that we maintain a sentinel reference while it's hashed. This in turn requires that we have to do things differently in the "put" depending on whether its hashed, which we believe to have led to races. There are other problems in here too. nfsd_file_close_inode_sync can end up freeing an nfsd_file while there are still outstanding references to it, and there are a number of subtle ToC/ToU races. Rework the code so that the refcount is what drives the lifecycle. When the refcount goes to zero, then unhash and rcu free the object. A task searching for a nfsd_file is allowed to bump its refcount, but only if it's not already 0. Ensure that we don't make any other changes to it until a reference is held. With this change, the LRU carries a reference. Take special care to deal with it when removing an entry from the list, and ensure that we only repurpose the nf_lru list_head when the refcount is 0 to ensure exclusive access to it. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 72ee45fd46d0d3578c4e6046f66fae3218543ce3 Author: ye xingchen Date: Wed Dec 7 09:29:27 2022 +0800 ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Reviewed-by: Sergey Senozhatsky Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01f6c61bae3d658058ee6322af77acea26a5ee3a Author: Marios Makassikis Date: Tue Nov 29 12:19:33 2022 +0100 ksmbd: Fix resource leak in smb2_lock() "flock" is leaked if an error happens before smb2_lock_init(), as the lock is not added to the lock_list to be cleaned up. Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit bc044414fa0326a4e5c3c509c00b1fcaf621b5f4 Author: Xiu Jianfeng Date: Wed Nov 16 20:22:37 2022 +0800 ksmbd: Fix resource leak in ksmbd_session_rpc_open() When ksmbd_rpc_open() fails then it must call ksmbd_rpc_id_free() to undo the result of ksmbd_ipc_id_alloc(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Xiu Jianfeng Acked-by: Namjae Jeon Signed-off-by: Steve French commit 30429388531b120902126a39cf64f877fc5c7773 Author: Gustavo A. R. Silva Date: Tue Nov 15 09:35:10 2022 -0600 ksmbd: replace one-element arrays with flexible-array members One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element arrays with flexible-array members in multiple structs in fs/ksmbd/smb_common.h and one in fs/ksmbd/smb2pdu.h. Important to mention is that doing a build before/after this patch results in no binary output differences. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/242 Link: https://github.com/KSPP/linux/issues/79 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Reviewed-by: Sergey Senozhatsky Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7ecbe92696bb7fe32c80b6cf64736a0d157717a9 Author: Jeff Layton Date: Fri Nov 11 08:11:53 2022 -0500 ksmbd: use F_SETLK when unlocking a file ksmbd seems to be trying to use a cmd value of 0 when unlocking a file. That activity requires a type of F_UNLCK with a cmd of F_SETLK. For local POSIX locking, it doesn't matter much since vfs_lock_file ignores @cmd, but filesystems that define their own ->lock operation expect to see it set sanely. Cc: David Howells Signed-off-by: Jeff Layton Reviewed-by: David Howells Acked-by: Namjae Jeon Signed-off-by: Steve French commit 37ba7b005a7a4454046bd8659c7a9c5330552396 Author: Namjae Jeon Date: Sat Oct 29 00:01:38 2022 +0900 ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for this share Currently, SMB2_SESSION_FLAG_ENCRYPT_DATA is always set session setup response. Since this forces data encryption from the client, there is a problem that data is always encrypted regardless of the use of the cifs seal mount option. SMB2_SESSION_FLAG_ENCRYPT_DATA should be set according to KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION flags, and in case of KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF, encryption mode is turned off for all connections. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit dbc94a0fb81771a38733c0e8f2ea8c4fa6934dc1 Author: Dragos Tatulea Date: Thu Dec 8 09:52:54 2022 +0200 IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces There are 2 ways to create IPoIB PKEY child interfaces: 1) Writing a PKEY to /sys/class/net//create_child. 2) Using netlink with iproute. While with sysfs the child interface has the same number of tx and rx queues as the parent, with netlink there will always be 1 tx and 1 rx queue for the child interface. That's because the get_num_tx/rx_queues() netlink ops are missing and the default value of 1 is taken for the number of queues (in rtnl_create_link()). This change adds the get_num_tx/rx_queues() ops which allows for interfaces with multiple queues to be created over netlink. This constant only represents the max number of tx and rx queues on that net device. Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support") Signed-off-by: Dragos Tatulea Link: https://lore.kernel.org/r/f4a42c8aa43c02d5ae5559a60c3e5e0f18c82531.1670485816.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 80b6093b55e31c2c40ff082fb32523d4e852954f Author: Masahiro Yamada Date: Tue Dec 6 13:07:31 2022 +0900 kbuild: add -Wundef to KBUILD_CPPFLAGS for W=1 builds The use of an undefined macro in an #if directive is warned, but only in *.c files. No warning from other files such as *.S, *.lds.S. Since -Wundef is a preprocessor-related warning, it should be added to KBUILD_CPPFLAGS instead of KBUILD_CFLAGS. My previous attempt [1] uncovered several issues. I could not finish fixing them all. This commit adds -Wundef to KBUILD_CPPFLAGS for W=1 builds in order to block new breakages. (The kbuild test robot tests with W=1) We can fix the warnings one by one. After fixing all of them, we can make it default in the top Makefile, and remove -Wundef from KBUILD_CFLAGS. [1]: https://lore.kernel.org/all/20221012180118.331005-2-masahiroy@kernel.org/ Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Reviewed-by: Nick Desaulniers commit efa80b028c7a9c74fd875517aa0fc9fd8d610ed0 Author: Masahiro Yamada Date: Tue Dec 6 13:07:30 2022 +0900 kbuild: move -Werror from KBUILD_CFLAGS to KBUILD_CPPFLAGS CONFIG_WERROR turns warnings into errors, which happens only for *.c files because -Werror is added to KBUILD_CFLAGS. Adding it to KBUILD_CPPFLAGS makes more sense because preprocessors understand the -Werror option. For example, you can put a #warning directive in any preprocessed code. warning: #warning "this is a warning message" [-Wcpp] If -Werror is added, it is promoted to an error. error: #warning "this is a warning message" [-Werror=cpp] This commit moves -Werror to KBUILD_CPPFLAGS so it works in the same way for *.c, *.S, *.lds.S or whatever needs preprocessing. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Reviewed-by: Nathan Chancellor commit e42f9c2e6aad583986e91979bf2fce47aaced1c2 Author: Jason Gunthorpe Date: Fri Dec 9 10:21:56 2022 -0400 RDMA: Add missed netdev_put() for the netdevice_tracker The netdev core will detect if any untracked puts are done on tracked pointers and throw refcount warnings: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 1 PID: 33 at lib/refcount.c:31 refcount_warn_saturate+0x1d7/0x1f0 lib/refcount.c:31 Modules linked in: CPU: 1 PID: 33 Comm: kworker/u4:2 Not tainted 6.1.0-rc8-next-20221207-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: ib-unreg-wq ib_unregister_work RIP: 0010:refcount_warn_saturate+0x1d7/0x1f0 lib/refcount.c:31 Code: 05 5a 60 51 0a 01 e8 35 0a b5 05 0f 0b e9 d3 fe ff ff e8 6c 9b 75 fd 48 c7 c7 c0 6d a6 8a c6 05 37 60 51 0a 01 e8 16 0a b5 05 <0f> 0b e9 b4 fe +ff ff 48 89 ef e8 5a b5 c3 fd e9 5c fe ff ff 0f 1f RSP: 0018:ffffc90000aa7b30 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff8880172f9d40 RSI: ffffffff8166b1dc RDI: fffff52000154f58 RBP: ffff88807906c600 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 0000000000000000 R12: 1ffff92000154f6b R13: 0000000000000000 R14: ffff88807906c600 R15: ffff888046894000 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe350a8ff8 CR3: 000000007a9e7000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] ref_tracker_free+0x539/0x6b0 lib/ref_tracker.c:118 netdev_tracker_free include/linux/netdevice.h:4039 [inline] netdev_put include/linux/netdevice.h:4056 [inline] dev_put include/linux/netdevice.h:4082 [inline] free_netdevs+0x1f8/0x470 drivers/infiniband/core/device.c:2204 __ib_unregister_device+0xa0/0x1a0 drivers/infiniband/core/device.c:1478 ib_unregister_work+0x19/0x30 drivers/infiniband/core/device.c:1586 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 So change the missed dev_put for pdata->netdev to also follow the tracker. Fixes: 09f530f0c6d6 ("RDMA: Add netdevice_tracker to ib_device_set_netdev()") Reported-by: syzbot+3fd8326d9a0812d19218@syzkaller.appspotmail.com Reported-by: syzbot+a1ed8ffe3121380cd5dd@syzkaller.appspotmail.com Reported-by: syzbot+8d0a099c8a6d1e4e601c@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/0-v1-e99919867b8d+1e2-netdev_tracker2_jgg@nvidia.com Signed-off-by: Leon Romanovsky commit 800b55b4dc62c4348fbc1f7570a8ac8be3f0eb66 Author: Neil Armstrong Date: Fri Nov 18 15:33:32 2022 +0100 dt-bindings: rtc: convert rtc-meson.txt to dt-schema Convert the Amlogic Meson6 RTC bindings to dt-schema. Signed-off-by: Neil Armstrong Reviewed-by: Martin Blumenstingl Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221117-b4-amlogic-bindings-convert-v1-6-3f025599b968@linaro.org Signed-off-by: Alexandre Belloni commit 144361c1949f227df9244302da02c258a363b674 Author: Julian Anastasov Date: Tue Nov 22 18:46:04 2022 +0200 ipvs: run_estimation should control the kthread tasks Change the run_estimation flag to start/stop the kthread tasks. Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit f0be83d5421718ead31707b6ece34cf77d411c00 Author: Julian Anastasov Date: Tue Nov 22 18:46:03 2022 +0200 ipvs: add est_cpulist and est_nice sysctl vars Allow the kthreads for stats to be configured for specific cpulist (isolation) and niceness (scheduling priority). Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit 705dd34440812735ece298eb5bc153fde9544d42 Author: Julian Anastasov Date: Tue Nov 22 18:46:02 2022 +0200 ipvs: use kthreads for stats estimation Estimating all entries in single list in timer context by single CPU causes large latency with multiple IPVS rules as reported in [1], [2], [3]. Spread the estimator structures in multiple chains and use kthread(s) for the estimation. The chains are processed in multiple (50) timer ticks to ensure the 2-second interval between estimations with some accuracy. Every chain is processed under RCU lock. Every kthread works over its own data structure and all such contexts are attached to array. The contexts can be preserved while the kthread tasks are stopped or restarted. When estimators are removed, unused kthread contexts are released and the slots in array are left empty. First kthread determines parameters to use, eg. maximum number of estimators to process per kthread based on chain's length (chain_max), allowing sub-100us cond_resched rate and estimation taking up to 1/8 of the CPU capacity to avoid any problems if chain_max is not correctly calculated. chain_max is calculated taking into account factors such as CPU speed and memory/cache speed where the cache_factor (4) is selected from real tests with current generation of CPU/NUMA configurations to correct the difference in CPU usage between cached (during calc phase) and non-cached (working) state of the estimated per-cpu data. First kthread also plays the role of distributor of added estimators to all kthreads, keeping low the time to add estimators. The optimization is based on the fact that newly added estimator should be estimated after 2 seconds, so we have the time to offload the adding to chain from controlling process to kthread 0. The allocated kthread context may grow from 1 to 50 allocated structures for timer ticks which saves memory for setups with small number of estimators. We also add delayed work est_reload_work that will make sure the kthread tasks are properly started/stopped. ip_vs_start_estimator() is changed to report errors which allows to safely store the estimators in allocated structures. Many thanks to Jiri Wiesner for his valuable comments and for spending a lot of time reviewing and testing the changes on different platforms with 48-256 CPUs and 1-8 NUMA nodes under different cpufreq governors. [1] Report from Yunhong Jiang: https://lore.kernel.org/netdev/D25792C1-1B89-45DE-9F10-EC350DC04ADC@gmail.com/ [2] https://marc.info/?l=linux-virtual-server&m=159679809118027&w=2 [3] Report from Dust: https://archive.linuxvirtualserver.org/html/lvs-devel/2020-12/msg00000.html Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Tested-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit 1dbd8d9a82e3f26b9d063292d47ece673f48fce2 Author: Julian Anastasov Date: Tue Nov 22 18:46:01 2022 +0200 ipvs: use u64_stats_t for the per-cpu counters Use the provided u64_stats_t type to avoid load/store tearing. Fixes: 316580b69d0a ("u64_stats: provide u64_stats_t type") Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Tested-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit de39afb3d811ba2c028de8662adafedb4899327b Author: Julian Anastasov Date: Tue Nov 22 18:46:00 2022 +0200 ipvs: use common functions for stats allocation Move alloc_percpu/free_percpu logic in new functions Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit 5df7d714d8cbcce7642936cc0f6532f0c4c3d197 Author: Julian Anastasov Date: Tue Nov 22 18:45:59 2022 +0200 ipvs: add rcu protection to stats In preparation to using RCU locking for the list with estimators, make sure the struct ip_vs_stats are released after RCU grace period by using RCU callbacks. This affects ipvs->tot_stats where we can not use RCU callbacks for ipvs, so we use allocated struct ip_vs_stats_rcu. For services and dests we force RCU callbacks for all cases. Signed-off-by: Julian Anastasov Cc: yunhong-cgl jiang Cc: "dust.li" Reviewed-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit 90cd5c88830140c9fade92a8027e0fb2c6e4cc49 Author: Gaosheng Cui Date: Wed Nov 23 09:59:53 2022 +0800 rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() The pic32_rtc_enable(pdata, 0) and clk_disable_unprepare(pdata->clk) should be called in the error handling of devm_rtc_allocate_device(), so we should move devm_rtc_allocate_device earlier in pic32_rtc_probe() to fix it. Fixes: 6515e23b9fde ("rtc: pic32: convert to devm_rtc_allocate_device") Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221123015953.1998521-1-cuigaosheng1@huawei.com Signed-off-by: Alexandre Belloni commit 5fb733d7bd6949e90028efdce8bd528c6ab7cf1e Author: Gaosheng Cui Date: Wed Nov 23 09:48:05 2022 +0800 rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() The clk_disable_unprepare() should be called in the error handling of clk_get_rate(), fix it. Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221123014805.1993052-1-cuigaosheng1@huawei.com Signed-off-by: Alexandre Belloni commit 99523094de48df65477cbbb9d8027f4bc4701794 Merge: f3212ad5b7e93 efd6286ff74a2 Author: Alexei Starovoitov Date: Sat Dec 10 13:20:53 2022 -0800 Merge branch 'stricter register ID checking in regsafe()' Eduard Zingerman says: ==================== This patch-set consists of a series of bug fixes for register ID tracking in verifier.c:states_equal()/regsafe() functions: - for registers of type PTR_TO_MAP_{KEY,VALUE}, PTR_TO_PACKET[_META] the regsafe() should call check_ids() even if registers are byte-to-byte equal; - states_equal() must maintain idmap that covers all function frames in the state because functions like mark_ptr_or_null_regs() operate on all registers in the state; - regsafe() must compare spin lock ids for PTR_TO_MAP_VALUE registers. The last point covers issue reported by Kumar Kartikeya Dwivedi in [1], I borrowed the test commit from there. Note, that there is also an issue with register id tracking for scalars described here [2], it would be addressed separately. [1] https://lore.kernel.org/bpf/20221111202719.982118-1-memxor@gmail.com/ [2] https://lore.kernel.org/bpf/20221128163442.280187-2-eddyz87@gmail.com/ Eduard Zingerman (6): bpf: regsafe() must not skip check_ids() selftests/bpf: test cases for regsafe() bug skipping check_id() bpf: states_equal() must build idmap for all function frames selftests/bpf: verify states_equal() maintains idmap across all frames bpf: use check_ids() for active_lock comparison selftests/bpf: test case for relaxed prunning of active_lock.id ==================== Signed-off-by: Alexei Starovoitov commit efd6286ff74a2fa2b45ed070d344cc0822b8ea6e Author: Eduard Zingerman Date: Fri Dec 9 15:57:33 2022 +0200 selftests/bpf: test case for relaxed prunning of active_lock.id Check that verifier.c:states_equal() uses check_ids() to match consistent active_lock/map_value configurations. This allows to prune states with active spin locks even if numerical values of active_lock ids do not match across compared states. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-8-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 2026f2062df860e5d282ffd4962ea5d5ed53dc51 Author: Kumar Kartikeya Dwivedi Date: Fri Dec 9 15:57:32 2022 +0200 selftests/bpf: Add pruning test case for bpf_spin_lock Test that when reg->id is not same for the same register of type PTR_TO_MAP_VALUE between current and old explored state, we currently return false from regsafe and continue exploring. Without the fix in prior commit, the test case fails. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-7-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 4ea2bb158bec2fe171e7e07c033dcf208d86e274 Author: Eduard Zingerman Date: Fri Dec 9 15:57:31 2022 +0200 bpf: use check_ids() for active_lock comparison An update for verifier.c:states_equal()/regsafe() to use check_ids() for active spin lock comparisons. This fixes the issue reported by Kumar Kartikeya Dwivedi in [1] using technique suggested by Edward Cree. W/o this commit the verifier might be tricked to accept the following program working with a map containing spin locks: 0: r9 = map_lookup_elem(...) ; Returns PTR_TO_MAP_VALUE_OR_NULL id=1. 1: r8 = map_lookup_elem(...) ; Returns PTR_TO_MAP_VALUE_OR_NULL id=2. 2: if r9 == 0 goto exit ; r9 -> PTR_TO_MAP_VALUE. 3: if r8 == 0 goto exit ; r8 -> PTR_TO_MAP_VALUE. 4: r7 = ktime_get_ns() ; Unbound SCALAR_VALUE. 5: r6 = ktime_get_ns() ; Unbound SCALAR_VALUE. 6: bpf_spin_lock(r8) ; active_lock.id == 2. 7: if r6 > r7 goto +1 ; No new information about the state ; is derived from this check, thus ; produced verifier states differ only ; in 'insn_idx'. 8: r9 = r8 ; Optionally make r9.id == r8.id. --- checkpoint --- ; Assume is_state_visisted() creates a ; checkpoint here. 9: bpf_spin_unlock(r9) ; (a,b) active_lock.id == 2. ; (a) r9.id == 2, (b) r9.id == 1. 10: exit(0) Consider two verification paths: (a) 0-10 (b) 0-7,9-10 The path (a) is verified first. If checkpoint is created at (8) the (b) would assume that (8) is safe because regsafe() does not compare register ids for registers of type PTR_TO_MAP_VALUE. [1] https://lore.kernel.org/bpf/20221111202719.982118-1-memxor@gmail.com/ Reported-by: Kumar Kartikeya Dwivedi Suggested-by: Edward Cree Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-6-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 7d05794330877986f605c1618534d7478030f5b8 Author: Eduard Zingerman Date: Fri Dec 9 15:57:30 2022 +0200 selftests/bpf: verify states_equal() maintains idmap across all frames A test case that would erroneously pass verification if verifier.c:states_equal() maintains separate register ID mappings for call frames. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 5dd9cdbc9dec3e99b19e483767e247d15ca8cc0d Author: Eduard Zingerman Date: Fri Dec 9 15:57:29 2022 +0200 bpf: states_equal() must build idmap for all function frames verifier.c:states_equal() must maintain register ID mapping across all function frames. Otherwise the following example might be erroneously marked as safe: main: fp[-24] = map_lookup_elem(...) ; frame[0].fp[-24].id == 1 fp[-32] = map_lookup_elem(...) ; frame[0].fp[-32].id == 2 r1 = &fp[-24] r2 = &fp[-32] call foo() r0 = 0 exit foo: 0: r9 = r1 1: r8 = r2 2: r7 = ktime_get_ns() 3: r6 = ktime_get_ns() 4: if (r6 > r7) goto skip_assign 5: r9 = r8 skip_assign: ; <--- checkpoint 6: r9 = *r9 ; (a) frame[1].r9.id == 2 ; (b) frame[1].r9.id == 1 7: if r9 == 0 goto exit: ; mark_ptr_or_null_regs() transfers != 0 info ; for all regs sharing ID: ; (a) r9 != 0 => &frame[0].fp[-32] != 0 ; (b) r9 != 0 => &frame[0].fp[-24] != 0 8: r8 = *r8 ; (a) r8 == &frame[0].fp[-32] ; (b) r8 == &frame[0].fp[-32] 9: r0 = *r8 ; (a) safe ; (b) unsafe exit: 10: exit While processing call to foo() verifier considers the following execution paths: (a) 0-10 (b) 0-4,6-10 (There is also path 0-7,10 but it is not interesting for the issue at hand. (a) is verified first.) Suppose that checkpoint is created at (6) when path (a) is verified, next path (b) is verified and (6) is reached. If states_equal() maintains separate 'idmap' for each frame the mapping at (6) for frame[1] would be empty and regsafe(r9)::check_ids() would add a pair 2->1 and return true, which is an error. If states_equal() maintains single 'idmap' for all frames the mapping at (6) would be { 1->1, 2->2 } and regsafe(r9)::check_ids() would return false when trying to add a pair 2->1. This issue was suggested in the following discussion: https://lore.kernel.org/bpf/CAEf4BzbFB5g4oUfyxk9rHy-PJSLQ3h8q9mV=rVoXfr_JVm8+1Q@mail.gmail.com/ Suggested-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit cb578c1c9cf60275f258b5af7929c2a54a188f66 Author: Eduard Zingerman Date: Fri Dec 9 15:57:28 2022 +0200 selftests/bpf: test cases for regsafe() bug skipping check_id() Under certain conditions it was possible for verifier.c:regsafe() to skip check_id() call. This commit adds negative test cases previously errorneously accepted as safe. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 7c884339bbff80250bfc11d56b5cf48640e6ebdb Author: Eduard Zingerman Date: Fri Dec 9 15:57:27 2022 +0200 bpf: regsafe() must not skip check_ids() The verifier.c:regsafe() has the following shortcut: equal = memcmp(rold, rcur, offsetof(struct bpf_reg_state, parent)) == 0; ... if (equal) return true; Which is executed regardless old register type. This is incorrect for register types that might have an ID checked by check_ids(), namely: - PTR_TO_MAP_KEY - PTR_TO_MAP_VALUE - PTR_TO_PACKET_META - PTR_TO_PACKET The following pattern could be used to exploit this: 0: r9 = map_lookup_elem(...) ; Returns PTR_TO_MAP_VALUE_OR_NULL id=1. 1: r8 = map_lookup_elem(...) ; Returns PTR_TO_MAP_VALUE_OR_NULL id=2. 2: r7 = ktime_get_ns() ; Unbound SCALAR_VALUE. 3: r6 = ktime_get_ns() ; Unbound SCALAR_VALUE. 4: if r6 > r7 goto +1 ; No new information about the state ; is derived from this check, thus ; produced verifier states differ only ; in 'insn_idx'. 5: r9 = r8 ; Optionally make r9.id == r8.id. --- checkpoint --- ; Assume is_state_visisted() creates a ; checkpoint here. 6: if r9 == 0 goto ; Nullness info is propagated to all ; registers with matching ID. 7: r1 = *(u64 *) r8 ; Not always safe. Verifier first visits path 1-7 where r8 is verified to be not null at (6). Later the jump from 4 to 6 is examined. The checkpoint for (6) looks as follows: R8_rD=map_value_or_null(id=2,off=0,ks=4,vs=8,imm=0) R9_rwD=map_value_or_null(id=2,off=0,ks=4,vs=8,imm=0) R10=fp0 The current state is: R0=... R6=... R7=... fp-8=... R8=map_value_or_null(id=2,off=0,ks=4,vs=8,imm=0) R9=map_value_or_null(id=1,off=0,ks=4,vs=8,imm=0) R10=fp0 Note that R8 states are byte-to-byte identical, so regsafe() would exit early and skip call to check_ids(), thus ID mapping 2->2 will not be added to 'idmap'. Next, states for R9 are compared: these are not identical and check_ids() is executed, but 'idmap' is empty, so check_ids() adds mapping 2->1 to 'idmap' and returns success. This commit pushes the 'equal' down to register types that don't need check_ids(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20221209135733.28851-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit e0c49bd2b4d3cd1751491eb2d940bce968ac65e9 Author: Chen Zhongjin Date: Fri Dec 9 18:04:48 2022 +0800 fs: sysv: Fix sysv_nblocks() returns wrong value sysv_nblocks() returns 'blocks' rather than 'res', which only counting the number of triple-indirect blocks and causing sysv_getattr() gets a wrong result. [AV: this is actually a sysv counterpart of minixfs fix - 0fcd426de9d0 "[PATCH] minix block usage counting fix" in historical tree; mea culpa, should've thought to check fs/sysv back then...] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin Signed-off-by: Al Viro commit d358dfe60b7724ad0acb8cf8375a608b983e2b59 Author: Daniel Bristot de Oliveira Date: Fri Dec 9 23:05:54 2022 +0100 Documentation/osnoise: Add osnoise/options documentation Add the documentation about the osnoise/options file, the options, and some additional explanation about the OSNOISE_WORKLOAD option. Link: https://lkml.kernel.org/r/fde5567a4bae364f67fd1e9a644d1d62862618a6.1670623111.git.bristot@kernel.org Cc: Daniel Bristot de Oliveira Cc: Juri Lelli Cc: Clark Williams Cc: Masami Hiramatsu Cc: Jonathan Corbet Cc: Bagas Sanjaya Signed-off-by: Daniel Bristot de Oliveira Reviewed-by: Bagas Sanjaya Signed-off-by: Steven Rostedt (Google) commit b5dce2002567a9b1a83ef3e3a8678d8c32be2a78 Author: Daniel Bristot de Oliveira Date: Fri Dec 9 23:05:53 2022 +0100 tracing/osnoise: Add preempt and/or irq disabled options The osnoise workload runs with preemption and IRQs enabled in such a way as to allow all sorts of noise to disturb osnoise's execution. hwlat tracer has a similar workload but works with irq disabled, allowing only NMIs and the hardware to generate noise. While thinking about adding an options file to hwlat tracer to allow the system to panic, and other features I was thinking to add, like having a tracepoint at each noise detection, it came to my mind that is easier to make osnoise and also do hardware latency detection than making hwlat "feature compatible" with osnoise. Other points are: - osnoise already has an independent cpu file. - osnoise has a more intuitive interface, e.g., runtime/period vs. window/width (and people often need help remembering what it is). - osnoise: tracepoints - osnoise stop options - osnoise options file itself Moreover, the user-space side (in rtla) is simplified by reusing the existing osnoise code. Finally, people have been asking me about using osnoise for hw latency detection, and I have to explain that it was sufficient but not necessary. These options make it sufficient and necessary. Adding a Suggested-by Clark, as he often asked me about this possibility. Link: https://lkml.kernel.org/r/d9c6c19135497054986900f94c8e47410b15316a.1670623111.git.bristot@kernel.org Cc: Suggested-by: Clark Williams Cc: Juri Lelli Cc: Bagas Sanjaya Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 1603dda47714cebe8a29b2154407da7a929d13f4 Author: Daniel Bristot de Oliveira Date: Fri Dec 9 23:05:52 2022 +0100 tracing/osnoise: Add PANIC_ON_STOP option Often the latency observed in a CPU is not caused by the work being done in the CPU itself, but by work done on another CPU that causes the hardware to stall all CPUs. In this case, it is interesting to know what is happening on ALL CPUs, and the best way to do this is via crash dump analysis. Add the PANIC_ON_STOP option to osnoise/timerlat tracers. The default behavior is having this option off. When enabled by the user, the system will panic after hitting a stop tracing condition. This option was motivated by a real scenario that Juri Lelli and I were debugging. Link: https://lkml.kernel.org/r/249ce4287c6725543e6db845a6e0df621dc67db5.1670623111.git.bristot@kernel.org Cc: Juri Lelli Cc: Clark Williams Cc: Bagas Sanjaya Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 0e162c6f1c8f7f502b3978f5a37ed6fa2e4d21f9 Author: Bagas Sanjaya Date: Fri Nov 25 10:43:00 2022 +0700 Documentation/osnoise: Escape underscore of NO_ prefix kernel test robot reported unknown target name warning: Documentation/trace/osnoise-tracer.rst:112: WARNING: Unknown target name: "no". The warning causes NO_ prefix to be rendered as link text instead, which points to non-existent link target. Escape the prefix underscore to fix the warning. Link: https://lkml.kernel.org/r/20221125034300.24168-1-bagasdotme@gmail.com Cc: Masami Hiramatsu Cc: Jonathan Corbet Cc: Ammar Faizi Cc: GNU/Weeb Mailing List Link: https://lore.kernel.org/linux-doc/202211240447.HxRNftE5-lkp@intel.com/ Fixes: 67543cd6b8eee5 ("Documentation/osnoise: Add osnoise/options documentation") Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit bfd5a5e82d22da43afa0e2bb9fb72339aa79c6cc Author: David Howells Date: Mon Dec 5 10:21:52 2022 +0000 tracing: Fix some checker warnings Fix some checker warnings in the trace code by adding __printf attributes to a number of trace functions and their declarations. Changes: ======== ver #2) - Dropped the fix for the unconditional tracing_max_lat_fops decl[1]. Link: https://lore.kernel.org/r/20221205180617.9b9d3971cbe06ee536603523@kernel.org/ [1] Link: https://lore.kernel.org/r/166992525941.1716618.13740663757583361463.stgit@warthog.procyon.org.uk/ # v1 Link: https://lkml.kernel.org/r/167023571258.382307.15314866482834835192.stgit@warthog.procyon.org.uk Signed-off-by: David Howells Signed-off-by: Steven Rostedt (Google) commit ec370890f92ba8ad5476a34068655b06ba48def7 Author: Daniel Bristot de Oliveira Date: Mon Dec 5 09:27:38 2022 +0100 tracing/osnoise: Make osnoise_options static Make osnoise_options static, as reported by the kernel test robot. Link: https://lkml.kernel.org/r/63255826485400d7a2270e9c5e66111079671e7a.1670228712.git.bristot@kernel.org Reported-by: kernel test robot Cc: Daniel Bristot de Oliveira Cc: Steven Rostedt Cc: Masami Hiramatsu Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 98629dadcd020cba690ce0c49a564a1166444646 Author: Ross Zwisler Date: Thu Dec 8 17:33:10 2022 -0700 tracing: remove unnecessary trace_trigger ifdef The trace_trigger command line option introduced by commit a01fdc897fa5 ("tracing: Add trace_trigger kernel command line option") doesn't need to depend on the CONFIG_HIST_TRIGGERS kernel config option. This code doesn't depend on the histogram code, and the run-time selection of triggers is usable without CONFIG_HIST_TRIGGERS. Link: https://lore.kernel.org/linux-trace-kernel/20221209003310.1737039-1-zwisler@google.com Cc: Masami Hiramatsu Cc: Andrew Morton Cc: Mathieu Desnoyers Cc: Joel Fernandes Cc: Tom Zanussi Fixes: a01fdc897fa5 ("tracing: Add trace_trigger kernel command line option") Signed-off-by: Ross Zwisler Signed-off-by: Steven Rostedt (Google) commit 88ca6a71dcab4a4ba6e6e2ff66415a5c4f86e874 Author: Steven Rostedt Date: Fri Dec 9 10:11:51 2022 -0500 ring-buffer: Handle resize in early boot up With the new command line option that allows trace event triggers to be added at boot, the "snapshot" trigger will allocate the snapshot buffer very early, when interrupts can not be enabled. Allocating the ring buffer is not the problem, but it also resizes it, which is, as the resize code does synchronization that can not be preformed at early boot. To handle this, first change the raw_spin_lock_irq() in rb_insert_pages() to raw_spin_lock_irqsave(), such that the unlocking of that spin lock will not enable interrupts. Next, where it calls schedule_work_on(), disable migration and check if the CPU to update is the current CPU, and if so, perform the work directly, otherwise re-enable migration and call the schedule_work_on() to the CPU that is being updated. The rb_insert_pages() just needs to be run on the CPU that it is updating, and does not need preemption nor interrupts disabled when calling it. Link: https://lore.kernel.org/lkml/Y5J%2FCajlNh1gexvo@google.com/ Link: https://lore.kernel.org/linux-trace-kernel/20221209101151.1fec1167@gandalf.local.home Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: a01fdc897fa5 ("tracing: Add trace_trigger kernel command line option") Reported-by: Ross Zwisler Signed-off-by: Steven Rostedt Tested-by: Ross Zwisler Signed-off-by: Steven Rostedt (Google) commit 608c6ed3337850c767ab0dd6c583477922233e29 Author: Zheng Yejian Date: Wed Dec 7 21:53:26 2022 +0800 tracing/hist: Fix issue of losting command info in error_log When input some constructed invalid 'trigger' command, command info in 'error_log' are lost [1]. The root cause is that there is a path that event_hist_trigger_parse() is recursely called once and 'last_cmd' which save origin command is cleared, then later calling of hist_err() will no longer record origin command info: event_hist_trigger_parse() { last_cmd_set() // <1> 'last_cmd' save origin command here at first create_actions() { onmatch_create() { action_create() { trace_action_create() { trace_action_create_field_var() { create_field_var_hist() { event_hist_trigger_parse() { // <2> recursely called once hist_err_clear() // <3> 'last_cmd' is cleared here } hist_err() // <4> No longer find origin command!!! Since 'glob' is empty string while running into the recurse call, we can trickly check it and bypass the call of hist_err_clear() to solve it. [1] # cd /sys/kernel/tracing # echo "my_synth_event int v1; int v2; int v3;" >> synthetic_events # echo 'hist:keys=pid' >> events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid1)" >> events/sched/sched_switch/trigger # cat error_log [ 8.405018] hist:sched:sched_switch: error: Couldn't find synthetic event Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't parse field variable Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't parse field variable Command: ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't create histogram for field Command: ^ Link: https://lore.kernel.org/linux-trace-kernel/20221207135326.3483216-1-zhengyejian1@huawei.com Cc: Cc: Fixes: f404da6e1d46 ("tracing: Add 'last error' error facility for hist triggers") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit ff4837f7fe59ff018eca4705a70eca5e0b486b97 Author: Zheng Yejian Date: Wed Dec 7 17:15:57 2022 +0800 tracing: Fix issue of missing one synthetic field The maximum number of synthetic fields supported is defined as SYNTH_FIELDS_MAX which value currently is 64, but it actually fails when try to generate a synthetic event with 64 fields by executing like: # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\ int v63; int v64" >> /sys/kernel/tracing/synthetic_events Correct the field counting to fix it. Link: https://lore.kernel.org/linux-trace-kernel/20221207091557.3137904-1-zhengyejian1@huawei.com Cc: Cc: Cc: stable@vger.kernel.org Fixes: c9e759b1e845 ("tracing: Rework synthetic event command parsing") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 82470f7d9044842618c847a7166de2b7458157a7 Author: Zheng Yejian Date: Wed Dec 7 11:51:43 2022 +0800 tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' When generate a synthetic event with many params and then create a trace action for it [1], kernel panic happened [2]. It is because that in trace_action_create() 'data->n_params' is up to SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx' keeps indices into array 'hist_data->var_refs' for each synthetic event param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX (current value is 16), so out-of-bound write happened when 'data->n_params' more than 16. In this case, 'data->match_data.event' is overwritten and eventually cause the panic. To solve the issue, adjust the length of 'data->var_ref_idx' to be SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write. [1] # cd /sys/kernel/tracing/ # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\ int v63" >> synthetic_events # echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="bash"' >> \ events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid)" >> events/sched/sched_switch/trigger [2] BUG: unable to handle page fault for address: ffff91c900000000 PGD 61001067 P4D 61001067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 322 Comm: bash Tainted: G W 6.1.0-rc8+ #229 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Call Trace: __find_event_file+0x55/0x90 action_create+0x76c/0x1060 event_hist_trigger_parse+0x146d/0x2060 ? event_trigger_write+0x31/0xd0 trigger_process_regex+0xbb/0x110 event_trigger_write+0x6b/0xd0 vfs_write+0xc8/0x3e0 ? alloc_fd+0xc0/0x160 ? preempt_count_add+0x4d/0xa0 ? preempt_count_add+0x70/0xa0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1d1d0cf077 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 RSP: 002b:00007ffcebb0e568 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000143 RCX: 00007f1d1d0cf077 RDX: 0000000000000143 RSI: 00005639265aa7e0 RDI: 0000000000000001 RBP: 00005639265aa7e0 R08: 000000000000000a R09: 0000000000000142 R10: 000056392639c017 R11: 0000000000000246 R12: 0000000000000143 R13: 00007f1d1d1ae6a0 R14: 00007f1d1d1aa4a0 R15: 00007f1d1d1a98a0 Modules linked in: CR2: ffff91c900000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Link: https://lore.kernel.org/linux-trace-kernel/20221207035143.2278781-1-zhengyejian1@huawei.com Cc: Cc: Cc: stable@vger.kernel.org Fixes: d380dcde9a07 ("tracing: Fix now invalid var_ref_vals assumption in trace action") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 2cc6a528882d0e0ccbc1bca5f95b8c963cedac54 Author: Zheng Yejian Date: Wed Dec 7 11:46:35 2022 +0800 tracing/hist: Fix wrong return value in parse_action_params() When number of synth fields is more than SYNTH_FIELDS_MAX, parse_action_params() should return -EINVAL. Link: https://lore.kernel.org/linux-trace-kernel/20221207034635.2253990-1-zhengyejian1@huawei.com Cc: Cc: Cc: stable@vger.kernel.org Fixes: c282a386a397 ("tracing: Add 'onmatch' hist trigger action support") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 20fb6c997600012209699564a79911584dd5876b Author: Steven Rostedt Date: Fri Dec 9 13:41:44 2022 -0500 x86/mm/kmmio: Use rcu_read_lock_sched_notrace() The mmiotrace tracer is "special". The purpose is to help reverse engineer binary drivers by removing the memory allocated by the driver and when the driver goes to access it, a fault occurs, the mmiotracer will record what the driver was doing and then do the work on its behalf by single stepping through the process. But to achieve this ability, it must do some special things. One is to take the rcu_read_lock() when the fault occurs, and then release it in the breakpoint that is single stepping. This makes lockdep unhappy, as it changes the state of RCU from within an exception that is not contained in that exception, and we get a nasty splat from lockdep. Instead, switch to rcu_read_lock_sched_notrace() as the RCU sched variant has the same grace period as normal RCU. This is basically the same as rcu_read_lock() but does not make lockdep complain about it. Note, the preempt_disable() is still needed as it uses preempt_enable_no_resched(). Link: https://lore.kernel.org/linux-trace-kernel/20221209134144.04f33626@gandalf.local.home Cc: Masami Hiramatsu Cc: Andrew Morton Cc: Karol Herbst Cc: Pekka Paalanen Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Acked-by: Paul E. McKenney Signed-off-by: Steven Rostedt (Google) commit 7fd461c47c6cfab4ca4d003790ec276209e52978 Author: Anna Schumaker Date: Wed Nov 30 13:15:27 2022 -0500 NFSv4.2: Change the default KConfig value for READ_PLUS Now that we've worked out performance issues and have a server patch addressing the failed xfstests, we can safely enable this feature by default. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit f826afe5eae856b3834cbc65db6178cccd4a3142 Merge: e4d741e9e40bf 8610e98f0b48a Author: Bjorn Helgaas Date: Sat Dec 10 10:36:52 2022 -0600 Merge branch 'pci/kbuild' - Remove unnecessary includes (Bjorn Helgaas) * pci/kbuild: PCI: Drop of_match_ptr() to avoid unused variables PCI: Remove unnecessary includes PCI: xgene-msi: Include explicitly PCI: mvebu: Include explicitly PCI: microchip: Include explicitly PCI: altera-msi: Include explicitly # Conflicts: # drivers/pci/controller/pci-mvebu.c commit e4d741e9e40bf77fa448195d53e08fe0303b712a Merge: 4e5194733a81b c1ddc3dad85dd Author: Bjorn Helgaas Date: Sat Dec 10 10:36:42 2022 -0600 Merge branch 'pci/ctrl/xilinx' - Fix whitespace issues (Michal Simek) * pci/ctrl/xilinx: PCI: xilinx-nwl: Fix coding style violations commit 4e5194733a81b9c46f8c7c6ca85526a1b8879bcb Merge: 0454c6c0ed26f 76007ccc5727f Author: Bjorn Helgaas Date: Sat Dec 10 10:36:41 2022 -0600 Merge branch 'pci/ctrl/mvebu' - Switch to the gpiod API so we can make of_get_named_gpio_flags() private (Dmitry Torokhov) * pci/ctrl/mvebu: PCI: mvebu: Switch to using gpiod API commit 0454c6c0ed26f99f60293c561746f663dd08f56f Merge: bcccaa0a48574 7ccb966779645 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:40 2022 -0600 Merge branch 'pci/ctrl/aardvark' - Switch to using devm_gpiod_get_optional() so we can stop exporting devm_gpiod_get_from_of_node() (Dmitry Torokhov) * pci/ctrl/aardvark: PCI: aardvark: Switch to using devm_gpiod_get_optional() commit bcccaa0a4857433aad8ed9874c496cb2e385d470 Merge: ba7deaa2a8e48 2759ddf7535d6 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:40 2022 -0600 Merge branch 'remotes/lorenzo/pci/misc' - Register notifier if core_init_notifier is enabled in pci-epf-test (Kunihiko Hayashi) - Fixup Kconfig indentation (Shunsuke Mie) * remotes/lorenzo/pci/misc: PCI: endpoint: Fix Kconfig indent style PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled commit ba7deaa2a8e48d8a31608b5dca58dbe119c0d72a Merge: 4e5db7983de0d 0a584655ef895 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:39 2022 -0600 Merge branch 'remotes/lorenzo/pci/vmd' - Restore MSI remapping configuration during resume because the configuration is cleared out by firmware when suspending (Nirmal Patel) - Reset the hierarchy below VMD when probing the VMD; we attempted this before, but with the wrong device, so it didn't work (Francisco Munoz) * remotes/lorenzo/pci/vmd: PCI: vmd: Fix secondary bus reset for Intel bridges PCI: vmd: Disable MSI remapping after suspend commit 4e5db7983de0d4bed83e2cdaf9f04093e8b8e1c4 Merge: 008ee711f99fd 16e3f40779659 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:39 2022 -0600 Merge branch 'remotes/lorenzo/pci/tegra' - Switch from devm_gpiod_get_from_of_node() to devm_fwnode_gpiod_get() (Dmitry Torokhov) * remotes/lorenzo/pci/tegra: PCI: tegra: Switch to using devm_fwnode_gpiod_get commit 008ee711f99fdc0e02f0c5eee10e5d067d67c110 Merge: 8ecdba32a500b 74eac50391ce4 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:38 2022 -0600 Merge branch 'remotes/lorenzo/pci/qcom' - Add DT and driver support for SC8280XP/SA8540P basic interconnects where interconnect bandwidth must be requested before enabling interconnect clocks (Johan Hovold) - Add 'dma-coherent' property (Johan Hovold) * remotes/lorenzo/pci/qcom: dt-bindings: PCI: qcom: Allow 'dma-coherent' property PCI: qcom: Add basic interconnect support dt-bindings: PCI: qcom: Add SC8280XP/SA8540P interconnects commit 8ecdba32a500bbc6c571ea96656eb664b0038f8d Merge: c00a1090544ed 19098934f910b Author: Bjorn Helgaas Date: Sat Dec 10 10:36:38 2022 -0600 Merge branch 'remotes/lorenzo/pci/mt7621' - Add sentinel to mt7621_pcie_quirks_match[] to prevent oops when parsing the table (John Thomson) * remotes/lorenzo/pci/mt7621: PCI: mt7621: Add sentinel to quirks table commit c00a1090544ed7d97dee0b49c5a5c063052bdeab Merge: 29a3e5aedc398 5f697b25009cc Author: Bjorn Helgaas Date: Sat Dec 10 10:36:37 2022 -0600 Merge branch 'remotes/lorenzo/pci/endpoint' - Add a .release() callback for the Endpoint Controller library so an Endpoint driver is removable (Yoshihiro Shimoda) - Fix pci-epf-vntb kernel-doc and whitespace (Frank Li) - Fix pci-epf-vntb error path usage of pci_epc_mem_free_addr() (Frank Li) - Remove pci-epf-vntb unused epf_db_phy (Frank Li) - Fix pci-epf-vntb sparse warnings (Frank Li) * remotes/lorenzo/pci/endpoint: PCI: endpoint: pci-epf-vntb: Fix sparse ntb->reg build warning PCI: endpoint: pci-epf-vntb: Fix sparse build warning for epf_db PCI: endpoint: pci-epf-vntb: Replace hardcoded 4 with sizeof(u32) PCI: endpoint: pci-epf-vntb: Remove unused epf_db_phy struct member PCI: endpoint: pci-epf-vntb: Fix call pci_epc_mem_free_addr() in error path PCI: endpoint: pci-epf-vntb: Fix struct epf_ntb_ctrl indentation PCI: endpoint: pci-epf-vntb: Clean up kernel_doc warning PCI: endpoint: Fix WARN() when an endpoint driver is removed commit 29a3e5aedc398f6eca8e454c03f498202bf9d1eb Merge: 0ef283080e5dc ba6ed462dcf41 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:37 2022 -0600 Merge branch 'remotes/lorenzo/pci/dwc' - Fix n_fts[] array overrun (Vidya Sagar) - Don't advertise PTM Responder role for Endpoints (Vidya Sagar) - Fix qcom "reset assert" error message (Manivannan Sadhasivam) - Downgrade "link didn't come up" message to dev_info (Vidya Sagar) - Initialize PHY before deasserting core reset so the link comes up on boards where the PHY provides the reference clock (this was a regression in v6.0) (Sascha Hauer) - Switch histb to the gpiod API (Dmitry Torokhov) - Fix imx6sx and imx8mq clock names in DT binding (Serge Semin) - Fix visconti MSI interrupt in DT binding (Serge Semin) - Consolidate reset-gpio, cdm, windows info in common DT shared by both Root Port and Endpoint bindings (Serge Semin) - Remove bus node from DT examples (Serge Semin) - Add common phys, phy-names to DT (Serge Semin) - Add default max-link-speed of Gen5 to DT (Serge Semin) - Apply generic schema for generic device (Serge Semin) - Add default max-functions of 32 to DT (Serge Semin) - Add common interrupts, interrupt-names to DT (Serge Semin) - Add common regs, reg-names to DT (Serge Semin) - Add common clocks, resets to DT (Serge Semin) - Add dma-coherent to DT (Serge Semin) - Apply common schema to Rockchip DT (Serge Semin) - Add Baikal-T1 DT bindings (Serge Semin) - Add dma-ranges support in DesignWare core (Serge Semin) - Add dw_pcie_cap_is() for testing controller capabilities (Serge Semin) - Add generic resources getter to DesignWare core (Serge Semin) - Combine iATU detection procedures (Serge Semin) - Add generic clock and reset names to DesignWare core (Serge Semin) - Add Baikal-T1 PCIe controller driver (Serge Semin) * remotes/lorenzo/pci/dwc: PCI: dwc: Add Baikal-T1 PCIe controller support PCI: dwc: Introduce generic platform clocks and resets PCI: dwc: Combine iATU detection procedures PCI: dwc: Introduce generic resources getter PCI: dwc: Introduce generic controller capabilities interface PCI: dwc: Introduce dma-ranges property support for RC-host dt-bindings: PCI: dwc: Add Baikal-T1 PCIe Root Port bindings dt-bindings: PCI: dwc: Apply common schema to Rockchip DW PCIe nodes dt-bindings: PCI: dwc: Add dma-coherent property dt-bindings: PCI: dwc: Add clocks/resets common properties dt-bindings: PCI: dwc: Add reg/reg-names common properties dt-bindings: PCI: dwc: Add interrupts/interrupt-names common properties dt-bindings: PCI: dwc: Add max-functions EP property dt-bindings: PCI: dwc: Apply generic schema for generic device only dt-bindings: PCI: dwc: Add max-link-speed common property dt-bindings: PCI: dwc: Add phys/phy-names common properties dt-bindings: PCI: dwc: Remove bus node from the examples dt-bindings: PCI: dwc: Detach common RP/EP DT bindings dt-bindings: visconti-pcie: Fix interrupts array max constraints dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq PCI: histb: Switch to using gpiod API PCI: imx6: Initialize PHY before deasserting core reset PCI: dwc: Use dev_info for PCIe link down event logging PCI: qcom: Fix error message for reset_control_assert() PCI: designware-ep: Disable PTM capabilities for EP mode PCI: Add PCI_PTM_CAP_RES macro PCI: dwc: Fix n_fts[] array overrun commit 0ef283080e5dc508a60977156c60358f2ac18ecc Merge: e6936c8d7c338 602fb860945fd Author: Bjorn Helgaas Date: Sat Dec 10 10:36:36 2022 -0600 Merge branch 'remotes/lorenzo/pci/brcmstb' - Enable Multi-MSI (Jim Quinlan) - Wait for 100ms after PERST# deassert for power and clocks to stabilize (Jim Quinlan) - Use readl_poll_timeout_atomic() instead of hand-rolled timeout loop (Jim Quinlan) - Drop needless "inline" annotations (Jim Quinlan) - Set RCB_MPS mode bit so data for reads up to MPS are returned in a single completion (Jim Quinlan) * remotes/lorenzo/pci/brcmstb: PCI: brcmstb: Set RCB_{MPS,64B}_MODE bits PCI: brcmstb: Drop needless 'inline' annotations PCI: brcmstb: Replace status loops with read_poll_timeout_atomic() PCI: brcmstb: Wait for 100ms following PERST# deassert PCI: brcmstb: Enable Multi-MSI commit e6936c8d7c338c67ae280064ef25b342e51eded2 Merge: 0084cd6072002 d3fd0ee7a4a1e Author: Bjorn Helgaas Date: Sat Dec 10 10:36:36 2022 -0600 Merge branch 'remotes/lorenzo/pci/dt' - Add ti,j721e-pci-host interrupt controller definition (Matt Ranostay) - Add ti,j721e-pci-host interrupt properties (Matt Ranostay) - Add ti,j721s2 host mode device-id (Matt Ranostay) - Add mediatek-gen3 iommu, power properties (Jianjun Wang) - Add mediatek-gen3 SoC-based clock names (Frank Wunderlich) - Add mediatek-gen3 mt7986 support (Frank Wunderlich) * remotes/lorenzo/pci/dt: dt-bindings: PCI: mediatek-gen3: add support for mt7986 dt-bindings: PCI: mediatek-gen3: add SoC based clock config dt-bindings: PCI: Add host mode device-id for j721s2 platform dt-bindings: PCI: mediatek-gen3: Support mt8195 dt-bindings: PCI: ti,j721e-pci-*: Add missing interrupt properties dt-bindings: PCI: ti,j721e-pci-host: add interrupt controller definition commit 0084cd60720023dbab90e6c85c9aa375478f8ebd Merge: 8961fc4f8c78f aa382ffa705be Author: Bjorn Helgaas Date: Sat Dec 10 10:36:35 2022 -0600 Merge branch 'pci/sysfs' - Fix a double free in the error path of creating sysfs "resource%d" attributes (Sascha Hauer) * pci/sysfs: PCI/sysfs: Fix double free in error path commit 8961fc4f8c78f876c4b7278c5d5fb47f0e2ba1be Merge: 9303050181bce d91482bb212b3 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:34 2022 -0600 Merge branch 'pci/resource' - Remove EfiMemoryMappedIO regions from the E820 map to allow PCI core to allocate BARs from them. The only purpose of EfiMemoryMappedIO is to tell the OS to map things needed by EFI runtime services, so it's often used for PCI host bridge apertures. If we can't allocate from those apertures, we can't hot-add devices (Bjorn Helgaas) * pci/resource: x86/PCI: Use pr_info() when possible x86/PCI: Fix log message typo x86/PCI: Tidy E820 removal messages PCI: Skip allocate_resource() if too little space available efi/x86: Remove EfiMemoryMappedIO from E820 map commit 9303050181bcea67cfda2bd74e3508a333e2e23a Merge: ec7c9a681dacc d8d2b65a940bb Author: Bjorn Helgaas Date: Sat Dec 10 10:36:34 2022 -0600 Merge branch 'pci/portdrv' - Squash portdrv_core.c and portdrv_pci.c into portdrv.c to make it easier to find things (Bjorn Helgaas) - Allow AER service only for Root Ports & RCECs so portdrv can successfully bind to other devices that have AER but lack MSI (which they don't need for AER), which allows power management for those devices (Bjorn Helgaas) * pci/portdrv: PCI/portdrv: Allow AER service only for Root Ports & RCECs PCI/portdrv: Unexport pcie_port_service_register(), pcie_port_service_unregister() PCI/portdrv: Move private things to portdrv.c PCI/portdrv: Squash into portdrv.c commit ec7c9a681dacce779604429f561c079164ee6e7c Merge: e1f2d1539731d 73fcd4520edb4 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:33 2022 -0600 Merge branch 'pci/pm-agp' - Convert AGP efficeon, intel, amd-k7, ati, nvidia to generic power management (Bjorn Helgaas) * pci/pm-agp: agp/via: Update to DEFINE_SIMPLE_DEV_PM_OPS() agp/sis: Update to DEFINE_SIMPLE_DEV_PM_OPS() agp/amd64: Update to DEFINE_SIMPLE_DEV_PM_OPS() agp/nvidia: Convert to generic power management agp/ati: Convert to generic power management agp/amd-k7: Convert to generic power management agp/intel: Convert to generic power management agp/efficeon: Convert to generic power management commit e1f2d1539731dfb3c367d1778cb06c4e2f169424 Merge: eae10935ef894 5984de0b41bf8 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:33 2022 -0600 Merge branch 'pci/pm' - Remove unused 'state' parameter to pci_legacy_suspend_late() (Bjorn Helgaas) * pci/pm: PCI/PM: Remove unused 'state' parameter to pci_legacy_suspend_late() commit eae10935ef894532acf8645ed444fe4480a4eaf8 Merge: 84c3482963c80 9f0b4cc174c3c Author: Bjorn Helgaas Date: Sat Dec 10 10:36:32 2022 -0600 Merge branch 'pci/misc' - Use METHOD_NAME__UID instead of plain string to make it easier to find all uses (Yipeng Zou) * pci/misc: PCI/ACPI: Use METHOD_NAME__UID instead of plain string commit 84c3482963c8011d0d817fe1ddde28fbab321ae8 Merge: 51ef4873c672b 6d4671b534f6c Author: Bjorn Helgaas Date: Sat Dec 10 10:36:32 2022 -0600 Merge branch 'pci/hotplug' - Enable pciehp by default if USB4 is enabled because USB4/Thunderbolt tunneling depends on native PCIe hotplug (Albert Zhou) - Make sure pciehp binds only to Downstream Ports, not Upstream Ports (Rafael J. Wysocki) - Remove unused get_mode1_ECC_cap callback in shpchp (Ian Cowan) - Enable pciehp Command Completed Interrupt only if supported to reduce confusion when looking at lspci output (Pali Rohár) * pci/hotplug: PCI: pciehp: Enable Command Completed Interrupt only if supported PCI: shpchp: Remove unused get_mode1_ECC_cap callback PCI: acpiphp: Avoid setting is_hotplug_bridge for PCIe Upstream Ports PCI/portdrv: Set PCIE_PORT_SERVICE_HP for Root and Downstream Ports only PCI: pciehp: Enable by default if USB4 enabled commit 51ef4873c672b126df7a939546e40dfe43cb5074 Merge: cad4f43f36d2f 2d9cd957d40c3 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:32 2022 -0600 Merge branch 'pci/enumeration' - Only read/write PCIe Link 2 registers for devices with Links and PCIe Capability version >= 2 (Maciej W. Rozycki) - Revert a patch that cleared PCI_STATUS during enumeration because it broke Linux guests on Apple's virtualization framework (Bjorn Helgaas) - Assign PCI domain IDs using IDAs so IDs can be easily reused after loading/unloading host bridge drivers (Pali Rohár) - Fix pci_device_is_present(), which previously always returned "false" for VFs because their vendor ID is always 0xfff (Michael S. Tsirkin) - Check for alloc failure in pci_request_irq() (Zeng Heng) * pci/enumeration: PCI: Check for alloc failure in pci_request_irq() PCI: Fix pci_device_is_present() for VFs by checking PF PCI: Assign PCI domain IDs by ida_alloc() Revert "PCI: Clear PCI_STATUS when setting up device" PCI: Access Link 2 registers only for devices with Links commit cad4f43f36d2fefc03b5211d00729f790eec1a90 Merge: 9abf2313adc1c a4ff8e7a71601 Author: Bjorn Helgaas Date: Sat Dec 10 10:36:31 2022 -0600 Merge branch 'pci/doe' - Fix calculation of DOE length to account for the "0 means 2^18 DWORDs" special case (Li Ming) * pci/doe: PCI/DOE: Fix maximum data object length miscalculation commit d91482bb212b36354b0e46d7a5c0adae807e7a12 Author: Bjorn Helgaas Date: Fri Dec 9 14:41:27 2022 -0600 x86/PCI: Use pr_info() when possible Use pr_info() and similar when possible. No functional change intended. Link: https://lore.kernel.org/r/20221209205131.GA1726524@bhelgaas Suggested-by: Andy Shevchenko Signed-off-by: Bjorn Helgaas Reviewed-by: Andy Shevchenko commit 2bfa89fab5ff06703c034c4702e6ea4418194ffe Author: Bjorn Helgaas Date: Thu Dec 8 13:03:41 2022 -0600 x86/PCI: Fix log message typo Add missing word in the log message: - ... so future kernels can this automatically + ... so future kernels can do this automatically Suggested-by: Andy Shevchenko Link: https://lore.kernel.org/r/20221208190341.1560157-5-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andy Shevchenko Acked-by: Hans de Goede commit 00904bf64c2819d90a76407d79bdbc8918541320 Author: Bjorn Helgaas Date: Thu Dec 8 13:03:40 2022 -0600 x86/PCI: Tidy E820 removal messages These messages: clipped [mem size 0x00000000 64bit] to [mem size 0xfffffffffffa0000 64bit] for e820 entry [mem 0x0009f000-0x000fffff] aren't as useful as they could be because (a) the resource is often IORESOURCE_UNSET, so we print the size instead of the start/end and (b) we print the available resource even if it is empty after removing the E820 entry. Print the available space by hand to avoid the IORESOURCE_UNSET problem and only if it's non-empty. No functional change intended. Link: https://lore.kernel.org/r/20221208190341.1560157-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Acked-by: Hans de Goede commit 5c5fb3c3a793b34554e1d21f07cda34308b082cd Author: Bjorn Helgaas Date: Thu Dec 8 13:03:39 2022 -0600 PCI: Skip allocate_resource() if too little space available pci_bus_alloc_from_region() allocates MMIO space by iterating through all the resources available on the bus. The available resource might be reduced if the caller requires 32-bit space or we're avoiding BIOS or E820 areas. Don't bother calling allocate_resource() if we need more space than is available in this resource. This prevents some pointless and annoying messages about avoided areas. Link: https://lore.kernel.org/r/20221208190341.1560157-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Acked-by: Hans de Goede commit 07eab0901ede8b7540c52160663bd300cc238164 Author: Bjorn Helgaas Date: Thu Dec 8 13:03:38 2022 -0600 efi/x86: Remove EfiMemoryMappedIO from E820 map Firmware can use EfiMemoryMappedIO to request that MMIO regions be mapped by the OS so they can be accessed by EFI runtime services, but should have no other significance to the OS (UEFI r2.10, sec 7.2). However, most bootloaders and EFI stubs convert EfiMemoryMappedIO regions to E820_TYPE_RESERVED entries, which prevent Linux from allocating space from them (see remove_e820_regions()). Some platforms use EfiMemoryMappedIO entries for PCI MMCONFIG space and PCI host bridge windows, which means Linux can't allocate BAR space for hot-added devices. Remove large EfiMemoryMappedIO regions from the E820 map to avoid this problem. Leave small (< 256KB) EfiMemoryMappedIO regions alone because on some platforms, these describe non-window space that's included in host bridge _CRS. If we assign that space to PCI devices, they don't work. On the Lenovo X1 Carbon, this leads to suspend/resume failures. The previous solution to the problem of allocating BARs in these regions was to add pci_crs_quirks[] entries to disable E820 checking for these machines (see d341838d776a ("x86/PCI: Disable E820 reserved region clipping via quirks")): Acer DMI_PRODUCT_NAME Spin SP513-54N Clevo DMI_BOARD_NAME X170KM-G Lenovo DMI_PRODUCT_VERSION *IIL* Florent reported the BAR allocation issue on the Clevo NL4XLU. We could add another quirk for the NL4XLU, but I hope this generic change can solve it for many machines without having to add quirks. This change has been tested on Clevo X170KM-G (Konrad) and Lenovo Ideapad Slim 3 (Matt) and solves the problem even when overriding the existing quirks by booting with "pci=use_e820". Link: https://bugzilla.kernel.org/show_bug.cgi?id=216565 Clevo NL4XLU Link: https://bugzilla.kernel.org/show_bug.cgi?id=206459#c78 Clevo X170KM-G Link: https://bugzilla.redhat.com/show_bug.cgi?id=1868899 Ideapad Slim 3 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2029207 X1 Carbon Link: https://lore.kernel.org/r/20221208190341.1560157-2-helgaas@kernel.org Reported-by: Florent DELAHAYE Tested-by: Konrad J Hambrick Tested-by: Matt Hansen <2lprbe78@duck.com> Signed-off-by: Bjorn Helgaas Acked-by: Hans de Goede commit d8d2b65a940bb497749d66bdab59b530901d3854 Author: Bjorn Helgaas Date: Fri Dec 9 11:01:00 2022 -0600 PCI/portdrv: Allow AER service only for Root Ports & RCECs Previously portdrv allowed the AER service for any device with an AER capability (assuming Linux had control of AER) even though the AER service driver only attaches to Root Port and RCECs. Because get_port_device_capability() included AER for non-RP, non-RCEC devices, we tried to initialize the AER IRQ even though these devices don't generate AER interrupts. Intel DG1 and DG2 discrete graphics cards contain a switch leading to a GPU. The switch supports AER but not MSI, so initializing an AER IRQ failed, and portdrv failed to claim the switch port at all. The GPU itself could be suspended, but the switch could not be put in a low-power state because it had no driver. Don't allow the AER service on non-Root Port, non-Root Complex Event Collector devices. This means we won't enable Bus Mastering if the device doesn't require MSI, the AER service will not appear in sysfs, and the AER service driver will not bind to the device. Link: https://lore.kernel.org/r/20221207084105.84947-1-mika.westerberg@linux.intel.com Link: https://lore.kernel.org/r/20221210002922.1749403-1-helgaas@kernel.org Based-on-patch-by: Mika Westerberg Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan commit e78e274eb22d966258a3845acc71d3c5b8ee2ea8 Author: Kees Cook Date: Fri Dec 2 12:48:59 2022 -0800 NFSD: Avoid clashing function prototypes When built with Control Flow Integrity, function prototypes between caller and function declaration must match. These mismatches are visible at compile time with the new -Wcast-function-type-strict in Clang[1]. There were 97 warnings produced by NFS. For example: fs/nfsd/nfs4xdr.c:2228:17: warning: cast from '__be32 (*)(struct nfsd4_compoundargs *, struct nfsd4_access *)' (aka 'unsigned int (*)(struct nfsd4_compoundargs *, struct nfsd4_access *)') to 'nfsd4_dec' (aka 'unsigned int (*)(struct nfsd4_compoundargs *, void *)') converts to incompatible function type [-Wcast-function-type-strict] [OP_ACCESS] = (nfsd4_dec)nfsd4_decode_access, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The enc/dec callbacks were defined as passing "void *" as the second argument, but were being implicitly cast to a new type. Replace the argument with union nfsd4_op_u, and perform explicit member selection in the function body. There are no resulting binary differences. Changes were made mechanically using the following Coccinelle script, with minor by-hand fixes for members that didn't already match their existing argument name: @find@ identifier func; type T, opsT; identifier ops, N; @@ opsT ops[] = { [N] = (T) func, }; @already_void@ identifier find.func; identifier name; @@ func(..., -void +union nfsd4_op_u *name) { ... } @proto depends on !already_void@ identifier find.func; type T; identifier name; position p; @@ func@p(..., T name ) { ... } @script:python get_member@ type_name << proto.T; member; @@ coccinelle.member = cocci.make_ident(type_name.split("_", 1)[1].split(' ',1)[0]) @convert@ identifier find.func; type proto.T; identifier proto.name; position proto.p; identifier get_member.member; @@ func@p(..., - T name + union nfsd4_op_u *u ) { + T name = &u->member; ... } @cast@ identifier find.func; type T, opsT; identifier ops, N; @@ opsT ops[] = { [N] = - (T) func, }; Cc: Chuck Lever Cc: Jeff Layton Cc: Gustavo A. R. Silva Cc: linux-nfs@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Chuck Lever commit 4dd9daa9124aad3c3d4ceca4f1d417cc62d59156 Author: Chuck Lever Date: Sun Nov 27 12:17:27 2022 -0500 SUNRPC: Fix crasher in unwrap_integ_data() If a zero length is passed to kmalloc() it returns 0x10, which is not a valid address. gss_verify_mic() subsequently crashes when it attempts to dereference that pointer. Instead of allocating this memory on every call based on an untrusted size value, use a piece of dynamically-allocated scratch memory that is always available. Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit c65d9df0c4a0e150d97aff363cbd0363f21f9466 Author: Chuck Lever Date: Sat Nov 26 15:55:36 2022 -0500 SUNRPC: Make the svc_authenticate tracepoint conditional Clean up: Simplify the tracepoint's only call site. Also, I noticed that when svc_authenticate() returns SVC_COMPLETE, it leaves rq_auth_stat set to an error value. That doesn't need to be recorded in the trace log. Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 9315564747cb6a570e99196b3a4880fb817635fd Author: Chuck Lever Date: Sat Nov 26 15:55:30 2022 -0500 NFSD: Use only RQ_DROPME to signal the need to drop a reply Clean up: NFSv2 has the only two usages of rpc_drop_reply in the NFSD code base. Since NFSv2 is going away at some point, replace these in order to simplify the "drop this reply?" check in nfsd_dispatch(). Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit ad3d24c59d8c3b31b10bb3e4944ae7bef63480d3 Author: Chuck Lever Date: Sat Nov 26 15:55:24 2022 -0500 SUNRPC: Clean up xdr_write_pages() Make it more evident how xdr_write_pages() updates the tail buffer by using the convention of naming the iov pointer variable "tail". I spent more than a couple of hours chasing through code to understand this, so someone is likely to find this useful later. Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit da522b5fe1a5f8b7c20a0023e87b52a150e53bf5 Author: Chuck Lever Date: Sat Nov 26 15:55:18 2022 -0500 SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails Fixes: 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.") Signed-off-by: Chuck Lever Cc: Reviewed-by: Jeff Layton commit 638593be55c0b37a1930038460a9918215d5c24b Author: Dai Ngo Date: Wed Nov 16 19:44:48 2022 -0800 NFSD: add CB_RECALL_ANY tracepoints Add tracepoints to trace start and end of CB_RECALL_ANY operation. Signed-off-by: Dai Ngo [ cel: added show_rca_mask() macro ] Signed-off-by: Chuck Lever commit 44df6f439a1790a5f602e3842879efa88f346672 Author: Dai Ngo Date: Wed Nov 16 19:44:47 2022 -0800 NFSD: add delegation reaper to react to low memory condition The delegation reaper is called by nfsd memory shrinker's on the 'count' callback. It scans the client list and sends the courtesy CB_RECALL_ANY to the clients that hold delegations. To avoid flooding the clients with CB_RECALL_ANY requests, the delegation reaper sends only one CB_RECALL_ANY request to each client per 5 seconds. Signed-off-by: Dai Ngo [ cel: moved definition of RCA4_TYPE_MASK_RDATA_DLG ] Signed-off-by: Chuck Lever commit 3959066b697b5dfbb7141124ae9665337d4bc638 Author: Dai Ngo Date: Wed Nov 16 19:44:46 2022 -0800 NFSD: add support for sending CB_RECALL_ANY Add XDR encode and decode function for CB_RECALL_ANY. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit a1049eb47f20b9eabf9afb218578fff16b4baca6 Author: Dai Ngo Date: Wed Nov 16 19:44:45 2022 -0800 NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker Refactoring courtesy_client_reaper to generic low memory shrinker so it can be used for other purposes. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 247c01ff5f8d66e62a404c91733be52fecb8b7f6 Author: Chuck Lever Date: Mon Nov 14 08:57:43 2022 -0500 trace: Relocate event helper files Steven Rostedt says: > The include/trace/events/ directory should only hold files that > are to create events, not headers that hold helper functions. > > Can you please move them out of include/trace/events/ as that > directory is "special" in the creation of events. Signed-off-by: Chuck Lever Acked-by: Leon Romanovsky Acked-by: Steven Rostedt (Google) Acked-by: Anna Schumaker commit 79a1d88a36f77374c77fd41a4386d8c2736b8704 Author: Brian Foster Date: Wed Nov 16 10:28:36 2022 -0500 NFSD: pass range end to vfs_fsync_range() instead of count _nfsd_copy_file_range() calls vfs_fsync_range() with an offset and count (bytes written), but the former wants the start and end bytes of the range to sync. Fix it up. Fixes: eac0b17a77fb ("NFSD add vfs_fsync after async copy is done") Signed-off-by: Brian Foster Tested-by: Dai Ngo Signed-off-by: Chuck Lever commit 9f27783b4dd235ef3c8dbf69fc6322777450323c Author: Jeff Layton Date: Fri Nov 11 14:36:38 2022 -0500 lockd: fix file selection in nlmsvc_cancel_blocked We currently do a lock_to_openmode call based on the arguments from the NLM_UNLOCK call, but that will always set the fl_type of the lock to F_UNLCK, and the O_RDONLY descriptor is always chosen. Fix it to use the file_lock from the block instead. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 69efce009f7df888e1fede3cb2913690eb829f52 Author: Jeff Layton Date: Fri Nov 11 14:36:37 2022 -0500 lockd: ensure we use the correct file descriptor when unlocking Shared locks are set on O_RDONLY descriptors and exclusive locks are set on O_WRONLY ones. nlmsvc_unlock however calls vfs_lock_file twice, once for each descriptor, but it doesn't reset fl_file. Ensure that it does. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 75c7940d2a86d3f1b60a0a265478cb8fc887b970 Author: Jeff Layton Date: Fri Nov 11 14:36:36 2022 -0500 lockd: set missing fl_flags field when retrieving args Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 85a0d0c9a58002ef7d1bf5e3ea630f4fbd42a4f0 Author: Xiu Jianfeng Date: Fri Nov 11 17:18:35 2022 +0800 NFSD: Use struct_size() helper in alloc_session() Use struct_size() helper to simplify the code, no functional changes. Signed-off-by: Xiu Jianfeng Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 01d53a88c08951f88f2a42f1f1e6568928e0590e Author: Jeff Layton Date: Mon Nov 7 06:58:41 2022 -0500 nfsd: return error if nfs4_setacl fails With the addition of POSIX ACLs to struct nfsd_attrs, we no longer return an error if setting the ACL fails. Ensure we return the na_aclerr error on SETATTR if there is one. Fixes: c0cbe70742f4 ("NFSD: add posix ACLs to struct nfsd_attrs") Cc: Neil Brown Reported-by: Yongcheng Yang Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 18ebd35b61b4693a0ddc270b6d4f18def232e770 Author: Trond Myklebust Date: Sun Nov 6 14:02:39 2022 -0500 lockd: set other missing fields when unlocking files vfs_lock_file() expects the struct file_lock to be fully initialised by the caller. Re-exported NFSv3 has been seen to Oops if the fl_file field is NULL. Fixes: aec158242b87 ("lockd: set fl_owner when unlocking files") Signed-off-by: Trond Myklebust Reviewed-by: Jeff Layton Link: https://bugzilla.kernel.org/show_bug.cgi?id=216582 Signed-off-by: Chuck Lever commit d7064eaf688cfe454c50db9f59298463d80d403c Author: Chuck Lever Date: Thu Nov 3 16:22:48 2022 -0400 NFSD: Add an nfsd_file_fsync tracepoint Add a tracepoint to capture the number of filecache-triggered fsync calls and which files needed it. Also, record when an fsync triggers a write verifier reset. Examples: <...>-97 [007] 262.505611: nfsd_file_free: inode=0xffff888171e08140 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d2400 <...>-97 [007] 262.505612: nfsd_file_fsync: inode=0xffff888171e08140 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d2400 ret=0 <...>-97 [007] 262.505623: nfsd_file_free: inode=0xffff888171e08dc0 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d1e00 <...>-97 [007] 262.505624: nfsd_file_fsync: inode=0xffff888171e08dc0 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d1e00 ret=0 Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 3ed157d0d73f15b6574424dd068ca5f5a8560562 Author: Li zeming Date: Fri Nov 4 09:43:03 2022 +0800 sunrpc: svc: Remove an unused static function svc_ungetu32() The svc_ungetu32 function is not used, you could remove it. Signed-off-by: Li zeming Signed-off-by: Chuck Lever commit 22ae4c114f77b55a4c5036e8f70409a0799a08f8 Author: Jeff Layton Date: Wed Nov 2 14:44:50 2022 -0400 nfsd: fix up the filecache laundrette scheduling We don't really care whether there are hashed entries when it comes to scheduling the laundrette. They might all be non-gc entries, after all. We only want to schedule it if there are entries on the LRU. Switch to using list_lru_count, and move the check into nfsd_file_gc_worker. The other callsite in nfsd_file_put doesn't need to count entries, since it only schedules the laundrette after adding an entry to the LRU. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit ea6ff7792203ad6786bda75d1dabf33311c8bef4 Author: Biju Das Date: Thu Oct 27 09:21:57 2022 +0100 can: rcar_canfd: Add multi_channel_irqs to struct rcar_canfd_hw_info RZ/G2L has separate IRQ lines for tx and error interrupt for each channel whereas R-Car has a combined IRQ line for all the channel specific tx and error interrupts. Add multi_channel_irqs to struct rcar_canfd_hw_info to select the driver to choose between combined and separate irq registration for channel interrupts. This patch also removes enum rcanfd_chip_id and chip_id from both struct rcar_canfd_hw_info, as it is unused. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221027082158.95895-6-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit a1dcfbdfd1d0f7843f381f7c58cc87a0f8c11f6c Author: Biju Das Date: Thu Oct 27 09:21:56 2022 +0100 can: rcar_canfd: Add postdiv to struct rcar_canfd_hw_info R-Car has a clock divider for CAN FD clock within the IP, whereas it is not available on RZ/G2L. Add postdiv variable to struct rcar_canfd_hw_info to take care of this difference. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221027082158.95895-5-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 841645cfc773cdd0a21c67357c53845f2e972f91 Author: Biju Das Date: Thu Oct 27 09:21:55 2022 +0100 can: rcar_canfd: Add shared_global_irqs to struct rcar_canfd_hw_info RZ/G2L has separate IRQ lines for receive FIFO and global error interrupt whereas R-Car has shared IRQ line. Add shared_global_irqs to struct rcar_canfd_hw_info to select the driver to choose between shared and separate irq registration for global interrupts. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221027082158.95895-4-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 34f9e9852b90d7be6eef95874500d1fb1b768e7f Author: Biju Das Date: Thu Oct 27 09:21:54 2022 +0100 can: rcar_canfd: Add max_channels to struct rcar_canfd_hw_info R-Car V3U supports a maximum of 8 channels whereas rest of the SoCs support 2 channels. Add max_channels variable to struct rcar_canfd_hw_info to handle this difference. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221027082158.95895-3-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 09451f244eabb7ba197abdd92a5ed5e0a8387200 Author: Vivek Yadav Date: Fri Nov 4 10:46:17 2022 +0530 can: m_can: sort header inclusion alphabetically Sort header inclusion alphabetically. Suggested-by: Marc Kleine-Budde Signed-off-by: Vivek Yadav Link: https://lore.kernel.org/all/20221104051617.21173-1-vivek.2311@samsung.com Signed-off-by: Marc Kleine-Budde commit ce7c5382758b13dd4dfa2eb2f4989f9a27c58ffe Author: Biju Das Date: Thu Oct 27 09:21:53 2022 +0100 can: rcar_canfd: rcar_canfd_probe: Add struct rcar_canfd_hw_info to driver data The CAN FD IP found on RZ/G2L SoC has some HW features different to that of R-Car. For example, it has multiple resets and multiple IRQs for global and channel interrupts. Also, it does not have ECC error flag registers and clk post divider present on R-Car. Similarly, R-Car V3U has 8 channels whereas other SoCs has only 2 channels. This patch adds the struct rcar_canfd_hw_info to take care of the HW feature differences and driver data present on both IPs. It also replaces the driver data chip type with struct rcar_canfd_hw_info by moving chip type to it. Whilst started using driver data instead of chip_id for detecting R-Car V3U SoCs. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20221027082158.95895-2-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 0bf582fc51684dc4380b0b9248112cf9f837a585 Author: Marc Kleine-Budde Date: Mon Oct 31 12:28:08 2022 +0100 can: kvaser_usb: kvaser_usb_set_{,data}bittiming(): remove empty lines in variable declaration Fix coding style by removing empty lines in variable declaration. Fixes: 39d3df6b0ea8 ("can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming") Cc: Jimmy Assarsson Cc: Anssi Hannula Link: https://lore.kernel.org/all/20221031114513.81214-2-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f0c0ade8d874fb127f9b451d415bee8cbb6bf7a6 Author: Andreas Gruenbacher Date: Mon Dec 5 22:27:38 2022 +0100 gfs2: Minor gfs2_try_evict cleanup In gfs2_try_evict(), when an inode can't be evicted, we are grabbing a temporary reference on the inode glock to poke that glock. That should be safe, but it's easier to just grab an inode reference as we already do earlier in this function. Signed-off-by: Andreas Gruenbacher commit cce2d7d2abcc8d083fbb24e795089542f1e742c8 Author: Marc Kleine-Budde Date: Mon Oct 31 12:26:24 2022 +0100 can: kvaser_usb: kvaser_usb_set_bittiming(): fix redundant initialization warning for err The variable err is initialized, but the initialized value is Overwritten before it is read. Fix the warning by not initializing the variable err at all. Fixes: 39d3df6b0ea8 ("can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming") Cc: Jimmy Assarsson Cc: Anssi Hannula Link: https://lore.kernel.org/all/20221031114513.81214-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 4994e387d7332f03cd4eab55f7896ddf04cab1c0 Author: Steven Rostedt Date: Tue Dec 6 14:12:02 2022 -0500 x86/mm/kmmio: Switch to arch_spin_lock() The mmiotrace tracer is "special". The purpose is to help reverse engineer binary drivers by removing the memory allocated by the driver and when the driver goes to access it, a fault occurs, the mmiotracer will record what the driver was doing and then do the work on its behalf by single stepping through the process. But to achieve this ability, it must do some special things. One is it needs to grab a lock while in the breakpoint handler. This is considered an NMI state, and then lockdep warns that the lock is being held in both an NMI state (really a breakpoint handler) and also in normal context. As the breakpoint/NMI state only happens when the driver is accessing memory, there's no concern of a race condition against the setup and tear-down of mmiotracer. To make lockdep and mmiotrace work together, convert the locks used in the breakpoint handler into arch_spin_lock(). Link: https://lkml.kernel.org/r/20221206191229.656244029@goodmis.org Link: https://lore.kernel.org/lkml/20221201213126.620b7dd3@gandalf.local.home/ Cc: Masami Hiramatsu Cc: Andrew Morton Cc: Karol Herbst Cc: Pekka Paalanen Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Borislav Petkov Suggested-by: Thomas Gleixner Signed-off-by: Steven Rostedt (Google) commit e25e43a4e5d8cb2323553d8b6a7ba08d2ebab21f Author: Masami Hiramatsu (Google) Date: Tue Dec 6 23:18:01 2022 +0900 tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE Both CONFIG_OSNOISE_TRACER and CONFIG_HWLAT_TRACER partially enables the CONFIG_TRACER_MAX_TRACE code, but that is complicated and has introduced a bug; It declares tracing_max_lat_fops data structure outside of #ifdefs, but since it is defined only when CONFIG_TRACER_MAX_TRACE=y or CONFIG_HWLAT_TRACER=y, if only CONFIG_OSNOISE_TRACER=y, that declaration comes to a definition(!). To fix this issue, and do not repeat the similar problem, makes CONFIG_OSNOISE_TRACER and CONFIG_HWLAT_TRACER enables the CONFIG_TRACER_MAX_TRACE always. It has there benefits; - Fix the tracing_max_lat_fops bug - Simplify the #ifdefs - CONFIG_TRACER_MAX_TRACE code is fully enabled, or not. Link: https://lore.kernel.org/linux-trace-kernel/167033628155.4111793.12185405690820208159.stgit@devnote3 Fixes: 424b650f35c7 ("tracing: Fix missing osnoise tracer on max_latency") Cc: Daniel Bristot de Oliveira Cc: stable@vger.kernel.org Reported-by: David Howells Reported-by: kernel test robot Signed-off-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/all/166992525941.1716618.13740663757583361463.stgit@warthog.procyon.org.uk/ (original thread and v1) Link: https://lore.kernel.org/all/202212052253.VuhZ2ulJ-lkp@intel.com/T/#u (v1 error report) Signed-off-by: Steven Rostedt (Google) commit 575b76cb885532aae13a9d979fd476bb2b156cb9 Author: Steven Rostedt (Google) Date: Tue Nov 22 12:23:45 2022 -0500 tracing/probes: Handle system names with hyphens When creating probe names, a check is done to make sure it matches basic C standard variable naming standards. Basically, starts with alphabetic or underline, and then the rest of the characters have alpha-numeric or underline in them. But system names do not have any true naming conventions, as they are created by the TRACE_SYSTEM macro and nothing tests to see what they are. The "xhci-hcd" trace events has a '-' in the system name. When trying to attach a eprobe to one of these trace points, it fails because the system name does not follow the variable naming convention because of the hyphen, and the eprobe checks fail on this. Allow hyphens in the system name so that eprobes can attach to the "xhci-hcd" trace events. Link: https://lore.kernel.org/all/Y3eJ8GiGnEvVd8%2FN@macondo/ Link: https://lore.kernel.org/linux-trace-kernel/20221122122345.160f5077@gandalf.local.home Cc: Masami Hiramatsu Cc: stable@vger.kernel.org Fixes: 5b7a96220900e ("tracing/probe: Check event/group naming rule at parsing") Reported-by: Rafael Mendonca Signed-off-by: Steven Rostedt (Google) commit fff1787adaeebe66f27c01d5c40d8d2e4d79d5ee Author: Song Chen Date: Wed Oct 19 10:11:18 2022 +0800 trace/kprobe: remove duplicated calls of ring_buffer_event_data Function __kprobe_trace_func calls ring_buffer_event_data to get a ring buffer, however, it has been done in above call trace_event_buffer_reserve. So does __kretprobe_trace_func. This patch removes those duplicated calls. Link: https://lore.kernel.org/all/1666145478-4706-1-git-send-email-chensong_2000@189.cn/ Reviewed-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Song Chen Signed-off-by: Masami Hiramatsu (Google) commit 8c2b99790196d34a58a2b00a4c9862d2de3af3e2 Author: Masami Hiramatsu (Google) Date: Thu Oct 20 00:31:56 2022 +0900 tracing: docs: Update histogram doc for .percent/.graph and 'nohitcount' Update histogram document for .percent/.graph suffixes and 'nohitcount' option. Link: https://lore.kernel.org/linux-trace-kernel/166610815604.56030.4124933216911828519.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi commit ccf47f5cc4cebdba7444cf1c04fc1b02d4b3cd15 Author: Masami Hiramatsu (Google) Date: Thu Oct 20 00:31:55 2022 +0900 tracing: Add nohitcount option for suppressing display of raw hitcount Add 'nohitcount' ('NOHC' for short) option for suppressing display of the raw hitcount column in the histogram. Note that you must specify at least one value except raw 'hitcount' when you specify this nohitcount option. # cd /sys/kernel/debug/tracing/ # echo hist:keys=pid:vals=runtime.percent,runtime.graph:sort=pid:NOHC > \ events/sched/sched_stat_runtime/trigger # sleep 10 # cat events/sched/sched_stat_runtime/hist # event histogram # # trigger info: hist:keys=pid:vals=runtime.percent,runtime.graph:sort=pid:size=2048:nohitcount [active] # { pid: 8 } runtime (%): 3.02 runtime: # { pid: 14 } runtime (%): 2.25 runtime: { pid: 16 } runtime (%): 2.25 runtime: { pid: 26 } runtime (%): 0.17 runtime: { pid: 61 } runtime (%): 11.52 runtime: #### { pid: 67 } runtime (%): 1.56 runtime: { pid: 68 } runtime (%): 0.84 runtime: { pid: 76 } runtime (%): 0.92 runtime: { pid: 117 } runtime (%): 2.50 runtime: # { pid: 146 } runtime (%): 49.88 runtime: #################### { pid: 157 } runtime (%): 16.63 runtime: ###### { pid: 158 } runtime (%): 8.38 runtime: ### Link: https://lore.kernel.org/linux-trace-kernel/166610814787.56030.4980636083486339906.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi commit a2c54256dec7510477e2b4f4db187e638f7cac37 Author: Masami Hiramatsu (Google) Date: Thu Oct 20 00:31:55 2022 +0900 tracing: Add .graph suffix option to histogram value Add the .graph suffix which shows the bar graph of the histogram value. For example, the below example shows that the bar graph of the histogram of the runtime for each tasks. ------ # cd /sys/kernel/debug/tracing/ # echo hist:keys=pid:vals=runtime.graph:sort=pid > \ events/sched/sched_stat_runtime/trigger # sleep 10 # cat events/sched/sched_stat_runtime/hist # event histogram # # trigger info: hist:keys=pid:vals=hitcount,runtime.graph:sort=pid:size=2048 [active] # { pid: 14 } hitcount: 2 runtime: { pid: 16 } hitcount: 8 runtime: { pid: 26 } hitcount: 1 runtime: { pid: 57 } hitcount: 3 runtime: { pid: 61 } hitcount: 20 runtime: ### { pid: 66 } hitcount: 2 runtime: { pid: 70 } hitcount: 3 runtime: { pid: 72 } hitcount: 2 runtime: { pid: 145 } hitcount: 14 runtime: #################### { pid: 152 } hitcount: 5 runtime: ####### { pid: 153 } hitcount: 2 runtime: #### Totals: Hits: 62 Entries: 11 Dropped: 0 ------- Link: https://lore.kernel.org/linux-trace-kernel/166610813953.56030.10944148382315789485.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi commit abaa5258ce5e5887a9de049f50a85dc023391a1c Author: Masami Hiramatsu (Google) Date: Thu Oct 20 00:31:55 2022 +0900 tracing: Add .percent suffix option to histogram values Add .percent suffix option to show the histogram values in percentage. This feature is useful when we need yo undersntand the overall trend for the histograms of large values. E.g. this shows the runtime percentage for each tasks. ------ # cd /sys/kernel/debug/tracing/ # echo hist:keys=pid:vals=hitcount,runtime.percent:sort=pid > \ events/sched/sched_stat_runtime/trigger # sleep 10 # cat events/sched/sched_stat_runtime/hist # event histogram # # trigger info: hist:keys=pid:vals=hitcount,runtime.percent:sort=pid:size=2048 [active] # { pid: 8 } hitcount: 7 runtime (%): 4.14 { pid: 14 } hitcount: 5 runtime (%): 3.69 { pid: 16 } hitcount: 11 runtime (%): 3.41 { pid: 61 } hitcount: 41 runtime (%): 19.75 { pid: 65 } hitcount: 4 runtime (%): 1.48 { pid: 70 } hitcount: 6 runtime (%): 3.60 { pid: 72 } hitcount: 2 runtime (%): 1.10 { pid: 144 } hitcount: 10 runtime (%): 32.01 { pid: 151 } hitcount: 8 runtime (%): 22.66 { pid: 152 } hitcount: 2 runtime (%): 8.10 Totals: Hits: 96 Entries: 10 Dropped: 0 ----- Link: https://lore.kernel.org/linux-trace-kernel/166610813077.56030.4238090506973562347.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi commit 5f2e094ed2592abb3d1f49e263957188e121c2ac Author: Tom Zanussi Date: Thu Oct 20 00:31:55 2022 +0900 tracing: Allow multiple hitcount values in histograms The hitcount is treated specially in the histograms - since it's always expected to be there regardless of whether the user specified anything or not, it's always added as the first histogram value. Currently the code doesn't allow it to be added more than once as a value, which is inconsistent with all the other possible values. It would seem to be a pointless thing to want to do, but other features being added such as percent and graph modifiers don't work properly with the current hitcount restrictions. Fix this by allowing multiple hitcounts to be added. Link: https://lore.kernel.org/linux-trace-kernel/166610812248.56030.16754785928712505251.stgit@devnote2 Signed-off-by: Tom Zanussi Signed-off-by: Masami Hiramatsu (Google) Tested-by: Tom Zanussi commit dd8b3a802b64adf059a49a68f1bdca7846e492fc Merge: 5fc11a401a8dc abe2343d37c2b Author: Jakub Kicinski Date: Fri Dec 9 20:06:34 2022 -0800 Merge tag 'ipsec-next-2022-12-09' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== ipsec-next 2022-12-09 1) Add xfrm packet offload core API. From Leon Romanovsky. 2) Add xfrm packet offload support for mlx5. From Leon Romanovsky and Raed Salem. 3) Fix a typto in a error message. From Colin Ian King. * tag 'ipsec-next-2022-12-09' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: (38 commits) xfrm: Fix spelling mistake "oflload" -> "offload" net/mlx5e: Open mlx5 driver to accept IPsec packet offload net/mlx5e: Handle ESN update events net/mlx5e: Handle hardware IPsec limits events net/mlx5e: Update IPsec soft and hard limits net/mlx5e: Store all XFRM SAs in Xarray net/mlx5e: Provide intermediate pointer to access IPsec struct net/mlx5e: Skip IPsec encryption for TX path without matching policy net/mlx5e: Add statistics for Rx/Tx IPsec offloaded flows net/mlx5e: Improve IPsec flow steering autogroup net/mlx5e: Configure IPsec packet offload flow steering net/mlx5e: Use same coding pattern for Rx and Tx flows net/mlx5e: Add XFRM policy offload logic net/mlx5e: Create IPsec policy offload tables net/mlx5e: Generalize creation of default IPsec miss group and rule net/mlx5e: Group IPsec miss handles into separate struct net/mlx5e: Make clear what IPsec rx_err does net/mlx5e: Flatten the IPsec RX add rule path net/mlx5e: Refactor FTE setup code to be more clear net/mlx5e: Move IPsec flow table creation to separate function ... ==================== Link: https://lore.kernel.org/r/20221209093310.4018731-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 5fc11a401a8dc491b326d2c916b07d22e7ac8833 Author: Gavrilov Ilia Date: Thu Dec 8 08:31:39 2022 +0000 net: devlink: Add missing error check to devlink_resource_put() When the resource size changes, the return value of the 'nla_put_u64_64bit' function is not checked. That has been fixed to avoid rechecking at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Note that this is harmless, we'd error out at the next put(). Signed-off-by: Ilia.Gavrilov Link: https://lore.kernel.org/r/20221208082821.3927937-1-Ilia.Gavrilov@infotecs.ru Signed-off-by: Jakub Kicinski commit ce098da1497c6dee9589fce2c61d1910f4fcf0e7 Author: Kees Cook Date: Wed Dec 7 22:02:59 2022 -0800 skbuff: Introduce slab_build_skb() syzkaller reported: BUG: KASAN: slab-out-of-bounds in __build_skb_around+0x235/0x340 net/core/skbuff.c:294 Write of size 32 at addr ffff88802aa172c0 by task syz-executor413/5295 For bpf_prog_test_run_skb(), which uses a kmalloc()ed buffer passed to build_skb(). When build_skb() is passed a frag_size of 0, it means the buffer came from kmalloc. In these cases, ksize() is used to find its actual size, but since the allocation may not have been made to that size, actually perform the krealloc() call so that all the associated buffer size checking will be correctly notified (and use the "new" pointer so that compiler hinting works correctly). Split this logic out into a new interface, slab_build_skb(), but leave the original 0 checking for now to catch any stragglers. Reported-by: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com Link: https://groups.google.com/g/syzkaller-bugs/c/UnIKxTtU5-0/m/-wbXinkgAQAJ Fixes: 38931d8989b5 ("mm: Make ksize() a reporting-only function") Cc: Pavel Begunkov Cc: pepsipu Cc: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com Cc: Vlastimil Babka Cc: kasan-dev Cc: Andrii Nakryiko Cc: ast@kernel.org Cc: Daniel Borkmann Cc: Hao Luo Cc: Jesper Dangaard Brouer Cc: John Fastabend Cc: jolsa@kernel.org Cc: KP Singh Cc: martin.lau@linux.dev Cc: Stanislav Fomichev Cc: song@kernel.org Cc: Yonghong Song Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221208060256.give.994-kees@kernel.org Signed-off-by: Jakub Kicinski commit 28d39503e4e06c2caf09a89865c81cfd9e4eae7c Author: Jiapeng Chong Date: Fri Dec 9 11:37:23 2022 +0800 net: bcmgenet: Remove the unused function The function dmadesc_get_addr() is defined in the bcmgenet.c file, but not called elsewhere, so remove this unused function. drivers/net/ethernet/broadcom/genet/bcmgenet.c:120:26: warning: unused function 'dmadesc_get_addr'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3401 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20221209033723.32452-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 2b53d8698a47a3f6879b3c5cd2a90906422971cc Merge: c80edd8d41d9a 03e7d28cd25ee Author: Jakub Kicinski Date: Fri Dec 9 19:46:14 2022 -0800 Merge branch 'mptcp-miscellaneous-cleanup' Mat Martineau says: ==================== mptcp: Miscellaneous cleanup Two code cleanup patches for the 6.2 merge window that don't change behavior: Patch 1 makes proper use of nlmsg_free(), as suggested by Jakub while reviewing f8c9dfbd875b ("mptcp: add pm listener events"). Patch 2 clarifies success status in a few mptcp functions, which prevents some smatch false positives. ==================== Link: https://lore.kernel.org/r/20221209004431.143701-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit 03e7d28cd25ee6ff731386fb154d03f76dede1cc Author: Matthieu Baerts Date: Thu Dec 8 16:44:31 2022 -0800 mptcp: return 0 instead of 'err' var When 'err' is 0, it looks clearer to return '0' instead of the variable called 'err'. The behaviour is then not modified, just a clearer code. By doing this, we can also avoid false positive smatch warnings like this one: net/mptcp/pm_netlink.c:1169 mptcp_pm_parse_pm_addr_attr() warn: missing error code? 'err' Reported-by: kernel test robot Reported-by: Dan Carpenter Suggested-by: Mat Martineau Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 8b34b52c1794932a16308631121b758830349ae9 Author: Geliang Tang Date: Thu Dec 8 16:44:30 2022 -0800 mptcp: use nlmsg_free instead of kfree_skb Use nlmsg_free() instead of kfree_skb() in pm_netlink.c. The SKB's have been created by nlmsg_new(). The proper cleaning way should then be done with nlmsg_free(). For the moment, nlmsg_free() is simply calling kfree_skb() so we don't change the behaviour here. Suggested-by: Jakub Kicinski Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit c80edd8d41d9a7cd4ff6aa5e8f5d5b9d066f6984 Merge: 043cd1e204a02 4fe1b3a5f8fe2 Author: Jakub Kicinski Date: Fri Dec 9 19:44:42 2022 -0800 Merge tag 'mlx5-updates-2022-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2022-12-08 1) Support range match action in SW steering Yevgeny Kliteynik says: ======================= The following patch series adds support for a range match action in SW Steering. SW steering is able to match only on the exact values of the packet fields, as requested by the user: the user provides mask for the fields that are of interest, and the exact values to be matched on when the traffic is handled. The following patch series add new type of action - Range Match, where the user provides a field to be matched on and a range of values (min to max) that will be considered as hit. There are several new notions that were implemented in order to support Range Match: - MATCH_RANGES Steering Table Entry (STE): the new STE type that allows matching the packets' fields on the range of values instead of a specific value. - Match Definer: this is a general FW object that defines which fields in the packet will be referenced by the mask and tag of each STE. Match definer ID is part of STE fields, and it defines how the HW needs to interpret the STE's mask/tag values. Till now SW steering used the definers that were managed by FW and implemented the STE layout as described by the HW spec. Now that we're adding a new type of STE, SW steering needs to also be able to define this new STE's layout, and this is do ======================= 2) From OZ add support for meter mtu offload 2.1: Refactor the code to allow both metering and range post actions as a pre-step for adding police mtu offload support. 2.2: Instantiate mtu green/red flow tables with a single match-all rule. Add the green/red actions to the hit/miss table accordingly 2.3: Initialize the meter object with the TC police mtu parameter. Use the hardware range match action feature. 3) From MaorD, support routes with more than 2 nexthops in multipath 4) Michael and Or, improve and extend vport representor counters. * tag 'mlx5-updates-2022-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Expose steering dropped packets counter net/mlx5: Refactor and expand rep vport stat group net/mlx5e: multipath, support routes with more than 2 nexthops net/mlx5e: TC, add support for meter mtu offload net/mlx5e: meter, add mtu post meter tables net/mlx5e: meter, refactor to allow multiple post meter tables net/mlx5: DR, Add support for range match action net/mlx5: DR, Add function that tells if STE miss addr has been initialized net/mlx5: DR, Some refactoring of miss address handling net/mlx5: DR, Manage definers with refcounts net/mlx5: DR, Handle FT action in a separate function net/mlx5: DR, Rework is_fw_table function net/mlx5: DR, Add functions to create/destroy MATCH_DEFINER general object net/mlx5: fs, add match on ranges API net/mlx5: mlx5_ifc updates for MATCH_DEFINER general object ==================== Link: https://lore.kernel.org/r/20221209001420.142794-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 043cd1e204a02735228a4bcc1ef094b347b360bf Merge: 1933ea365aa7a 95af1f1c4c9f9 Author: Jakub Kicinski Date: Fri Dec 9 19:42:16 2022 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-12-08 (ice) Jacob Keller says: This series of patches primarily consists of changes to fix some corner cases that can cause Tx timestamp failures. The issues were discovered and reported by Siddaraju DH and primarily affect E822 hardware, though this series also includes some improvements that affect E810 hardware as well. The primary issue is regarding the way that E822 determines when to generate timestamp interrupts. If the driver reads timestamp indexes which do not have a valid timestamp, the E822 interrupt tracking logic can get stuck. This is due to the way that E822 hardware tracks timestamp index reads internally. I was previously unaware of this behavior as it is significantly different in E810 hardware. Most of the fixes target refactors to ensure that the ice driver does not read timestamp indexes which are not valid on E822 hardware. This is done by using the Tx timestamp ready bitmap register from the PHY. This register indicates what timestamp indexes have outstanding timestamps waiting to be captured. Care must be taken in all cases where we read the timestamp registers, and thus all flows which might have read these registers are refactored. The ice_ptp_tx_tstamp function is modified to consolidate as much of the logic relating to these registers as possible. It now handles discarding stale timestamps which are old or which occurred after a PHC time update. This replaces previously standalone thread functions like the periodic work function and the ice_ptp_flush_tx_tracker function. In addition, some minor cleanups noticed while writing these refactors are included. The remaining patches refactor the E822 implementation to remove the "bypass" mode for timestamps. The E822 hardware has the ability to provide a more precise timestamp by making use of measurements of the precise way that packets flow through the hardware pipeline. These measurements are known as "Vernier" calibration. The "bypass" mode disables many of these measurements in favor of a faster start up time for Tx and Rx timestamping. Instead, once these measurements were captured, the driver tries to reconfigure the PHY to enable the vernier calibrations. Unfortunately this recalibration does not work. Testing indicates that the PHY simply remains in bypass mode without the increased timestamp precision. Remove the attempt at recalibration and always use vernier mode. This has one disadvantage that Tx and Rx timestamps cannot begin until after at least one packet of that type goes through the hardware pipeline. Because of this, further refactor the driver to separate Tx and Rx vernier calibration. Complete the Tx and Rx independently, enabling the appropriate type of timestamp as soon as the relevant packet has traversed the hardware pipeline. This was reported by Milena Olech. Note that although these might be considered "bug fixes", the required changes in order to appropriately resolve these issues is large. Thus it does not feel suitable to send this series to net. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: reschedule ice_ptp_wait_for_offset_valid during reset ice: make Tx and Rx vernier offset calibration independent ice: only check set bits in ice_ptp_flush_tx_tracker ice: handle flushing stale Tx timestamps in ice_ptp_tx_tstamp ice: cleanup allocations in ice_ptp_alloc_tx_tracker ice: protect init and calibrating check in ice_ptp_request_ts ice: synchronize the misc IRQ when tearing down Tx tracker ice: check Tx timestamp memory register for ready timestamps ice: handle discarding old Tx requests in ice_ptp_tx_tstamp ice: always call ice_ptp_link_change and make it void ice: fix misuse of "link err" with "link status" ice: Reset TS memory for all quads ice: Remove the E822 vernier "bypass" logic ice: Use more generic names for ice_ptp_tx fields ==================== Link: https://lore.kernel.org/r/20221208213932.1274143-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3b91010500eba3601e906b0e92cf84fab4d895d1 Merge: e0ff428042335 4a7ba45b1a435 Author: Andrew Morton Date: Fri Dec 9 19:31:11 2022 -0800 Merge branch 'mm-hotfixes-stable' into mm-stable commit d01404fa7b8c72c7052232423f30a16060828f28 Merge: 59a582ad13813 26fb4b90b745a Author: Palmer Dabbelt Date: Fri Dec 9 18:14:28 2022 -0800 Merge patch series "riscv: alternative-macros.h cleanups" Andrew Jones says: This series is a collection of cleanups for alternative-macros.h with the main motivation being that adding new ALTERNATIVE_3, ALTERNATIVE_4, ... will be possible without lots of bloat. * b4-shazam-merge: riscv: Don't duplicate _ALTERNATIVE_CFG* macros riscv: alternatives: Drop the underscores from the assembly macro names riscv: alternatives: Don't name unused macro parameters riscv: Don't duplicate __ALTERNATIVE_CFG in __ALTERNATIVE_CFG_2 Link: https://lore.kernel.org/r/20221129150053.50464-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 59a582ad13813375e3e091df51f876fdb8b3f119 Merge: 6ff8ca3f93d3c 9daaca4a44d6f Author: Palmer Dabbelt Date: Fri Dec 9 14:01:54 2022 -0800 Merge patch series "RISC-V: Ensure Zicbom has a valid block size" Andrew Jones says: When a DT puts zicbom in the isa string, but does not provide a block size, ALT_CMO_OP() will attempt to do cache operations on address zero since the start address will be ANDed with zero. We can't simply BUG() in riscv_init_cbom_blocksize() when we fail to find a block size because the failure will happen before logging works, leaving users to scratch their heads as to why the boot hung. Instead, ensure Zicbom is disabled and output an error which will hopefully alert people that the DT needs to be fixed. While at it, add a check that the block size is a power-of-2 too. * b4-shazam-merge: RISC-V: Ensure Zicbom has a valid block size RISC-V: Introduce riscv_isa_extension_check RISC-V: Improve use of isa2hwcap[] Link: https://lore.kernel.org/r/20221129143447.49714-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 9daaca4a44d6f0741060e67c54a0175c035edb1f Author: Andrew Jones Date: Tue Nov 29 15:34:47 2022 +0100 RISC-V: Ensure Zicbom has a valid block size When a DT puts zicbom in the isa string, but does not provide a block size, ALT_CMO_OP() will attempt to do cache operations on address zero since the start address will be ANDed with zero. We can't simply BUG() in riscv_init_cbom_blocksize() when we fail to find a block size because the failure will happen before logging works, leaving users to scratch their heads as to why the boot hung. Instead, ensure Zicbom is disabled and output an error which will hopefully alert people that the DT needs to be fixed. While at it, add a check that the block size is a power-of-2 too. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20221129143447.49714-4-ajones@ventanamicro.com [Palmer: base on 5c20a3a9df19 ("RISC-V: Fix compilation without RISCV_ISA_ZICBOM"] Reported-by: kernel test robot Signed-off-by: Palmer Dabbelt commit fb0ff0a95d61f69415cb8d8f2d921e1f7eed75af Author: Andrew Jones Date: Tue Nov 29 15:34:46 2022 +0100 RISC-V: Introduce riscv_isa_extension_check Currently any isa extension found in the isa string is set in the isa bitmap. An isa extension set in the bitmap indicates that the extension is present and may be used (a.k.a is enabled). However, when an extension cannot be used due to missing dependencies or errata it should not be added to the bitmap. Introduce a function where additional checks may be placed in order to determine if an extension should be enabled or not. Note, the checks may simply indicate an issue with the DT, but, since extensions may be used in early boot, it's not always possible to simply produce an error at the point the issue is determined. It's best to keep the extension disabled and produce an error. No functional change intended, as the function is only introduced and always returns true. A later patch will provide checks for an isa extension. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20221129143447.49714-3-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 726855549cf8d5c6b05795cf74a9c23584f45544 Author: Andrew Jones Date: Tue Nov 29 15:34:45 2022 +0100 RISC-V: Improve use of isa2hwcap[] Improve isa2hwcap[] by removing it from static storage, as riscv_fill_hwcap() is only called once, and by reducing its size from 256 bytes to 26. The latter improvement is possible because isa2hwcap[] will never be indexed with capital letters and we can precompute the offsets from 'a'. No functional change intended. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20221129143447.49714-2-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 26fb4b90b745a808e94a81dc732d440c285fa74b Author: Andrew Jones Date: Tue Nov 29 16:00:53 2022 +0100 riscv: Don't duplicate _ALTERNATIVE_CFG* macros Reduce clutter by only defining the _ALTERNATIVE_CFG* macros once, rather than once for assembly and once for C. To do that, we need to add __ALTERNATIVE_CFG* macros to the assembly side, but those are one-liners. Also take the opportunity to do a bit of reformatting, taking full advantage of the fact checkpatch gives us 100 char lines. Signed-off-by: Andrew Jones Tested-by: Lad Prabhakar Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221129150053.50464-5-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit bb2efcde594628ae08ee6e4be51b2047df9d2d06 Author: Andrew Jones Date: Tue Nov 29 16:00:52 2022 +0100 riscv: alternatives: Drop the underscores from the assembly macro names The underscores aren't needed because there isn't anything already named without them and the _CFG extension. This is a bit of a cleanup by itself, but the real motivation is for a coming patch which would otherwise need to add two more underscores to these macro names, i.e. ____ALTERNATIVE_CFG, and that'd be gross. Signed-off-by: Andrew Jones Tested-by: Lad Prabhakar Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221129150053.50464-4-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 7d52eace1bf5c55704bb0ca5dc8f2489927683ff Author: Andrew Jones Date: Tue Nov 29 16:00:51 2022 +0100 riscv: alternatives: Don't name unused macro parameters Without CONFIG_RISCV_ALTERNATIVE only the first parameter of the ALTERNATIVE macros is needed. Use ... for the rest to cut down on clutter. While there, fix a couple space vs. tab issues. Signed-off-by: Andrew Jones Tested-by: Lad Prabhakar Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221129150053.50464-3-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 2ba8c7dc71c098935977528747b82ffae43f3f18 Author: Andrew Jones Date: Tue Nov 29 16:00:50 2022 +0100 riscv: Don't duplicate __ALTERNATIVE_CFG in __ALTERNATIVE_CFG_2 Build __ALTERNATIVE_CFG_2 by adding on to __ALTERNATIVE_CFG rather than duplicating it. Signed-off-by: Andrew Jones Tested-by: Lad Prabhakar Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221129150053.50464-2-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 4bf73588165ba7d32131a043775557a54b6e1db5 Author: Dmitry Goncharov Date: Mon Dec 5 16:48:19 2022 -0500 kbuild: Port silent mode detection to future gnu make. Port silent mode detection to the future (post make-4.4) versions of gnu make. Makefile contains the following piece of make code to detect if option -s is specified on the command line. ifneq ($(findstring s,$(filter-out --%,$(MAKEFLAGS))),) This code is executed by make at parse time and assumes that MAKEFLAGS does not contain command line variable definitions. Currently if the user defines a=s on the command line, then at build only time MAKEFLAGS contains " -- a=s". However, starting with commit dc2d963989b96161472b2cd38cef5d1f4851ea34 MAKEFLAGS contains command line definitions at both parse time and build time. This '-s' detection code then confuses a command line variable definition which contains letter 's' with option -s. $ # old make $ make net/wireless/ocb.o a=s CALL scripts/checksyscalls.sh DESCEND objtool $ # this a new make which defines makeflags at parse time $ ~/src/gmake/make/l64/make net/wireless/ocb.o a=s $ We can see here that the letter 's' from 'a=s' was confused with -s. This patch checks for presence of -s using a method recommended by the make manual here https://www.gnu.org/software/make/manual/make.html#Testing-Flags. Link: https://lists.gnu.org/archive/html/bug-make/2022-11/msg00190.html Reported-by: Jan Palus Signed-off-by: Dmitry Goncharov Signed-off-by: Masahiro Yamada commit 9edb4fd3d70a9dffd8ac6af6d060e97672b4a22f Author: Thomas Weißschuh Date: Sat Nov 26 06:10:01 2022 +0100 init/version.c: remove #include Commit 2df8220cc511 ("kbuild: build init/built-in.a just once") moved the usage of the define UTS_RELEASE to the file version-timestamp.c. version-timestamp.c in turn is included from version.c but already includes utsrelease.h itself properly. The unneeded include of utsrelease.h from version.c can be dropped. Fixes: 2df8220cc511 ("kbuild: build init/built-in.a just once") Signed-off-by: Thomas Weißschuh Signed-off-by: Masahiro Yamada commit bd328def2f987ebd4e20725a490f005556d737bf Author: Thomas Weißschuh Date: Sat Nov 26 06:09:59 2022 +0100 firmware_loader: remove #include utsrelease.h is potentially generated on each build. By removing this unused include we can get rid of some spurious recompilations. Signed-off-by: Thomas Weißschuh Reviewed-by: Russ Weight Signed-off-by: Masahiro Yamada commit 124011e6e933bead5852c3f69b32dec43919fe1a Author: Li Zhijian Date: Tue Dec 6 21:02:01 2022 +0800 RDMA/rxe: Enable RDMA FLUSH capability for rxe device Now we are ready to enable RDMA FLUSH capability for RXE. It can support Global Visibility and Persistence placement types. Link: https://lore.kernel.org/r/20221206130201.30986-11-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 8b4d379b399d19f4c803e565bfe13f07b66b5ad7 Author: Li Zhijian Date: Tue Dec 6 21:02:00 2022 +0800 RDMA/cm: Make QP FLUSHABLE for supported device Similar to RDMA and Atomic qp attributes enabled by default in CM, enable FLUSH attribute for supported device. That makes applications that are built with rdma_create_ep, rdma_accept APIs have FLUSH qp attribute natively so that user is able to request FLUSH operation simpler. Note that, a FLUSH operation requires FLUSH are supported by both device(HCA) and memory region(MR) and QP at the same time, so it's safe to enable FLUSH qp attribute by default here. FLUSH attribute can be disable by modify_qp() interface. Link: https://lore.kernel.org/r/20221206130201.30986-10-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 70aad902ce8aeb094dd3ef14988a652f24cce7c8 Author: Li Zhijian Date: Tue Dec 6 21:01:59 2022 +0800 RDMA/rxe: Implement flush completion Per IBA SPEC, FLUSH will ack in rdma read response with 0 length. Use IB_WC_FLUSH (aka IB_UVERBS_WC_FLUSH) code to tell userspace a FLUSH completion. Link: https://lore.kernel.org/r/20221206130201.30986-9-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit ea1bb00ee9a5527b032a6efebe4a879db4cb42bb Author: Li Zhijian Date: Tue Dec 6 21:01:58 2022 +0800 RDMA/rxe: Implement flush execution in responder side Only the requested placement types that also registered in the destination memory region are acceptable. Otherwise, responder will also reply NAK "Remote Access Error" if it found a placement type violation. We will persist data via arch_wb_cache_pmem(), which could be architecture specific. This commit also adds 2 helpers to update qp.resp from the incoming packet. Link: https://lore.kernel.org/r/20221206130201.30986-8-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit fa1fd682ad3ef35b0e532c3bb14140786d17527c Author: Li Zhijian Date: Tue Dec 6 21:01:57 2022 +0800 RDMA/rxe: Implement RC RDMA FLUSH service in requester side Implement FLUSH request operation in the requester. Link: https://lore.kernel.org/r/20221206130201.30986-7-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 02e9a31c897d17981508ceaac4430b93ff56ffc7 Author: Li Zhijian Date: Tue Dec 6 21:01:56 2022 +0800 RDMA/rxe: Extend rxe packet format to support flush Extend rxe opcode tables, headers, helper and constants to support flush operations. Refer to the IBA A19.4.1 for more FETH definition details Link: https://lore.kernel.org/r/20221206130201.30986-6-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 02ea0a511558c907bde0e01fdebcd4536924d996 Author: Li Zhijian Date: Tue Dec 6 21:01:55 2022 +0800 RDMA/rxe: Allow registering persistent flag for pmem MR only Memory region could support at most 2 flush access flags: IB_ACCESS_FLUSH_PERSISTENT and IB_ACCESS_FLUSH_GLOBAL But we only allow user to register persistent flush flags to the pmem MR where it has the ability of persisting data across power cycles. So registering a persistent access flag to a non-pmem MR will be rejected. Link: https://lore.kernel.org/r/20221206130201.30986-5-lizhijian@fujitsu.com CC: Dan Williams Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 668ce52d5eef477c0def757610768a1a3ccc9785 Author: Li Zhijian Date: Tue Dec 6 21:01:54 2022 +0800 RDMA/rxe: Extend rxe user ABI to support flush This commit extends the rxe user ABI to support the flush operation defined in IBA A19.4.1. These changes are backward compatible with the existing rxe user ABI. The user API request a flush by filling this structure. Link: https://lore.kernel.org/r/20221206130201.30986-4-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 208e3a134b50d95ea3962d7a37b4d8a8f5368376 Author: Li Zhijian Date: Tue Dec 6 21:01:53 2022 +0800 RDMA: Extend RDMA kernel verbs ABI to support flush This commit extends the RDMA kernel verbs ABI to support the flush operation defined in IBA A19.4.1. These changes are backward compatible with the existing RDMA kernel verbs ABI. It makes device/HCA support new FLUSH attributes/capabilities, and it also makes memory region support new FLUSH access flags. Users can use ibv_reg_mr(3) to register flush access flags. Only the access flags also supported by device's capabilities can be registered successfully. Once registered successfully, it means the MR is flushable. Similarly, A flushable MR should also have one or both of GLOBAL_VISIBILITY and PERSISTENT attributes/capabilities like device/HCA. Link: https://lore.kernel.org/r/20221206130201.30986-3-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 0c17da492dc6c33cc5b99633adb4bd7b2587153c Author: Li Zhijian Date: Tue Dec 6 21:01:52 2022 +0800 RDMA: Extend RDMA user ABI to support flush This commit extends the RDMA user ABI to support the flush operation defined in IBA A19.4.1. These changes are backward compatible with the existing RDMA user ABI. Link: https://lore.kernel.org/r/20221206130201.30986-2-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit 689c5421bfe0eac65526bd97a466b9590a6aad3c Author: Bob Pearson Date: Thu Dec 8 15:09:46 2022 -0600 RDMA/rxe: Fix incorrect responder length checking The code in rxe_resp.c at check_length() is incorrect as it compares pkt->opcode an 8 bit value against various mask bits which are all higher than 256 so nothing is ever reported. This patch rewrites this to compare against pkt->mask which is correct. However this now exposes another error. For UD send packets the value of the pmtu cannot be determined from qp->mtu. All that is required here is to later check if the payload fits into the posted receive buffer in that case. Fixes: 837a55847ead ("RDMA/rxe: Implement packet length validation on responder") Link: https://lore.kernel.org/r/20221208210945.28607-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Reviewed-by: Daisuke Matsuda Signed-off-by: Jason Gunthorpe commit afc70ccb962861e068e04c6089827493f5160a0a Author: Daniel Bristot de Oliveira Date: Fri Nov 11 16:53:07 2022 +0100 Documentation/rv: Add verification/rv man pages Add man pages for the rv command line, using the same scheme we used in rtla. Link: https://lkml.kernel.org/r/e841d7cfbdfc3ebdaf7cbd40278571940145d829.1668180100.git.bristot@kernel.org Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 6d60f89691fc979e55b88508f4cfa8f6b4c56eac Author: Daniel Bristot de Oliveira Date: Fri Nov 11 16:53:06 2022 +0100 tools/rv: Add in-kernel monitor interface Add the ability to control and trace in-kernel monitors. This is a generic interface, it will check for existing monitors and enable standard setup, like enabling reactors. For example: # rv list wip wakeup in preemptive per-cpu testing monitor. [OFF] wwnr wakeup while not running per-task testing model. [OFF] # rv mon wwnr --help rv version 6.1.0-rc4: help usage: rv mon wwnr [-h] [-q] [-r reactor] [-s] [-v] -h/--help: print this menu and the reactor list -r/--reactor 'reactor': enables the 'reactor' -s/--self: when tracing (-t), also trace rv command -t/--trace: trace monitor's event -v/--verbose: print debug messages available reactors: nop printk panic # rv mon wwnr --trace -PID [CPU] TYPE ID STATE x EVENT -> NEXT_STATE FINAL | | | | | | | | | rv-3613 [001] event 3613 running x switch_out -> not_running Y sshd-1248 [005] event 1248 running x switch_out -> not_running Y -0 [005] event 71 not_running x wakeup -> not_running Y -0 [005] event 71 not_running x switch_in -> running N kcompactd0-71 [005] event 71 running x switch_out -> not_running Y -0 [000] event 860 not_running x wakeup -> not_running Y -0 [000] event 860 not_running x switch_in -> running N systemd-oomd-860 [000] event 860 running x switch_out -> not_running Y -0 [000] event 860 not_running x wakeup -> not_running Y -0 [000] event 860 not_running x switch_in -> running N systemd-oomd-860 [000] event 860 running x switch_out -> not_running Y -0 [005] event 71 not_running x wakeup -> not_running Y -0 [005] event 71 not_running x switch_in -> running N kcompactd0-71 [005] event 71 running x switch_out -> not_running Y -0 [000] event 860 not_running x wakeup -> not_running Y -0 [000] event 860 not_running x switch_in -> running N systemd-oomd-860 [000] event 860 running x switch_out -> not_running Y -0 [001] event 3613 not_running x wakeup -> not_running Y Link: https://lkml.kernel.org/r/1e57547e3acadda6e23949b2672c89e76ec2ec42.1668180100.git.bristot@kernel.org Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4bc4b131d44c8ead00130fae678ff6c3417d7e13 Author: Daniel Bristot de Oliveira Date: Fri Nov 11 16:53:05 2022 +0100 rv: Add rv tool This is the (user-space) runtime verification tool, named rv. This tool aims to be the interface for in-kernel rv monitors, as well as the home for monitors in user-space (online asynchronous), and in *eBPF. The tool receives a command as the first argument, the current commands are: list - list all available monitors mon - run a given monitor Each monitor is an independent piece of software inside the tool and can have their own arguments. There is no monitor implemented in this patch, it only adds the basic structure of the tool, based on rtla. # rv --help rv version 6.1.0-rc4: help usage: rv command [-h] [command_options] -h/--help: print this menu command: run one of the following command: list: list all available monitors mon: run a monitor [command options]: each command has its own set of options run rv command -h for further information *dot2bpf is the next patch set, depends on this, doing cleanups. Link: https://lkml.kernel.org/r/fb51184f3b95aea0d7bfdc33ec09f4153aee84fa.1668180100.git.bristot@kernel.org Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4c6874374859d89aa6a75019bb0a913369e472c9 Author: John Kacur Date: Mon Nov 7 09:43:13 2022 -0500 rtla: Fix exit status when returning from calls to usage() rtla_usage(), osnoise_usage() and timerlat_usage() all exit with an error status. However when these are called from help, they should exit with a non-error status. Fix this by passing the exit status to the functions. Note, although we remove the subsequent call to exit after calling usage, we leave it in at the end of a function to suppress the compiler warning "control reaches end of a non-void function". Link: https://lkml.kernel.org/r/20221107144313.22470-1-jkacur@redhat.com Signed-off-by: John Kacur Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4c587a982603d7e7e751b4925809a1512099a690 Author: Ladislav Michl Date: Thu Dec 8 12:25:57 2022 +0100 MIPS: OCTEON: warn only once if deprecated link status is being used Avoid flooding kernel log with warnings. Fixes: 2c0756d306c2 ("MIPS: OCTEON: warn if deprecated link status is being used") Signed-off-by: Ladislav Michl Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit ee9ef11bd2a59c2fefaa0959e5efcdf040d7c654 Author: Anastasia Belova Date: Fri Dec 9 13:05:50 2022 +0300 MIPS: BCM63xx: Add check for NULL for clk in clk_enable Check clk for NULL before calling clk_enable_unlocked where clk is dereferenced. There is such check in other implementations of clk_enable. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") Signed-off-by: Anastasia Belova Reviewed-by: Philippe Mathieu-Daudé Acked-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer commit 03871060e458e1d8bdc37a245c22ba842000c87b Author: Alexander Stein Date: Thu Dec 8 15:08:40 2022 +0100 dt-bindings: lcdif: Fix constraints for imx8mp i.MX8MP uses 3 clocks, so soften the restrictions for clocks & clock-names. This SoC requires a power-domain for this peripheral to use. Add it as a required property. Fixes: f5419cb0743f ("dt-bindings: lcdif: Add compatible for i.MX8MP") Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20221208140840.3227035-1-alexander.stein@ew.tq-group.com Signed-off-by: Rob Herring commit 0bf99c1f066cef596b6fa668676ccba09f86fea1 Author: Rob Herring Date: Wed Dec 7 14:44:06 2022 -0600 media: dt-bindings: atmel,isc: Drop unneeded unevaluatedProperties The 'port' node schema has both 'additionalProperties' and 'unevaluatedProperties', but only one is necessary. 'additionalProperties' works here, so drop 'unevaluatedProperties' and move 'additionalProperties' next to the $ref. Link: https://lore.kernel.org/r/20221207204406.2810864-1-robh@kernel.org Signed-off-by: Rob Herring commit 1d4624cd72b912b2680c08d0be48338a1629a858 Author: Alex Deucher Date: Mon Nov 21 15:52:19 2022 -0500 drm/amdgpu: handle polaris10/11 overlap asics (v2) Some special polaris 10 chips overlap with the polaris11 DID range. Handle this properly in the driver. v2: use local flags for other function calls. Acked-by: Luben Tuikov Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 81d0bcf9900932633d270d5bc4a54ff599c6ebdb Author: Alex Deucher Date: Wed Dec 7 11:08:53 2022 -0500 drm/amdgpu: make display pinning more flexible (v2) Only apply the static threshold for Stoney and Carrizo. This hardware has certain requirements that don't allow mixing of GTT and VRAM. Newer asics do not have these requirements so we should be able to be more flexible with where buffers end up. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2270 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2291 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2255 Acked-by: Luben Tuikov Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2165359b7ed4e0b93fc23f49ede38d76e91fffe1 Author: Colin Ian King Date: Thu Dec 8 12:18:54 2022 +0000 drm/amd/display: Fix spelling mistake: "dram_clk_chanage" -> "dram_clk_change" There is a spelling mistake in the struct field dram_clk_chanage. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 6ff8ca3f93d3cd2a77f051d2d971cf3638d39546 Author: Qinglin Pan Date: Mon Nov 28 10:36:43 2022 +0800 riscv: mm: call best_map_size many times during linear-mapping Modify the best_map_size function to give map_size many times instead of only once, so a memory region can be mapped by both PMD_SIZE and PAGE_SIZE. Signed-off-by: Qinglin Pan Reviewed-by: Andrew Jones Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20221128023643.329091-1-panqinglin2020@iscas.ac.cn Signed-off-by: Palmer Dabbelt commit d4d4c6fbae3837623708594a7499f40673fb0692 Author: Umesh Nerlige Ramappa Date: Wed Nov 23 15:53:42 2022 -0800 drm/i915/perf: Do not parse context image for HSW An earlier commit introduced a mechanism to parse the context image to find the OA context control offset. This resulted in an NPD on haswell when gem_context was passed into i915_perf_open_ioctl params. Haswell does not support logical ring contexts, so ensure that the context image is parsed only for platforms with logical ring contexts and also validate lrc_reg_state. v2: Fix build failure v3: Fix checkpatch error Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7432 Fixes: a5c3a3cbf029 ("drm/i915/perf: Determine gen12 oa ctx offset at runtime") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20221123235342.713068-1-umesh.nerlige.ramappa@intel.com (cherry picked from commit 95c713d722017b26e301303713d638e0b95b1f68) Signed-off-by: Rodrigo Vivi commit 449a0ef584d42ed24b7432c899863eaabe2583b5 Author: Miaoqian Lin Date: Wed Dec 7 15:29:09 2022 +0400 drm/i915: Fix documentation for intel_uncore_forcewake_put__locked intel_uncore_forcewake_put__locked() is used to release a reference. Fixes: a6111f7b6604 ("drm/i915: Reduce locking in execlist command submission") Signed-off-by: Miaoqian Lin Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20221207112909.2655251-1-linmq006@gmail.com (cherry picked from commit 955f4d7176eb154db587ae162ec2b392dc8d5f27) Signed-off-by: Rodrigo Vivi commit 2c1da39008fee00596ed33baeacaffa0dc62df25 Author: Matt Roper Date: Mon Nov 28 15:30:10 2022 -0800 drm/i915/gt: Correct kerneldoc for intel_gt_mcr_wait_for_reg() The kerneldoc function name was not updated when this function was converted to a non-fw form. Fixes: 41f425adbce9 ("drm/i915/gt: Manage uncore->lock while waiting on MCR register") Reported-by: kernel test robot Signed-off-by: Matt Roper Reviewed-by: Balasubramani Vivekanandan Link: https://patchwork.freedesktop.org/patch/msgid/20221128233014.4000136-2-matthew.d.roper@intel.com (cherry picked from commit 03b713d029bd17a1ed426590609af79843db95e2) Signed-off-by: Rodrigo Vivi commit 3282a549cf9b300e2d1b007925ed007ab24e4131 Author: Daisuke Matsuda Date: Fri Dec 9 13:59:26 2022 +0900 RDMA/rxe: Fix oops with zero length reads The commit 686d348476ee ("RDMA/rxe: Remove unnecessary mr testing") causes a kernel crash. If responder get a zero-byte RDMA Read request, qp->resp.mr is not set in check_rkey() (see IBA C9-88). The mr is NULL in this case, and a NULL pointer dereference occurs as shown below. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 3622 Comm: python3 Kdump: loaded Not tainted 6.1.0-rc3+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:__rxe_put+0xc/0x60 [rdma_rxe] Code: cc cc cc 31 f6 e8 64 36 1b d3 41 b8 01 00 00 00 44 89 c0 c3 cc cc cc cc 41 89 c0 eb c1 90 0f 1f 44 00 00 41 54 b8 ff ff ff ff 0f c1 47 10 83 f8 01 74 11 45 31 e4 85 c0 7e 20 44 89 e0 41 5c RSP: 0018:ffffb27bc012ce78 EFLAGS: 00010246 RAX: 00000000ffffffff RBX: ffff9790857b0580 RCX: 0000000000000000 RDX: ffff979080fe145a RSI: 000055560e3e0000 RDI: 0000000000000000 RBP: ffff97909c7dd800 R08: 0000000000000001 R09: e7ce43d97f7bed0f R10: ffff97908b29c300 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff97908b29c300 R15: 0000000000000000 FS: 00007f276f7bd740(0000) GS:ffff9792b5c80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000114230002 CR4: 0000000000060ee0 Call Trace: read_reply+0xda/0x310 [rdma_rxe] rxe_responder+0x82d/0xe50 [rdma_rxe] do_task+0x84/0x170 [rdma_rxe] tasklet_action_common.constprop.0+0xa7/0x120 __do_softirq+0xcb/0x2ac do_softirq+0x63/0x90 Support a NULL mr during read_reply() Fixes: 686d348476ee ("RDMA/rxe: Remove unnecessary mr testing") Fixes: b5f9a01fae42 ("RDMA/rxe: Fix mr leak in RESPST_ERR_RNR") Link: https://lore.kernel.org/r/20221209045926.531689-1-matsuda-daisuke@fujitsu.com Link: https://lore.kernel.org/r/20221202145713.13152-1-lizhijian@fujitsu.com Signed-off-by: Daisuke Matsuda Signed-off-by: Li Zhijian Reviewed-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit d69e8c63fcbbf695ff7ff2c6d26efead23cfbb3a Merge: 6cfe7bd0dfd33 76dcd734eca23 Author: Jason Gunthorpe Date: Fri Dec 9 15:52:17 2022 -0400 Merge tag 'v6.1-rc8' into rdma.git for-next For dependencies in following patches Signed-off-by: Jason Gunthorpe commit d6c55c0a20e5059abdde81713ddf6324a946eb3c Author: Jason Gunthorpe Date: Wed Dec 7 16:44:43 2022 -0400 iommufd: Change the order of MSI setup Eric points out this is wrong for the rare case of someone using allow_unsafe_interrupts on ARM. We always have to setup the MSI window in the domain if the iommu driver asks for it. Move the iommu_get_msi_cookie() setup to the top of the function and always do it, regardless of the security mode. Add checks to iommufd_device_setup_msi() to ensure the driver is not doing something incomprehensible. No current driver will set both a HW and SW MSI window, or have more than one SW MSI window. Fixes: e8d57210035b ("iommufd: Add kAPI toward external drivers for physical devices") Link: https://lore.kernel.org/r/3-v1-0362a1a1c034+98-iommufd_fixes1_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: Eric Auger Signed-off-by: Jason Gunthorpe commit a26fa392068d1dcdf781397b7a7dd908dd68f030 Author: Jason Gunthorpe Date: Wed Dec 7 16:44:42 2022 -0400 iommufd: Improve a few unclear bits of code Correct a few items noticed late in review: - We should assert that the math in batch_clear_carry() doesn't underflow - user->locked should be -1 not 0 sicne we just did mmput - npages should not have been recalculated, it already has that value No functional change. Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") Link: https://lore.kernel.org/r/2-v1-0362a1a1c034+98-iommufd_fixes1_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Eric Auger Reported-by: Binbin Wu Signed-off-by: Jason Gunthorpe commit c9b8a83a8f2dca9f82288a621595a6a5970cdc5e Author: Jason Gunthorpe Date: Wed Dec 7 16:44:41 2022 -0400 iommufd: Fix comment typos Repair some typos in comments that were noticed late in the review cycle. Fixes: f394576eb11d ("iommufd: PFN handling for iopt_pages") Link: https://lore.kernel.org/r/1-v1-0362a1a1c034+98-iommufd_fixes1_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Eric Auger Reported-by: Binbin Wu Signed-off-by: Jason Gunthorpe commit 5e57aaa8b6ec038940c2258b803c53f08a65d1f0 Author: Randy Dunlap Date: Thu Dec 8 16:20:16 2022 -0800 clk: nomadik: correct struct name kernel-doc warning Use the correct struct name for the kernel-doc notation to prevent a kernel-doc warning: clk-nomadik.c:148: warning: expecting prototype for struct clk_pll1. Prototype was for struct clk_pll instead Fixes: ef6eb322ce57 ("clk: nomadik: implement the Nomadik clocks properly") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Mauro Carvalho Chehab Cc: Linus Walleij Cc: linux-arm-kernel@lists.infradead.org Cc: Michael Turquette Cc: Stephen Boyd Cc: linux-clk@vger.kernel.org Link: https://lore.kernel.org/r/20221209002016.14776-1-rdunlap@infradead.org Signed-off-by: Stephen Boyd commit f3212ad5b7e93c002bd2dbe552c2b0b0033317ff Author: Donald Hunter Date: Fri Dec 9 11:24:01 2022 +0000 docs/bpf: Add documentation for BPF_MAP_TYPE_SK_STORAGE Add documentation for the BPF_MAP_TYPE_SK_STORAGE including kernel version introduced, usage and examples. Signed-off-by: Donald Hunter Acked-by: David Vernet Link: https://lore.kernel.org/r/20221209112401.69319-1-donald.hunter@gmail.com Signed-off-by: Alexei Starovoitov commit 69af4bcaa08d06fd4d788a7f7193fb3c40ac6aba Author: William Breathitt Gray Date: Tue Nov 22 02:10:59 2022 -0500 regmap-irq: Add handle_mask_sync() callback Provide a public callback handle_mask_sync() that drivers can use when they have more complex IRQ masking logic. The default implementation is regmap_irq_handle_mask_sync(), used if the chip doesn't provide its own callback. Cc: Mark Brown Signed-off-by: William Breathitt Gray Link: https://lore.kernel.org/r/e083474b3d467a86e6cb53da8072de4515bd6276.1669100542.git.william.gray@linaro.org Signed-off-by: Mark Brown commit 3cf241c3d56ff19f5192cb42a025bc6582b6e8fa Author: Rob Herring Date: Fri Dec 9 11:16:43 2022 -0600 spi: dt-bindings: Convert Synquacer SPI to DT schema Convert the Socionext Synquacer SPI binding to DT format. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20221209171644.3351787-1-robh@kernel.org Signed-off-by: Mark Brown commit 577cc1434e4cc1342c3df6d6a3c85136ab335c81 Author: Roberto Sassu Date: Fri Dec 9 09:29:35 2022 +0100 lsm: Fix description of fs_context_parse_param The fs_context_parse_param hook already has a description, which seems the right one according to the code. Fixes: 8eb687bc8069 ("lsm: Add/fix return values in lsm_hooks.h and fix formatting") Signed-off-by: Roberto Sassu Signed-off-by: Paul Moore commit fd3dc56253acbe9c641a66d312d8393cd55eb04c Author: Steven Rostedt (Google) Date: Fri Dec 9 10:52:47 2022 -0500 ftrace/x86: Add back ftrace_expected for ftrace bug reports After someone reported a bug report with a failed modification due to the expected value not matching what was found, it came to my attention that the ftrace_expected is no longer set when that happens. This makes for debugging the issue a bit more difficult. Set ftrace_expected to the expected code before calling ftrace_bug, so that it shows what was expected and why it failed. Link: https://lore.kernel.org/all/CA+wXwBQ-VhK+hpBtYtyZP-NiX4g8fqRRWithFOHQW-0coQ3vLg@mail.gmail.com/ Link: https://lore.kernel.org/linux-trace-kernel/20221209105247.01d4e51d@gandalf.local.home Cc: Masami Hiramatsu Cc: Andrew Morton Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: "x86@kernel.org" Cc: Borislav Petkov Cc: Ingo Molnar Cc: stable@vger.kernel.org Fixes: 768ae4406a5c ("x86/ftrace: Use text_poke()") Signed-off-by: Steven Rostedt (Google) commit 18a207849218d8c15072f449e6d0b901262290c9 Merge: ebe11732838f3 83571a4389039 Author: Thomas Gleixner Date: Fri Dec 9 16:41:58 2022 +0100 Merge tag 'timers-v6.2-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevent/source driver updates from Daniel Lezcano: - Add DT bindings for the Rockchip rk3128 timer (Johan Jonker) - Change the DT bindings for the npcm7xx timer in order to specify multiple clocks and enable the clock for the timer1 on WPCM450 (Jonathan Neuschäfer) - Fix the timer duration being too long the ARM architected timer in order to prevent an integer overflow leading to a negative value and an immediate interruption (Joe Korty) - Fix an unused pointer warning reported by lkp and some cleanups in the timer TI dm (Tony Lindgren) - Fix a missing call to clk_disable_unprepare() in the error path at init time on the timer TI dm (Yang Yingliang) - Use kstrtobool() instead of strtobool() in the ARM architected timer (Christophe JAILLET) - Add DT bindings for r8a779g0 on Renesas platform (Wolfram Sang) Link: https://lore.kernel.org/all/3c4c3bb2-b849-0c87-0948-8a36984bdde4@linaro.org commit 45be2ad007a9c6bea70249c4cf3e4905afe4caeb Author: Nathan Chancellor Date: Tue Nov 8 17:03:07 2022 -0700 x86/vdso: Conditionally export __vdso_sgx_enter_enclave() Recently, ld.lld moved from '--undefined-version' to '--no-undefined-version' as the default, which breaks building the vDSO when CONFIG_X86_SGX is not set: ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined __vdso_sgx_enter_enclave is only included in the vDSO when CONFIG_X86_SGX is set. Only export it if it will be present in the final object, which clears up the error. Fixes: 8466436952017 ("x86/vdso: Implement a vDSO for Intel SGX enclave call") Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Gleixner Reviewed-by: Nick Desaulniers Link: https://github.com/ClangBuiltLinux/linux/issues/1756 Link: https://lore.kernel.org/r/20221109000306.1407357-1-nathan@kernel.org commit 1f3868f06855c97a4954c99b36f3fc9eb8f60326 Author: Jan Kara Date: Thu Dec 8 13:03:30 2022 +0100 udf: Fix extending file within last block When extending file within last block it can happen that the extent is already rounded to the blocksize and thus contains the offset we want to grow up to. In such case we would mistakenly expand the last extent and make it one block longer than it should be, exposing unallocated block in a file and causing data corruption. Fix the problem by properly detecting this case and bailing out. CC: stable@vger.kernel.org Signed-off-by: Jan Kara commit 16d0556568148bdcaa45d077cac9f8f7077cf70a Author: Jan Kara Date: Wed Dec 7 18:17:34 2022 +0100 udf: Discard preallocation before extending file with a hole When extending file with a hole, we tried to preserve existing preallocation for the file. However that is not very useful and complicates code because the previous extent may need to be rounded to block boundary as well (which we forgot to do thus causing data corruption for sequence like: xfs_io -f -c "pwrite 0x75e63 11008" -c "truncate 0x7b24b" \ -c "truncate 0xabaa3" -c "pwrite 0xac70b 22954" \ -c "pwrite 0x93a43 11358" -c "pwrite 0xb8e65 52211" file with 512-byte block size. Just discard preallocation before extending file to simplify things and also fix this data corruption. CC: stable@vger.kernel.org Signed-off-by: Jan Kara commit 6ad53f0f71c52871202a7bf096feb2c59db33fc5 Author: Jan Kara Date: Wed Dec 7 17:34:33 2022 +0100 udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size If rounded block-rounded i_lenExtents matches block rounded i_size, there are no preallocation extents. Do not bother walking extent linked list. CC: stable@vger.kernel.org Signed-off-by: Jan Kara commit cfe4c1b25dd6d2f056afc00b7c98bcb3dd0b1fc3 Author: Jan Kara Date: Wed Dec 7 17:25:10 2022 +0100 udf: Fix preallocation discarding at indirect extent boundary When preallocation extent is the first one in the extent block, the code would corrupt extent tree header instead. Fix the problem and use udf_delete_aext() for deleting extent to avoid some code duplication. CC: stable@vger.kernel.org Signed-off-by: Jan Kara commit ee0b089d660021792e4ab4dda191b097ce1e964f Author: Kai Vehmanen Date: Fri Dec 9 12:18:22 2022 +0200 ALSA: hda/hdmi: fix stream-id config keep-alive for rt suspend When the new style KAE keep-alive implementation is used on compatible Intel hardware, the clocks are maintained when codec is in D3. The generic code in hda_cleanup_all_streams() can however interfere with generation of audio samples in this mode, by setting the stream and channel ids to zero. To get full benefit of the keepalive, set the new no_stream_clean_at_suspend quirk bit on affected Intel hardware. When this bit is set, stream cleanup is skipped in hda_call_codec_suspend(). Special handling is needed for the case when system goes to suspend. The stream id programming can be lost in this case. This will also cause codec->cvt_setups to be out of sync. Handle this by implementing custom suspend/resume handlers. If keep-alive is active for any converter, set the quirk flags no_stream_clean_at_suspend and forced_resume. Upon resume, keepalive programming is restored if needed. Fixes: 15175a4f2bbb ("ALSA: hda/hdmi: add keep-alive support for ADL-P and DG2") Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221209101822.3893675-4-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit b17e7ea041d8b565063632501ca4597afd105102 Author: Kai Vehmanen Date: Fri Dec 9 12:18:21 2022 +0200 ALSA: hda/hdmi: set default audio parameters for KAE silent-stream If the stream-id is zero, the keep-alive (KAE) will only ensure clock is generated, but no audio samples are sent over display link. This happens before first real audio stream is played out to a newly connected receiver. Reuse the code in silent_stream_enable() to set up stream parameters to sane defaults values, also when using the newer keep-alive flow. Fixes: 15175a4f2bbb ("ALSA: hda/hdmi: add keep-alive support for ADL-P and DG2") Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Tested-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20221209101822.3893675-3-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit ada261b690ecd5c2f55f0c51bdf11d852a4561a6 Author: Kai Vehmanen Date: Fri Dec 9 12:18:20 2022 +0200 ALSA: hda/hdmi: fix i915 silent stream programming flow The i915 display codec may not successfully transition to normal audio streaming mode, if the stream id is programmed while codec is actively transmitting data. This can happen when silent stream is enabled in KAE mode. Fix the issue by implementing a i915 specific programming flow, where the silent streaming is temporarily stopped, a small delay is applied to ensure display codec becomes idle, and then proceed with reprogramming the stream ID. Fixes: 15175a4f2bbb ("ALSA: hda/hdmi: add keep-alive support for ADL-P and DG2") Link: https://gitlab.freedesktop.org/drm/intel/-/issues/7353 Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Tested-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20221209101822.3893675-2-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 01de1123322e4fe1bbd0fcdf0982511b55519c03 Author: Yuan Can Date: Wed Dec 7 08:54:10 2022 +0000 drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() If vp alloc failed in qlcnic_sriov_init(), all previously allocated vp needs to be freed. Fixes: f197a7aa6288 ("qlcnic: VF-PF communication channel implementation") Signed-off-by: Yuan Can Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit a137f3f27f9290933fe7e40e6dc8a445781c31a2 Author: Gaosheng Cui Date: Wed Dec 7 16:34:13 2022 +0800 net: stmmac: fix possible memory leak in stmmac_dvr_probe() The bitmap_free() should be called to free priv->af_xdp_zc_qps when create_singlethread_workqueue() fails, otherwise there will be a memory leak, so we add the err path error_wq_init to fix it. Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Signed-off-by: Gaosheng Cui Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit f150b63f3fa5fdd81e0dd6151e8850268e29438c Author: Zhang Changzhong Date: Wed Dec 7 16:31:59 2022 +0800 net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() The skb allocated by stmmac_test_get_arp_skb() hasn't been released in some error handling case, which will lead to a memory leak. Fix this up by adding kfree_skb() to release skb. Compile tested only. Fixes: 5e3fb0a6e2b3 ("net: stmmac: selftests: Implement the ARP Offload test") Signed-off-by: Zhang Changzhong Signed-off-by: David S. Miller commit 453de3eb08c4b7e31b3019a4b0cc3ebce51a6219 Author: Linus Walleij Date: Sat Dec 3 10:15:18 2022 +0100 crypto: ux500/cryp - delete driver It turns out we can just modify the newer STM32 CRYP driver to be used with Ux500 and now that we have done that, delete the old and sparsely maintained Ux500 CRYP driver. Cc: Lionel Debieve Cc: Maxime Coquelin Cc: Alexandre Torgue Signed-off-by: Linus Walleij Signed-off-by: Herbert Xu commit 0b496efbd2d00f658dbf906882d935e7fa3dfd03 Author: Linus Walleij Date: Sat Dec 3 10:15:17 2022 +0100 crypto: stm32/cryp - enable for use with Ux500 This adds a few small quirks to handle the differences between the STM32 and Ux500 cryp blocks. The following differences are handled with special bool switch bits in the capabilities: - The main difference is that some registers are removed, so we add register offsets for all registers in the per-variant data. Then we assign the right offsets for Ux500 vs the STM32 variants. - The Ux500 does not support the aeads algorithms; gcm(aes) and ccm(aes). Avoid registering them when running on Ux500. - The Ux500 has a special "linear" key format and does some elaborare bit swizzling of the key bits before writing them into the key registers. This is written as an "application note" inside the DB8500 design specification, and seems to be the result of some mishap when assigning the data lines to register bits. (STM32 has clearly fixed this.) - The Ux500 does not have the KP "key prepare" bit in the CR register. Instead, we need to set the KSE bit, "key schedule encryption" bit which does the same thing but is in bit 11 rather than being a special "algorithm type" as on STM32. The algorithm must however be specified as AES ECB while doing this. - The Ux500 cannot just read out IV registers, we need to set the KEYRDEN "key read enable" bit, as this protects not just the key but also the IV from being read out. Enable this bit before reading out the IV and disable it afterwards. Cc: Maxime Coquelin Cc: Alexandre Torgue Acked by: Lionel Debieve Signed-off-by: Linus Walleij Signed-off-by: Herbert Xu commit fe867538c1620738bda5328a14179a3c2bc95ab1 Author: Linus Walleij Date: Sat Dec 3 10:15:16 2022 +0100 crypto: stm32 - enable drivers to be used on Ux500 The Ux500 cryp and hash drivers are older versions of the hardware managed by the stm32 driver. Instead of trying to improve the Ux500 cryp and hash drivers, start to switch over to the modern and more well-maintained STM32 drivers. Cc: Maxime Coquelin Cc: Alexandre Torgue Acked-by: Lionel Debieve Signed-off-by: Linus Walleij Signed-off-by: Herbert Xu commit 6c013679eb5c7e0b09cbcb64276f6dd97b473d12 Author: Linus Walleij Date: Sat Dec 3 10:15:15 2022 +0100 dt-bindings: crypto: Let STM32 define Ux500 CRYP This adds device tree bindings for the Ux500 CRYP block as a compatible in the STM32 CRYP bindings. The Ux500 CRYP binding has been used for ages in the kernel device tree for Ux500 but was never documented, so fill in the gap by making it a sibling of the STM32 CRYP block, which is what it is. The relationship to the existing STM32 CRYP block is pretty obvious when looking at the register map, and I have written patches to reuse the STM32 CRYP driver on the Ux500. The two properties added are DMA channels and power domain. Power domains are a generic SoC feature and the STM32 variant also has DMA channels. Cc: devicetree@vger.kernel.org Cc: Rob Herring Cc: Krzysztof Kozlowski Cc: Lionel Debieve Cc: Maxime Coquelin Cc: Alexandre Torgue Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij Signed-off-by: Herbert Xu commit 9f6ec8dc574efb7f4f3d7ee9cd59ae307e78f445 Author: Xiongfeng Wang Date: Fri Dec 2 21:22:34 2022 +0800 hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path. Fixes: ef5d862734b8 ("[PATCH] Add Geode HW RNG driver") Signed-off-by: Xiongfeng Wang Signed-off-by: Herbert Xu commit ecadb5b0111ea19fc7c240bb25d424a94471eb7d Author: Xiongfeng Wang Date: Fri Dec 2 21:22:33 2022 +0800 hwrng: amd - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error path. Fixes: 96d63c0297cc ("[PATCH] Add AMD HW RNG driver") Signed-off-by: Xiongfeng Wang Signed-off-by: Herbert Xu commit 18daae5b0c41bf54af5f162a3e205858c9771400 Author: Herbert Xu Date: Fri Dec 2 17:21:05 2022 +0800 crypto: qce - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit d887dec105cdeda6b8da0e84d96c7a07d80269bc Author: Herbert Xu Date: Fri Dec 2 17:21:03 2022 +0800 crypto: octeontx2 - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 0a55f4e38556f7e59b0f30fac0751e3a04be44c2 Author: Herbert Xu Date: Fri Dec 2 17:21:01 2022 +0800 crypto: octeontx - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit be75969c81d9a6e13487e1c043e62ed5432d9fa1 Author: Herbert Xu Date: Fri Dec 2 17:20:59 2022 +0800 crypto: keembay - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit b2e2e2da7b4f62c54ce0d6a66c54e9fb05a8d514 Author: Herbert Xu Date: Fri Dec 2 17:20:57 2022 +0800 crypto: safexcel - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 80b61baca4c8698139881f41473e652bedc65a73 Author: Herbert Xu Date: Fri Dec 2 17:20:55 2022 +0800 crypto: hisilicon/hpre - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit e055bffaa390042d73fed56a0ef9bfe71a675614 Author: Herbert Xu Date: Fri Dec 2 17:20:53 2022 +0800 crypto: chelsio - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 07547fa73e4645363165e662f50427a7d302dcf1 Author: Herbert Xu Date: Fri Dec 2 17:20:51 2022 +0800 crypto: ccree - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 99c6b20edfc031610240afca97ba9be5ec6f5750 Author: Herbert Xu Date: Fri Dec 2 17:20:49 2022 +0800 crypto: ccp - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 1c64a7e1f931821acadf964c5ddb0dc41abf9e20 Author: Herbert Xu Date: Fri Dec 2 17:20:47 2022 +0800 crypto: cavium - Set DMA alignment explicitly This driver has been implicitly relying on kmalloc alignment to be sufficient for DMA. This may no longer be the case with upcoming arm64 changes. This patch changes it to explicitly request DMA alignment from the Crypto API. Signed-off-by: Herbert Xu commit 04ba54e5af8f8f0137b08cb51a0b3a2e1ea46c94 Author: Gaosheng Cui Date: Thu Dec 1 14:25:26 2022 +0800 crypto: img-hash - Fix variable dereferenced before check 'hdev->req' Smatch report warning as follows: drivers/crypto/img-hash.c:366 img_hash_dma_task() warn: variable dereferenced before check 'hdev->req' Variable dereferenced should be done after check 'hdev->req', fix it. Fixes: d358f1abbf71 ("crypto: img-hash - Add Imagination Technologies hw hash accelerator") Fixes: 10badea259fa ("crypto: img-hash - Fix null pointer exception") Signed-off-by: Gaosheng Cui Signed-off-by: Herbert Xu commit a428636d4c827ebe967aa31a83684b4c8e742ed1 Author: Ard Biesheuvel Date: Tue Nov 29 17:48:52 2022 +0100 crypto: arm64/ghash-ce - use frame_push/pop macros consistently Use the frame_push and frame_pop macros to set up the stack frame so that return address protections will be enabled automically when configured. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 489a4a05fe6d544f1f1052d2c6cd5bffbd89ddb6 Author: Ard Biesheuvel Date: Tue Nov 29 17:48:51 2022 +0100 crypto: arm64/crct10dif - use frame_push/pop macros consistently Use the frame_push and frame_pop macros to set up the stack frame so that return address protections will be enabled automically when configured. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7d709af18054bc9e2043499bb35eb1809c2a316f Author: Ard Biesheuvel Date: Tue Nov 29 17:48:50 2022 +0100 crypto: arm64/aes-modes - use frame_push/pop macros consistently Use the frame_push and frame_pop macros to create the stack frames in the AES chaining mode wrappers so that they will get PAC and/or shadow call stack protection when configured. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 67ab02dce3adad3ea399e824b37f8e1c2453449f Author: Ard Biesheuvel Date: Tue Nov 29 17:48:49 2022 +0100 crypto: arm64/aes-neonbs - use frame_push/pop consistently Use the frame_push and frame_pop macros consistently to create the stack frame, so that we will get PAC and/or shadow call stack handling as well when enabled. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 3564f5a2144355cadb4f0c5c14d2bc7fcd2418b9 Author: Herbert Xu Date: Tue Nov 29 17:52:35 2022 +0800 crypto: chelsio - Fix flexible struct array warning This patch fixes the sparse warning about arrays of flexible structures by removing an unnecessary use of them in struct __crypto_ctx. Signed-off-by: Herbert Xu commit 3112d0f1b0b32daac97d170dbc9d3cce69f7ff49 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:23 2022 +0000 crypto: qat - add resubmit logic for decompression The acomp API allows to send requests with a NULL destination buffer. In this case, the algorithm implementation needs to allocate the destination scatter list, perform the operation and return the buffer to the user. For decompression, data is likely to expand and be bigger than the allocated buffer. This implements a re-submission mechanism for decompression requests that is triggered if the destination buffer, allocated by the driver, is not sufficiently big to store the output from decompression. If an overflow is detected when processing the callback for a decompression request with a NULL destination buffer, a workqueue is scheduled. This allocates a new scatter list of size CRYPTO_ACOMP_DST_MAX, now 128KB, creates a new firmware scatter list and resubmits the job to the hardware accelerator. Suggested-by: Herbert Xu Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 5fc8041e56782e4d44682f8c2e4d822817a4dae6 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:22 2022 +0000 crypto: acomp - define max size for destination The acomp API allows to send requests with a NULL destination buffer. In this case, the algorithm implementation needs to allocate the destination scatter list, perform the operation and return the buffer to the user. For decompression, data is likely to expand and be bigger than the allocated buffer. Define the maximum size (128KB) that acomp implementations will allocate for decompression operations as destination buffer when they receive a request with a NULL destination buffer. Suggested-by: Herbert Xu Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 5b14b2b307e4045b38a4961718cbe9c17cef2bf4 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:21 2022 +0000 crypto: qat - enable deflate for QAT GEN4 Enable deflate for QAT GEN4 devices. This adds (1) logic to create configuration entries at probe time for the compression instances for QAT GEN4 devices; (2) the implementation of QAT GEN4 specific compression operations, required since the creation of the compression request template is different between GEN2 and GEN4; and (3) updates to the firmware API related to compression for GEN4. The implementation configures the device to produce data compressed dynamically, optimized for throughput over compression ratio. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 1198ae56c9a520384dcf53f01cd9adecd73751d0 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:20 2022 +0000 crypto: qat - expose deflate through acomp api for QAT GEN2 Add infrastructure for implementing the acomp APIs in the QAT driver and expose the deflate algorithm for QAT GEN2 devices. This adds (1) the compression service which includes logic to create, allocate and handle compression instances; (2) logic to create configuration entries at probe time for the compression instances; (3) updates to the firmware API for allowing the compression service; and; (4) a back-end for deflate that implements the acomp api for QAT GEN2 devices. The implementation configures the device to produce data compressed statically, optimized for throughput over compression ratio. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 93b2f5799cee57814a36882e61ef5f03d5dc5392 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:19 2022 +0000 crypto: qat - rename and relocate GEN2 config function Rename qat_crypto_dev_config() in adf_gen2_dev_config() and relocate it to the newly created file adf_gen2_config.c. This function is specific to QAT GEN2 devices and will be used also to configure the compression service. In addition change the drivers to use the dev_config() in the hardware data structure (which for GEN2 devices now points to adf_gen2_dev_config()), for consistency. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 79d8dbf155d4e670b6ac20acbb6b22f02c728da5 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:18 2022 +0000 crypto: qat - relocate qat_algs_alloc_flags() Move qat_algs_alloc_flags() from qat_crypto.h to qat_bl.h as this will be used also by the compression logic. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 4d76f3880987a00da79f455876488ac3c7343e83 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:17 2022 +0000 crypto: qat - relocate backlog related structures Move the structures qat_instance_backlog and qat_alg_req from qat_crypto.h to qat_algs_send.h since they are not unique to crypto. Both structures will be used by the compression service to support requests with the CRYPTO_TFM_REQ_MAY_BACKLOG flag set. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit cf692906bd61af2eec06a32a83d2a8ec3acf3548 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:16 2022 +0000 crypto: qat - extend buffer list interface The compression service requires an additional pre-allocated buffer for each destination scatter list. Extend the function qat_alg_sgl_to_bufl() to take an additional structure that contains the dma address and the size of the extra buffer which will be appended in the destination FW SGL. The logic that unmaps buffers in qat_alg_free_bufl() has been changed to start unmapping from buffer 0 instead of skipping the initial buffers num_buff - num_mapped_bufs as that functionality was not used in the code. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 36ebc7472afeb58f1eb1d4c1f0546b9e98acea46 Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:15 2022 +0000 crypto: qat - generalize crypto request buffers The structure qat_crypto_request_buffs which contains the source and destination buffer lists and correspondent sizes and dma addresses is also required for the compression service. Rename it as qat_request_buffs and move it to qat_bl.h. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit 3ed330d0dba61d2e08a0eed7aa3d5def3f0c749b Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:14 2022 +0000 crypto: qat - change bufferlist logic interface The functions qat_alg_sgl_to_bufl() and qat_alg_free_bufl() take as argument a qat_crypto_instance and a qat_crypto_request structure. These two structures are used only to get a reference to the adf_accel_dev and qat_crypto_request_buffs. In order to reuse these functions for the compression service, change the signature so that they take adf_accel_dev and qat_crypto_request_buffs. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit b0cd997f35598c4fc01bf22061e1eb88fc10afad Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:13 2022 +0000 crypto: qat - rename bufferlist functions Rename the functions qat_alg_sgl_to_bufl() and qat_alg_free_bufl() as qat_bl_sgl_to_bufl() and qat_bl_free_bufl() after their relocation into the qat_bl module. This commit does not implement any functional change. Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit e9612987e437b7ada686f472c7596686fabecb2b Author: Giovanni Cabiddu Date: Mon Nov 28 12:21:12 2022 +0000 crypto: qat - relocate bufferlist logic Move the logic that maps, unmaps and converts scatterlists into QAT bufferlists from qat_algs.c to a new module, qat_bl. This is to allow reuse of the logic by the data compression service. This commit does not implement any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Wojciech Ziemba Reviewed-by: Adam Guerin Signed-off-by: Herbert Xu commit ae18dcdff0f8d7e84cd3fd9f496518b5e72d185d Author: Yongqiang Liu Date: Wed Dec 7 07:20:45 2022 +0000 net: defxx: Fix missing err handling in dfx_init() When eisa_driver_register() or tc_register_driver() failed, the modprobe defxx would fail with some err log as follows: Error: Driver 'defxx' is already registered, aborting... Fix this issue by adding err hanling in dfx_init(). Fixes: e89a2cfb7d7b5 ("[TC] defxx: TURBOchannel support") Signed-off-by: Yongqiang Liu Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 1933ea365aa7a48ce26bea2ea09c9f7cc48cc668 Author: wangchuanlei Date: Tue Dec 6 20:38:57 2022 -0500 net: openvswitch: Add support to count upcall packets Add support to count upall packets, when kmod of openvswitch upcall to count the number of packets for upcall succeed and failed, which is a better way to see how many packets upcalled on every interfaces. Signed-off-by: wangchuanlei Acked-by: Eelco Chaudron Signed-off-by: David S. Miller commit e47877c7aa821c413b45e05f804819579bdfa1a3 Author: Tejun Heo Date: Tue Dec 6 11:36:32 2022 -1000 rhashtable: Allow rhashtable to be used from irq-safe contexts rhashtable currently only does bh-safe synchronization making it impossible to use from irq-safe contexts. Switch it to use irq-safe synchronization to remove the restriction. v2: Update the lock functions to return the ulong flags value and unlock functions to take the value directly instead of passing around the pointer. Suggested by Linus. Signed-off-by: Tejun Heo Reviewed-by: David Vernet Acked-by: Josh Don Acked-by: Hao Luo Acked-by: Barret Rhoden Cc: Linus Torvalds Signed-off-by: David S. Miller commit ff874dbc4f868af128b412a9bd92637103cf11d7 Author: Wenchao Chen Date: Wed Dec 7 13:19:09 2022 +0800 mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K When the clock is less than 400K, some SD cards fail to initialize because CLK_AUTO is enabled. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Wenchao Chen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221207051909.32126-1-wenchao.chen@unisoc.com Signed-off-by: Ulf Hansson commit 19dafe9c6b86cc15979e514787fc743041ebc08d Author: Jiapeng Chong Date: Fri Dec 9 11:41:34 2022 +0800 mmc: sdhci-of-esdhc: Modify mismatched function name No functional modification involved. drivers/mmc/host/sdhci-of-esdhc.c:243: warning: expecting prototype for _fixup(). Prototype was for esdhc_writel_fixup() instead. drivers/mmc/host/sdhci-of-esdhc.c:117: warning: expecting prototype for _fixup(). Prototype was for esdhc_readl_fixup() instead. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3397 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221209034134.38477-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Ulf Hansson commit 0c35997020c462ab0be8ee8d62919c14f63631f2 Author: ye xingchen Date: Thu Dec 8 11:38:19 2022 +0800 memstick/mspro_block: Convert to use sysfs_emit()/sysfs_emit_at() APIs Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212081138191215291@zte.com.cn Signed-off-by: Ulf Hansson commit b602d00384bdfb8874cc4dcb298fc87cc369630b Merge: 0bdff1152c249 9f3101dca3a7c Author: David S. Miller Date: Fri Dec 9 09:18:08 2022 +0000 Merge branch 'net-sched-retpoline' Pedro Tammela says: ==================== net/sched: retpoline wrappers for tc In tc all qdics, classifiers and actions can be compiled as modules. This results today in indirect calls in all transitions in the tc hierarchy. Due to CONFIG_RETPOLINE, CPUs with mitigations=on might pay an extra cost on indirect calls. For newer Intel cpus with IBRS the extra cost is nonexistent, but AMD Zen cpus and older x86 cpus still go through the retpoline thunk. Known built-in symbols can be optimized into direct calls, thus avoiding the retpoline thunk. So far, tc has not been leveraging this build information and leaving out a performance optimization for some CPUs. In this series we wire up 'tcf_classify()' and 'tcf_action_exec()' with direct calls when known modules are compiled as built-in as an opt-in optimization. We measured these changes in one AMD Zen 4 cpu (Retpoline), one AMD Zen 3 cpu (Retpoline), one Intel 10th Gen CPU (IBRS), one Intel 3rd Gen cpu (Retpoline) and one Intel Xeon CPU (IBRS) using pktgen with 64b udp packets. Our test setup is a dummy device with clsact and matchall in a kernel compiled with every tc module as built-in. We observed a 3-8% speed up on the retpoline CPUs, when going through 1 tc filter, and a 60-100% speed up when going through 100 filters. For the IBRS cpus we observed a 1-2% degradation in both scenarios, we believe the extra branches check introduced a small overhead therefore we added a static key that bypasses the wrapper on kernels not using the retpoline mitigation, but compiled with CONFIG_RETPOLINE. 1 filter: CPU | before (pps) | after (pps) | diff R9 7950X | 5914980 | 6380227 | +7.8% R9 5950X | 4237838 | 4412241 | +4.1% R9 5950X | 4265287 | 4413757 | +3.4% [*] i5-3337U | 1580565 | 1682406 | +6.4% i5-10210U | 3006074 | 3006857 | +0.0% i5-10210U | 3160245 | 3179945 | +0.6% [*] Xeon 6230R | 3196906 | 3197059 | +0.0% Xeon 6230R | 3190392 | 3196153 | +0.01% [*] 100 filters: CPU | before (pps) | after (pps) | diff R9 7950X | 373598 | 820396 | +119.59% R9 5950X | 313469 | 633303 | +102.03% R9 5950X | 313797 | 633150 | +101.77% [*] i5-3337U | 127454 | 211210 | +65.71% i5-10210U | 389259 | 381765 | -1.9% i5-10210U | 408812 | 412730 | +0.9% [*] Xeon 6230R | 415420 | 406612 | -2.1% Xeon 6230R | 416705 | 405869 | -2.6% [*] [*] In these tests we ran pktgen with clone set to 1000. On the 7950x system we also tested the impact of filters if iteration order placement varied, first by compiling a kernel with the filter under test being the first one in the static iteration and then repeating it with being last (of 15 classifiers existing today). We saw a difference of +0.5-1% in pps between being the first in the iteration vs being the last. Therefore we order the classifiers and actions according to relevance per our current thinking. v5->v6: - Address Eric Dumazet suggestions v4->v5: - Rebase v3->v4: - Address Eric Dumazet suggestions v2->v3: - Address suggestions by Jakub, Paolo and Eric - Dropped RFC tag (I forgot to add it on v2) v1->v2: - Fix build errors found by the bots - Address Kuniyuki Iwashima suggestions ==================== Signed-off-by: David S. Miller commit 9f3101dca3a7c69027c65770ac28803768efefa5 Author: Pedro Tammela Date: Tue Dec 6 10:55:13 2022 -0300 net/sched: avoid indirect classify functions on retpoline kernels Expose the necessary tc classifier functions and wire up cls_api to use direct calls in retpoline kernels. Signed-off-by: Pedro Tammela Reviewed-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Signed-off-by: David S. Miller commit 871cf386dd16705b1e08942efd02c58801293d01 Author: Pedro Tammela Date: Tue Dec 6 10:55:12 2022 -0300 net/sched: avoid indirect act functions on retpoline kernels Expose the necessary tc act functions and wire up act_api to use direct calls in retpoline kernels. Signed-off-by: Pedro Tammela Reviewed-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Signed-off-by: David S. Miller commit 7f0e810220e2d985338ecdd907c1598404db251d Author: Pedro Tammela Date: Tue Dec 6 10:55:11 2022 -0300 net/sched: add retpoline wrapper for tc On kernels using retpoline as a spectrev2 mitigation, optimize actions and filters that are compiled as built-ins into a direct call. On subsequent patches we expose the classifiers and actions functions and wire up the wrapper into tc. Signed-off-by: Pedro Tammela Reviewed-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Signed-off-by: David S. Miller commit 2a7d228f1ae78b6eabef5f18bd1a8d2280555628 Author: Pedro Tammela Date: Tue Dec 6 10:55:10 2022 -0300 net/sched: move struct action_ops definition out of ifdef The type definition should be visible even in configurations not using CONFIG_NET_CLS_ACT. Signed-off-by: Pedro Tammela Reviewed-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Signed-off-by: David S. Miller commit 084ca216931ab9313e6fb862c2ec9ec5e0702cd5 Author: Cezary Rojewski Date: Thu Dec 8 15:26:35 2022 +0100 ALSA: hda: Error out if invalid stream is being setup Scenario when snd_hdac_stream_setup_periods() receives an instance of struct hdac_stream with neither ->substream nor ->cstream initialized is invalid. Simultaneously addresses "uninitialized symbol 'dmab'" error reported by Smatch. Fixes: 3e9582267e3a ("ALSA: hda: Interrupt servicing and BDL setup for compress streams") Signed-off-by: Cezary Rojewski Link: https://lore.kernel.org/r/20221208142635.1514944-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai commit a587601b55df505f38b18832d941e47dbbf084ce Merge: 4bf5bf54476df e85b1f5a9769a Author: Takashi Iwai Date: Fri Dec 9 09:50:13 2022 +0100 Merge tag 'asoc-v6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.2 A few more updates for v6.2 which can hopefully go into a later pull request, the bulk of these are fixes, minor cleanups or new board quirks - the one big bit that isn't is support for getting diagnostic data out of the Intel AVS firmwares. commit 44aa5a6dba8283bfda28b1517af4de711c5652a4 Author: Artem Chernyshev Date: Tue Dec 6 09:58:34 2022 +0300 net: vmw_vsock: vmci: Check memcpy_from_msg() vmci_transport_dgram_enqueue() does not check the return value of memcpy_from_msg(). If memcpy_from_msg() fails, it is possible that uninitialized memory contents are sent unintentionally instead of user's message in the datagram to the destination. Return with an error if memcpy_from_msg() fails. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr") Signed-off-by: Artem Chernyshev Reviewed-by: Stefano Garzarella Reviewed-by: Vishnu Dasa Signed-off-by: David S. Miller commit 2afc1fbbdab2aee831561f09f859989dcd5ed648 Author: Oliver Upton Date: Wed Dec 7 21:48:08 2022 +0000 KVM: selftests: Allocate ucall pool from MEM_REGION_DATA MEM_REGION_TEST_DATA is meant to hold data explicitly used by a selftest, not implicit allocations due to the selftests infrastructure. Allocate the ucall pool from MEM_REGION_DATA much like the rest of the selftests library allocations. Fixes: 426729b2cf2e ("KVM: selftests: Add ucall pool based implementation") Signed-off-by: Oliver Upton Message-Id: <20221207214809.489070-5-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit e8b9a055fa0481679132781db574ecb771960f16 Author: Oliver Upton Date: Wed Dec 7 21:48:07 2022 +0000 KVM: arm64: selftests: Align VA space allocator with TTBR0 An interesting feature of the Arm architecture is that the stage-1 MMU supports two distinct VA regions, controlled by TTBR{0,1}_EL1. As KVM selftests on arm64 only uses TTBR0_EL1, the VA space is constrained to [0, 2^(va_bits-1)). This is different from other architectures that allow for addressing low and high regions of the VA space from a single page table. KVM selftests' VA space allocator presumes the valid address range is split between low and high memory based the MSB, which of course is a poor match for arm64's TTBR0 region. Allow architectures to override the default VA space layout. Make use of the override to align vpages_valid with the behavior of TTBR0 on arm64. Signed-off-by: Oliver Upton Message-Id: <20221207214809.489070-4-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit eb5618911af0ac069d2313b289d4c19ca3379401 Merge: 1e79a9e3ab96e 753d734f3f347 Author: Paolo Bonzini Date: Tue Dec 6 12:27:39 2022 -0500 Merge tag 'kvmarm-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.2 - Enable the per-vcpu dirty-ring tracking mechanism, together with an option to keep the good old dirty log around for pages that are dirtied by something other than a vcpu. - Switch to the relaxed parallel fault handling, using RCU to delay page table reclaim and giving better performance under load. - Relax the MTE ABI, allowing a VMM to use the MAP_SHARED mapping option, which multi-process VMMs such as crosvm rely on. - Merge the pKVM shadow vcpu state tracking that allows the hypervisor to have its own view of a vcpu, keeping that state private. - Add support for the PMUv3p5 architecture revision, bringing support for 64bit counters on systems that support it, and fix the no-quite-compliant CHAIN-ed counter support for the machines that actually exist out there. - Fix a handful of minor issues around 52bit VA/PA support (64kB pages only) as a prefix of the oncoming support for 4kB and 16kB pages. - Add/Enable/Fix a bunch of selftests covering memslots, breakpoints, stage-2 faults and access tracking. You name it, we got it, we probably broke it. - Pick a small set of documentation and spelling fixes, because no good merge window would be complete without those. As a side effect, this tag also drags: - The 'kvmarm-fixes-6.1-3' tag as a dependency to the dirty-ring series - A shared branch with the arm64 tree that repaints all the system registers to match the ARM ARM's naming, and resulting in interesting conflicts commit abe2343d37c2b4361547d5d31e17340ff9ec7356 Author: Colin Ian King Date: Wed Dec 7 09:23:14 2022 +0000 xfrm: Fix spelling mistake "oflload" -> "offload" There is a spelling mistake in a NL_SET_ERR_MSG message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Steffen Klassert commit 1de8fda46f87157f920b908792f56ca60297269c Merge: e8a292d6a786c 37d244ad183f4 Author: Steffen Klassert Date: Fri Dec 9 07:47:37 2022 +0100 Merge branch 'mlx5 IPsec packet offload support (Part II)' Leon Romanovsky says: ============ This is second part with implementation of packet offload. ============ Signed-off-by: Steffen Klassert commit 1da18e38cb97e9521e93d63034521a9649524f64 Author: Ye Bin Date: Thu Dec 8 11:34:24 2022 +0800 ext4: fix reserved cluster accounting in __es_remove_extent() When bigalloc is enabled, reserved cluster accounting for delayed allocation is handled in extent_status.c. With a corrupted file system, it's possible for this accounting to be incorrect, dsicovered by Syzbot: EXT4-fs error (device loop0): ext4_validate_block_bitmap:398: comm rep: bg 0: block 5: invalid block bitmap EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 32 with error 28 EXT4-fs (loop0): This should not happen!! Data will be lost EXT4-fs (loop0): Total free blocks count 0 EXT4-fs (loop0): Free/Dirty block details EXT4-fs (loop0): free_blocks=0 EXT4-fs (loop0): dirty_blocks=32 EXT4-fs (loop0): Block reservation details EXT4-fs (loop0): i_reserved_data_blocks=2 EXT4-fs (loop0): Inode 18 (00000000845cd634): i_reserved_data_blocks (1) not cleared! Above issue happens as follows: Assume: sbi->s_cluster_ratio = 16 Step1: Insert delay block [0, 31] -> ei->i_reserved_data_blocks=2 Step2: ext4_writepages mpage_map_and_submit_extent -> return failed mpage_release_unused_pages -> to release [0, 30] ext4_es_remove_extent -> remove lblk=0 end=30 __es_remove_extent -> len1=0 len2=31-30=1 __es_remove_extent: ... if (len2 > 0) { ... if (len1 > 0) { ... } else { es->es_lblk = end + 1; es->es_len = len2; ... } if (count_reserved) count_rsvd(inode, lblk, ...); goto out; -> will return but didn't calculate 'reserved' ... Step3: ext4_destroy_inode -> trigger "i_reserved_data_blocks (1) not cleared!" To solve above issue if 'len2>0' call 'get_rsvd()' before goto out. Reported-by: syzbot+05a0f0ccab4a25626e38@syzkaller.appspotmail.com Fixes: 8fcc3a580651 ("ext4: rework reserved cluster accounting when invalidating pages") Signed-off-by: Ye Bin Reviewed-by: Eric Whitney Link: https://lore.kernel.org/r/20221208033426.1832460-2-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit e4db04f7d3dbbe16680e0ded27ea2a65b10f766a Author: Ye Bin Date: Thu Dec 8 10:32:33 2022 +0800 ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode is needed. Or will lead to inode leak. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221208023233.1231330-5-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit cc12a6f25e07ed05d5825a1664b67a970842b2ca Author: Ye Bin Date: Thu Dec 8 10:32:31 2022 +0800 ext4: allocate extended attribute value in vmalloc area Now, extended attribute value maximum length is 64K. The memory requested here does not need continuous physical addresses, so it is appropriate to use kvmalloc to request memory. At the same time, it can also cope with the situation that the extended attribute will become longer in the future. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221208023233.1231330-3-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 88a51b4f2e65ca4378a81ff0925fad076e82e177 Author: Steven Rostedt (Google) Date: Wed Dec 7 21:29:44 2022 -0500 ktest.pl: Add shell commands to variables Allow variables to execute shell commands. Note, these are processed when they are first seen while parsing the config file. This is useful if you have the same config file used for multiple hosts (as they may be in a git repository). HOSTNAME := ${shell hostname} DEFAULTS IF "${HOSTNAME}" == "frodo" Link: https://lkml.kernel.org/r/20221207212944.277ee850@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 0bdff1152c2496acf29930ec9b3c3cd7790b3f68 Author: Randy Dunlap Date: Tue Dec 6 20:42:57 2022 -0800 net: phy: remove redundant "depends on" lines Delete a few lines of "depends on PHYLIB" since they are inside an "if PHYLIB / endif # PHYLIB" block, i.e., they are redundant and the other 50+ drivers there don't use "depends on PHYLIB" since it is not needed. Signed-off-by: Randy Dunlap Cc: Andrew Lunn Cc: Heiner Kallweit Cc: Russell King Link: https://lore.kernel.org/r/20221207044257.30036-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit b534dc46c8ae0165b1b2509be24dbea4fa9c4011 Author: Willem de Bruijn Date: Wed Dec 7 09:37:01 2022 -0500 net_tstamp: add SOF_TIMESTAMPING_OPT_ID_TCP Add an option to initialize SOF_TIMESTAMPING_OPT_ID for TCP from write_seq sockets instead of snd_una. This should have been the behavior from the start. Because processes may now exist that rely on the established behavior, do not change behavior of the existing option, but add the right behavior with a new flag. It is encouraged to always set SOF_TIMESTAMPING_OPT_ID_TCP on stream sockets along with the existing SOF_TIMESTAMPING_OPT_ID. Intuitively the contract is that the counter is zero after the setsockopt, so that the next write N results in a notification for the last byte N - 1. On idle sockets snd_una == write_seq and this holds for both. But on sockets with data in transmission, snd_una records the unacked offset in the stream. This depends on the ACK response from the peer. A process cannot learn this in a race free manner (ioctl SIOCOUTQ is one racy approach). write_seq records the offset at the last byte written by the process. This is a better starting point. It matches the intuitive contract in all circumstances, unaffected by external behavior. The new timestamp flag necessitates increasing sk_tsflags to 32 bits. Move the field in struct sock to avoid growing the socket (for some common CONFIG variants). The UAPI interface so_timestamping.flags is already int, so 32 bits wide. Reported-by: Sotirios Delimanolis Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20221207143701.29861-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit ecd6df3c1ba8ad8befd82fc8f0d2438e8d3c75cc Merge: 3df96774a4224 587585e1bbebc Author: Jakub Kicinski Date: Thu Dec 8 19:47:45 2022 -0800 Merge branch 'fix-possible-deadlock-during-wed-attach' Lorenzo Bianconi says: ==================== fix possible deadlock during WED attach Fix a possible deadlock in mtk_wed_attach if mtk_wed_wo_init routine fails. Check wo pointer is properly allocated before running mtk_wed_wo_reset() and mtk_wed_wo_deinit(). ==================== Link: https://lore.kernel.org/r/cover.1670421354.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 587585e1bbebc250d46ebb0eeaf986d9c3c01c69 Author: Lorenzo Bianconi Date: Wed Dec 7 15:04:55 2022 +0100 net: ethernet: mtk_wed: fix possible deadlock if mtk_wed_wo_init fails Introduce __mtk_wed_detach() in order to avoid a deadlock in mtk_wed_attach routine if mtk_wed_wo_init fails since both mtk_wed_attach and mtk_wed_detach run holding hw_lock mutex. Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Leon Romanovsky Signed-off-by: Jakub Kicinski commit c79e0af5ae5e4de98595983fc7e883e2ca54db11 Author: Lorenzo Bianconi Date: Wed Dec 7 15:04:54 2022 +0100 net: ethernet: mtk_wed: fix some possible NULL pointer dereferences Fix possible NULL pointer dereference in mtk_wed_detach routine checking wo pointer is properly allocated before running mtk_wed_wo_reset() and mtk_wed_wo_deinit(). Even if it is just a theoretical issue at the moment check wo pointer is not NULL in mtk_wed_mcu_msg_update. Moreover, honor mtk_wed_mcu_send_msg return value in mtk_wed_wo_reset() Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support") Fixes: 4c5de09eb0d0 ("net: ethernet: mtk_wed: add configure wed wo support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Leon Romanovsky Signed-off-by: Jakub Kicinski commit 3df96774a4224fd96a54eff7446425f1fbd76006 Author: Colin Ian King Date: Wed Dec 7 09:43:12 2022 +0000 nfp: Fix spelling mistake "tha" -> "the" There is a spelling mistake in a nn_dp_warn message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20221207094312.2281493-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit 17961a37ce4077ae43128ba5ce0b1dfd8f02fdb9 Author: Björn Töpel Date: Tue Dec 6 11:28:38 2022 +0100 selftests: net: Fix O=dir builds The BPF Makefile in net/bpf did incorrect path substitution for O=dir builds, e.g. make O=/tmp/kselftest headers make O=/tmp/kselftest -C tools/testing/selftests would fail in selftest builds [1] net/ with clang-16: error: no such file or directory: 'kselftest/net/bpf/nat6to4.c' clang-16: error: no input files Add a pattern prerequisite and an order-only-prerequisite (for creating the directory), to resolve the issue. [1] https://lore.kernel.org/all/202212060009.34CkQmCN-lkp@intel.com/ Reported-by: kernel test robot Fixes: 837a3d66d698 ("selftests: net: Add cross-compilation support for BPF programs") Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20221206102838.272584-1-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 8994d11395f8165b3deca1971946f549f0822630 Author: Jan Kara Date: Wed Dec 7 12:59:28 2022 +0100 ext4: avoid unaccounted block allocation when expanding inode When expanding inode space in ext4_expand_extra_isize_ea() we may need to allocate external xattr block. If quota is not initialized for the inode, the block allocation will not be accounted into quota usage. Make sure the quota is initialized before we try to expand inode space. Reported-by: Pengfei Xu Link: https://lore.kernel.org/all/Y5BT+k6xWqthZc1P@xpf.sh.intel.com Signed-off-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20221207115937.26601-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 1485f726c6dec1a1f85438f2962feaa3d585526f Author: Jan Kara Date: Wed Dec 7 12:59:27 2022 +0100 ext4: initialize quota before expanding inode in setproject ioctl Make sure we initialize quotas before possibly expanding inode space (and thus maybe needing to allocate external xattr block) in ext4_ioctl_setproject(). This prevents not accounting the necessary block allocation. Signed-off-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20221207115937.26601-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit dae999602eeb0c5482bb62df7fda903f1edc0ff3 Author: Jan Kara Date: Wed Dec 7 12:27:15 2022 +0100 ext4: stop providing .writepage hook Now we don't need .writepage hook for anything anymore. Reclaim is fine with relying on .writepages to clean pages and we often couldn't do much from the .writepage callback anyway. We only need to provide .migrate_folio callback for the ext4_journalled_aops - let's use buffer_migrate_page_norefs() there so that buffers cannot be modified under jdb2's hands as that can cause data corruption. For example when commit code does writeout of transaction buffers in jbd2_journal_write_metadata_buffer(), we don't hold page lock or have page writeback bit set or have the buffer locked. So page migration code would go and happily migrate the page elsewhere while the copy is running thus corrupting data. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-12-jack@suse.cz Signed-off-by: Theodore Ts'o commit e26355e21520e56732f58590b812ca619b88ac72 Author: Jan Kara Date: Wed Dec 7 12:27:14 2022 +0100 mm: export buffer_migrate_folio_norefs() Ext4 needs this function to allow safe migration for journalled data pages. Signed-off-by: Jan Kara Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20221207112722.22220-11-jack@suse.cz Signed-off-by: Theodore Ts'o commit 49977f9762fe0f28ec08bec5ab992a5c9623f44c Author: Jan Kara Date: Wed Dec 7 12:27:13 2022 +0100 ext4: switch to using write_cache_pages() for data=journal writeout Instead of using generic_writepages(), let's use write_cache_pages() for writeout of journalled data. It will allow us to stop providing .writepage callback. Our data=journal writeback path would benefit from a larger cleanup and refactoring but that's for a separate cleanup series. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-10-jack@suse.cz Signed-off-by: Theodore Ts'o commit f30ff35f6266993405c8659e48fddc3180692164 Author: Jan Kara Date: Wed Dec 7 12:27:12 2022 +0100 jbd2: switch jbd2_submit_inode_data() to use fs-provided hook for data writeout jbd2_submit_inode_data() hardcoded use of jbd2_journal_submit_inode_data_buffers() for submission of data pages. Make it use j_submit_inode_data_buffers hook instead. This effectively switches ext4 fastcommits to use ext4_writepages() for data writeout instead of generic_writepages(). Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-9-jack@suse.cz Signed-off-by: Theodore Ts'o commit 59205c8d4eaeeb85cf76eb1cb140283cf900412a Author: Jan Kara Date: Wed Dec 7 12:27:11 2022 +0100 ext4: switch to using ext4_do_writepages() for ordered data writeout Use the standard writepages method (ext4_do_writepages()) to perform writeout of ordered data during journal commit. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-8-jack@suse.cz Signed-off-by: Theodore Ts'o commit 29bc9cea0e13dc8043c249f5f232b9e0c441ae24 Author: Jan Kara Date: Wed Dec 7 12:27:10 2022 +0100 ext4: move percpu_rwsem protection into ext4_writepages() Move protection by percpu_rwsem from ext4_do_writepages() to ext4_writepages(). We will not want to grab this protection during transaction commits as that would be prone to deadlocks and the protection is not needed. Move the shutdown state checking as well since we want to be able to complete commit while the shutdown is in progress. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-7-jack@suse.cz Signed-off-by: Theodore Ts'o commit 15648d599cd1c15cc678039dcab65599276fe407 Author: Jan Kara Date: Wed Dec 7 12:27:09 2022 +0100 ext4: provide ext4_do_writepages() Provide ext4_do_writepages() function that takes mpage_da_data as an argument and make ext4_writepages() just a simple wrapper around it. No functional changes. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-6-jack@suse.cz Signed-off-by: Theodore Ts'o commit de0039f69c95692539bcb7cfc3b01f31e1c9f342 Author: Jan Kara Date: Wed Dec 7 12:27:08 2022 +0100 ext4: add support for writepages calls that cannot map blocks Add support for calls to ext4_writepages() than cannot map blocks. These will be issued from jbd2 transaction commit code. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-5-jack@suse.cz Signed-off-by: Theodore Ts'o commit 5c27088b3bcf82c8525ec55cde7d2ddd034283b6 Author: Jan Kara Date: Wed Dec 7 12:27:07 2022 +0100 ext4: drop pointless IO submission from ext4_bio_write_page() We submit outstanding IO in ext4_bio_write_page() if we find a buffer we are not going to write. This is however pointless because we already handle submission of previous IO in case we detect newly added buffer head is discontiguous. So just delete the pointless IO submission call. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 29b83c574b0a06f29126e4e18801ba0e5d2e089b Author: Jan Kara Date: Wed Dec 7 12:27:06 2022 +0100 ext4: remove nr_submitted from ext4_bio_write_page() nr_submitted is the same as nr_to_submit. Drop one of them. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit dff4ac75eeeefc4397fe7cf8ce559425bf46b1f7 Author: Jan Kara Date: Wed Dec 7 12:27:05 2022 +0100 ext4: move keep_towrite handling to ext4_bio_write_page() When we are writing back page but we cannot for some reason write all its buffers (e.g. because we cannot allocate blocks in current context) we have to keep TOWRITE tag set in the mapping as otherwise racing WB_SYNC_ALL writeback that could write these buffers can skip the page and result in data loss. We will need this logic for writeback during transaction commit so move the logic from ext4_writepage() to ext4_bio_write_page(). Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 04e568a3b31cfbd545c04c8bfc35c20e5ccfce0f Author: Jan Kara Date: Wed Dec 7 12:27:04 2022 +0100 ext4: handle redirtying in ext4_bio_write_page() Since we want to transition transaction commits to use ext4_writepages() for writing back ordered, add handling of page redirtying into ext4_bio_write_page(). Also move buffer dirty bit clearing into the same place other buffer state handling. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221207112722.22220-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 5c099c4fdc438014d5893629e70a8ba934433ee8 Author: Ye Bin Date: Tue Dec 6 22:41:34 2022 +0800 ext4: fix kernel BUG in 'ext4_write_inline_data_end()' Syzbot report follow issue: ------------[ cut here ]------------ kernel BUG at fs/ext4/inline.c:227! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 3629 Comm: syz-executor212 Not tainted 6.1.0-rc5-syzkaller-00018-g59d0d52c30d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:ext4_write_inline_data+0x344/0x3e0 fs/ext4/inline.c:227 RSP: 0018:ffffc90003b3f368 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8880704e16c0 RCX: 0000000000000000 RDX: ffff888021763a80 RSI: ffffffff821e31a4 RDI: 0000000000000006 RBP: 000000000006818e R08: 0000000000000006 R09: 0000000000068199 R10: 0000000000000079 R11: 0000000000000000 R12: 000000000000000b R13: 0000000000068199 R14: ffffc90003b3f408 R15: ffff8880704e1c82 FS: 000055555723e3c0(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffe8ac9080 CR3: 0000000079f81000 CR4: 0000000000350ee0 Call Trace: ext4_write_inline_data_end+0x2a3/0x12f0 fs/ext4/inline.c:768 ext4_write_end+0x242/0xdd0 fs/ext4/inode.c:1313 ext4_da_write_end+0x3ed/0xa30 fs/ext4/inode.c:3063 generic_perform_write+0x316/0x570 mm/filemap.c:3764 ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285 ext4_file_write_iter+0x8bc/0x16e0 fs/ext4/file.c:700 call_write_iter include/linux/fs.h:2191 [inline] do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735 do_iter_write+0x182/0x700 fs/read_write.c:861 vfs_iter_write+0x74/0xa0 fs/read_write.c:902 iter_file_splice_write+0x745/0xc90 fs/splice.c:686 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x114/0x180 fs/splice.c:931 splice_direct_to_actor+0x335/0x8a0 fs/splice.c:886 do_splice_direct+0x1ab/0x280 fs/splice.c:974 do_sendfile+0xb19/0x1270 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1d0/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ---[ end trace 0000000000000000 ]--- Above issue may happens as follows: ext4_da_write_begin ext4_da_write_inline_data_begin ext4_da_convert_inline_data_to_extent ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); ext4_da_write_end ext4_run_li_request ext4_mb_prefetch ext4_read_block_bitmap_nowait ext4_validate_block_bitmap ext4_mark_group_bitmap_corrupted(sb, block_group, EXT4_GROUP_INFO_BBITMAP_CORRUPT) percpu_counter_sub(&sbi->s_freeclusters_counter,grp->bb_free); -> sbi->s_freeclusters_counter become zero ext4_da_write_begin if (ext4_nonda_switch(inode->i_sb)) -> As freeclusters_counter is zero will return true *fsdata = (void *)FALL_BACK_TO_NONDELALLOC; ext4_write_begin ext4_da_write_end if (write_mode == FALL_BACK_TO_NONDELALLOC) ext4_write_end if (inline_data) ext4_write_inline_data_end ext4_write_inline_data BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); -> As inode is already convert to extent, so 'pos + len' > inline_size -> then trigger BUG. To solve this issue, instead of checking ext4_has_inline_data() which is only cleared after data has been written back, check the EXT4_STATE_MAY_INLINE_DATA flag in ext4_write_end(). Fixes: f19d5870cbf7 ("ext4: add normal write support for inline data") Reported-by: syzbot+4faa160fa96bfba639f8@syzkaller.appspotmail.com Reported-by: Jun Nie Signed-off-by: Ye Bin Link: https://lore.kernel.org/r/20221206144134.1919987-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit d73eff68a8c0ea3fc626b08ea84e4cd327ccbe5f Author: Guoqing Jiang Date: Fri Dec 2 20:04:09 2022 +0800 ext4: make ext4_mb_initialize_context return void Change the return type to void since it always return 0, and no need to do the checking in ext4_mb_new_blocks. Signed-off-by: Guoqing Jiang Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20221202120409.24098-1-guoqing.jiang@linux.dev Signed-off-by: Theodore Ts'o commit a44e84a9b7764c72896f7241a0ec9ac7e7ef38dd Author: Jan Kara Date: Wed Nov 23 20:39:50 2022 +0100 ext4: fix deadlock due to mbcache entry corruption When manipulating xattr blocks, we can deadlock infinitely looping inside ext4_xattr_block_set() where we constantly keep finding xattr block for reuse in mbcache but we are unable to reuse it because its reference count is too big. This happens because cache entry for the xattr block is marked as reusable (e_reusable set) although its reference count is too big. When this inconsistency happens, this inconsistent state is kept indefinitely and so ext4_xattr_block_set() keeps retrying indefinitely. The inconsistent state is caused by non-atomic update of e_reusable bit. e_reusable is part of a bitfield and e_reusable update can race with update of e_referenced bit in the same bitfield resulting in loss of one of the updates. Fix the problem by using atomic bitops instead. This bug has been around for many years, but it became *much* easier to hit after commit 65f8b80053a1 ("ext4: fix race when reusing xattr blocks"). Cc: stable@vger.kernel.org Fixes: 6048c64b2609 ("mbcache: add reusable flag to cache entries") Fixes: 65f8b80053a1 ("ext4: fix race when reusing xattr blocks") Reported-and-tested-by: Jeremi Piotrowski Reported-by: Thilo Fromm Link: https://lore.kernel.org/r/c77bf00f-4618-7149-56f1-b8d1664b9d07@linux.microsoft.com/ Signed-off-by: Jan Kara Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20221123193950.16758-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit b40ebaf63851b3a401b0dc9263843538f64f5ce6 Author: Jan Kara Date: Mon Nov 21 14:09:29 2022 +0100 ext4: avoid BUG_ON when creating xattrs Commit fb0a387dcdcd ("ext4: limit block allocations for indirect-block files to < 2^32") added code to try to allocate xattr block with 32-bit block number for indirect block based files on the grounds that these files cannot use larger block numbers. It also added BUG_ON when allocated block could not fit into 32 bits. This is however bogus reasoning because xattr block is stored in inode->i_file_acl and inode->i_file_acl_hi and as such even indirect block based files can happily use full 48 bits for xattr block number. The proper handling seems to be there basically since 64-bit block number support was added. So remove the bogus limitation and BUG_ON. Cc: Eric Sandeen Fixes: fb0a387dcdcd ("ext4: limit block allocations for indirect-block files to < 2^32") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20221121130929.32031-1-jack@suse.cz Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 956510c0c7439e90b8103aaeaf4da92878c622f0 Author: Alexander Potapenko Date: Mon Nov 21 12:21:30 2022 +0100 fs: ext4: initialize fsdata in pagecache_write() When aops->write_begin() does not initialize fsdata, KMSAN reports an error passing the latter to aops->write_end(). Fix this by unconditionally initializing fsdata. Cc: Eric Biggers Fixes: c93d8f885809 ("ext4: add basic fs-verity support") Reported-by: syzbot+9767be679ef5016b6082@syzkaller.appspotmail.com Signed-off-by: Alexander Potapenko Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20221121112134.407362-1-glider@google.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 131294c35ed6f777bd4e79d42af13b5c41bf2775 Author: Eric Whitney Date: Thu Nov 17 10:22:07 2022 -0500 ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline When converting files with inline data to extents, delayed allocations made on a file system created with both the bigalloc and inline options can result in invalid extent status cache content, incorrect reserved cluster counts, kernel memory leaks, and potential kernel panics. With bigalloc, the code that determines whether a block must be delayed allocated searches the extent tree to see if that block maps to a previously allocated cluster. If not, the block is delayed allocated, and otherwise, it isn't. However, if the inline option is also used, and if the file containing the block is marked as able to store data inline, there isn't a valid extent tree associated with the file. The current code in ext4_clu_mapped() calls ext4_find_extent() to search the non-existent tree for a previously allocated cluster anyway, which typically finds nothing, as desired. However, a side effect of the search can be to cache invalid content from the non-existent tree (garbage) in the extent status tree, including bogus entries in the pending reservation tree. To fix this, avoid searching the extent tree when allocating blocks for bigalloc + inline files that are being converted from inline to extent mapped. Signed-off-by: Eric Whitney Link: https://lore.kernel.org/r/20221117152207.2424-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 7ea71af94eaaaf6d9aed24bc94a05b977a741cb9 Author: Ye Bin Date: Thu Nov 17 15:36:03 2022 +0800 ext4: fix uninititialized value in 'ext4_evict_inode' Syzbot found the following issue: ===================================================== BUG: KMSAN: uninit-value in ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180 ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180 evict+0x365/0x9a0 fs/inode.c:664 iput_final fs/inode.c:1747 [inline] iput+0x985/0xdd0 fs/inode.c:1773 __ext4_new_inode+0xe54/0x7ec0 fs/ext4/ialloc.c:1361 ext4_mknod+0x376/0x840 fs/ext4/namei.c:2844 vfs_mknod+0x79d/0x830 fs/namei.c:3914 do_mknodat+0x47d/0xaa0 __do_sys_mknodat fs/namei.c:3992 [inline] __se_sys_mknodat fs/namei.c:3989 [inline] __ia32_sys_mknodat+0xeb/0x150 fs/namei.c:3989 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9f1/0xe80 mm/page_alloc.c:5578 alloc_pages+0xaae/0xd80 mm/mempolicy.c:2285 alloc_slab_page mm/slub.c:1794 [inline] allocate_slab+0x1b5/0x1010 mm/slub.c:1939 new_slab mm/slub.c:1992 [inline] ___slab_alloc+0x10c3/0x2d60 mm/slub.c:3180 __slab_alloc mm/slub.c:3279 [inline] slab_alloc_node mm/slub.c:3364 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x6f3/0xb30 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3117 [inline] ext4_alloc_inode+0x5f/0x860 fs/ext4/super.c:1321 alloc_inode+0x83/0x440 fs/inode.c:259 new_inode_pseudo fs/inode.c:1018 [inline] new_inode+0x3b/0x430 fs/inode.c:1046 __ext4_new_inode+0x2a7/0x7ec0 fs/ext4/ialloc.c:959 ext4_mkdir+0x4d5/0x1560 fs/ext4/namei.c:2992 vfs_mkdir+0x62a/0x870 fs/namei.c:4035 do_mkdirat+0x466/0x7b0 fs/namei.c:4060 __do_sys_mkdirat fs/namei.c:4075 [inline] __se_sys_mkdirat fs/namei.c:4073 [inline] __ia32_sys_mkdirat+0xc4/0x120 fs/namei.c:4073 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 CPU: 1 PID: 4625 Comm: syz-executor.2 Not tainted 6.1.0-rc4-syzkaller-62821-gcb231e2f67ec #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 ===================================================== Now, 'ext4_alloc_inode()' didn't init 'ei->i_flags'. If new inode failed before set 'ei->i_flags' in '__ext4_new_inode()', then do 'iput()'. As after 6bc0d63dad7f commit will access 'ei->i_flags' in 'ext4_evict_inode()' which will lead to access uninit-value. To solve above issue just init 'ei->i_flags' in 'ext4_alloc_inode()'. Reported-by: syzbot+57b25da729eb0b88177d@syzkaller.appspotmail.com Signed-off-by: Ye Bin Fixes: 6bc0d63dad7f ("ext4: remove EA inode entry from mbcache on inode eviction") Reviewed-by: Jan Kara Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20221117073603.2598882-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 0aeaa2559d6d53358fca3e3fce73807367adca74 Author: Baokun Li Date: Thu Nov 17 12:03:41 2022 +0800 ext4: fix corruption when online resizing a 1K bigalloc fs When a backup superblock is updated in update_backups(), the primary superblock's offset in the group (that is, sbi->s_sbh->b_blocknr) is used as the backup superblock's offset in its group. However, when the block size is 1K and bigalloc is enabled, the two offsets are not equal. This causes the backup group descriptors to be overwritten by the superblock in update_backups(). Moreover, if meta_bg is enabled, the file system will be corrupted because this feature uses backup group descriptors. To solve this issue, we use a more accurate ext4_group_first_block_no() as the offset of the backup superblock in its group. Fixes: d77147ff443b ("ext4: add support for online resizing with bigalloc") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20221117040341.1380702-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 8f49ec603ae3e213bfab2799182724e3abac55a1 Author: Baokun Li Date: Thu Nov 17 12:03:40 2022 +0800 ext4: fix corrupt backup group descriptors after online resize In commit 9a8c5b0d0615 ("ext4: update the backup superblock's at the end of the online resize"), it is assumed that update_backups() only updates backup superblocks, so each b_data is treated as a backupsuper block to update its s_block_group_nr and s_checksum. However, update_backups() also updates the backup group descriptors, which causes the backup group descriptors to be corrupted. The above commit fixes the problem of invalid checksum of the backup superblock. The root cause of this problem is that the checksum of ext4_update_super() is not set correctly. This problem has been fixed in the previous patch ("ext4: fix bad checksum after online resize"). However, we do need to set block_group_nr for the backup superblock in update_backups(). When a block is in a group that contains a backup superblock, and the block is the first block in the group, the block is definitely a superblock. We add a helper function that includes setting s_block_group_nr and updating checksum, and then call it only when the above conditions are met to prevent the backup group descriptors from being incorrectly modified. Fixes: 9a8c5b0d0615 ("ext4: update the backup superblock's at the end of the online resize") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20221117040341.1380702-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit a408f33e895e455f16cf964cb5cd4979b658db7b Author: Baokun Li Date: Thu Nov 17 12:03:39 2022 +0800 ext4: fix bad checksum after online resize When online resizing is performed twice consecutively, the error message "Superblock checksum does not match superblock" is displayed for the second time. Here's the reproducer: mkfs.ext4 -F /dev/sdb 100M mount /dev/sdb /tmp/test resize2fs /dev/sdb 5G resize2fs /dev/sdb 6G To solve this issue, we moved the update of the checksum after the es->s_overhead_clusters is updated. Fixes: 026d0d27c488 ("ext4: reduce computation of overhead during resize") Fixes: de394a86658f ("ext4: update s_overhead_clusters in the superblock during an on-line resize") Signed-off-by: Baokun Li Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20221117040341.1380702-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit a7e9d977e031fceefe1e7cd69ebd7202d5758b56 Author: Darrick J. Wong Date: Thu Nov 10 12:16:34 2022 -0800 ext4: don't fail GETFSUUID when the caller provides a long buffer If userspace provides a longer UUID buffer than is required, we shouldn't fail the call with EINVAL -- rather, we can fill the caller's buffer with the bytes we /can/ fill, and update the length field to reflect what we copied. This doesn't break the UAPI since we're enabling a case that currently fails, and so far Ted hasn't released a version of e2fsprogs that uses the new ext4 ioctl. Signed-off-by: Darrick J. Wong Reviewed-by: Catherine Hoang Link: https://lore.kernel.org/r/166811139478.327006.13879198441587445544.stgit@magnolia Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit b76abb5157468756163fe7e3431c9fe32cba57ca Author: Darrick J. Wong Date: Thu Nov 10 12:16:29 2022 -0800 ext4: dont return EINVAL from GETFSUUID when reporting UUID length If userspace calls this ioctl with fsu_length (the length of the fsuuid.fsu_uuid array) set to zero, ext4 copies the desired uuid length out to userspace. The kernel call returned a result from a valid input, so the return value here should be zero, not EINVAL. While we're at it, fix the copy_to_user call to make it clear that we're only copying out fsu_len. Signed-off-by: Darrick J. Wong Reviewed-by: Catherine Hoang Link: https://lore.kernel.org/r/166811138914.327006.9241306894437166566.stgit@magnolia Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 26d75a16af285a70863ba6a81f85d81e7e65da50 Author: Luís Henriques Date: Wed Nov 9 18:14:45 2022 +0000 ext4: fix error code return to user-space in ext4_get_branch() If a block is out of range in ext4_get_branch(), -ENOMEM will be returned to user-space. Obviously, this error code isn't really useful. This patch fixes it by making sure the right error code (-EFSCORRUPTED) is propagated to user-space. EUCLEAN is more informative than ENOMEM. Signed-off-by: Luís Henriques Link: https://lore.kernel.org/r/20221109181445.17843-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 060f77392cab1c1cefb8a27cf6bd61f1db2441ec Author: JunChao Sun Date: Wed Nov 9 07:38:22 2022 -0800 ext4: replace kmem_cache_create with KMEM_CACHE Replace kmem_cache_create with KMEM_CACHE macro that guaranteed struct alignment Signed-off-by: JunChao Sun Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221109153822.80250-1-sunjunchao2870@gmail.com Signed-off-by: Theodore Ts'o commit 89481b5fa8c0640e62ba84c6020cee895f7ac643 Author: Baokun Li Date: Wed Nov 9 15:43:43 2022 +0800 ext4: correct inconsistent error msg in nojournal mode When we used the journal_async_commit mounting option in nojournal mode, the kernel told me that "can't mount with journal_checksum", was very confusing. I find that when we mount with journal_async_commit, both the JOURNAL_ASYNC_COMMIT and EXPLICIT_JOURNAL_CHECKSUM flags are set. However, in the error branch, CHECKSUM is checked before ASYNC_COMMIT. As a result, the above inconsistency occurs, and the ASYNC_COMMIT branch becomes dead code that cannot be executed. Therefore, we exchange the positions of the two judgments to make the error msg more accurate. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221109074343.4184862-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit bb0fbc782ee9fa8c970c8e8e17c1a52ff9419182 Author: Lukas Czerner Date: Tue Nov 8 15:50:42 2022 +0100 ext4: print file system UUID on mount, remount and unmount The device names are not necessarily consistent across reboots which can make it more difficult to identify the right file system when tracking down issues using system logs. Print file system UUID string on every mount, remount and unmount to make this task easier. This is similar to the functionality recently propsed for XFS. Signed-off-by: Lukas Czerner Cc: Lukas Herbolt Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20221108145042.85770-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o commit fae381a3d79bb94aa2eb752170d47458d778b797 Author: Ye Bin Date: Mon Nov 7 09:53:35 2022 +0800 ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828 __ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128 __ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128 ext4_xattr_block_set: inode=ffff88823869a2c8 ------------[ cut here ]------------ WARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980 Modules linked in: RIP: 0010:ext4_xattr_block_set.cold+0x22/0x980 RSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000 RDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178 RBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e R10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000 R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000 FS: 00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? ext4_xattr_set_entry+0x3b7/0x2320 ? ext4_xattr_block_set+0x0/0x2020 ? ext4_xattr_set_entry+0x0/0x2320 ? ext4_xattr_check_entries+0x77/0x310 ? ext4_xattr_ibody_set+0x23b/0x340 ext4_xattr_move_to_block+0x594/0x720 ext4_expand_extra_isize_ea+0x59a/0x10f0 __ext4_expand_extra_isize+0x278/0x3f0 __ext4_mark_inode_dirty.cold+0x347/0x410 ext4_rename+0xed3/0x174f vfs_rename+0x13a7/0x2510 do_renameat2+0x55d/0x920 __x64_sys_rename+0x7d/0xb0 do_syscall_64+0x3b/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc As 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty, which may trigger expand 'extra_isize' and allocate block. If inode didn't init quota will lead to warning. To solve above issue, init 'old.inode' firstly in 'ext4_rename'. Reported-by: syzbot+98346927678ac3059c77@syzkaller.appspotmail.com Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221107015335.2524319-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 8805dbcb3e83a4e5a6c91edc15643a7498e576ce Author: Eric Biggers Date: Sun Nov 6 14:48:41 2022 -0800 ext4: simplify fast-commit CRC calculation Instead of checksumming each field as it is added to the block, just checksum each block before it is written. This is simpler, and also much more efficient. Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-8-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 48a6a66db82b8043d298a630f22c62d43550cae5 Author: Eric Biggers Date: Sun Nov 6 14:48:40 2022 -0800 ext4: fix off-by-one errors in fast-commit block filling Due to several different off-by-one errors, or perhaps due to a late change in design that wasn't fully reflected in the code that was actually merged, there are several very strange constraints on how fast-commit blocks are filled with tlv entries: - tlvs must start at least 10 bytes before the end of the block, even though the minimum tlv length is 8. Otherwise, the replay code will ignore them. (BUG: ext4_fc_reserve_space() could violate this requirement if called with a len of blocksize - 9 or blocksize - 8. Fortunately, this doesn't seem to happen currently.) - tlvs must end at least 1 byte before the end of the block. Otherwise the replay code will consider them to be invalid. This quirk contributed to a bug (fixed by an earlier commit) where uninitialized memory was being leaked to disk in the last byte of blocks. Also, strangely these constraints don't apply to the replay code in e2fsprogs, which will accept any tlvs in the blocks (with no bounds checks at all, but that is a separate issue...). Given that this all seems to be a bug, let's fix it by just filling blocks with tlv entries in the natural way. Note that old kernels will be unable to replay fast-commit journals created by kernels that have this commit. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-7-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 8415ce07ecf0cc25efdd5db264a7133716e503cf Author: Eric Biggers Date: Sun Nov 6 14:48:39 2022 -0800 ext4: fix unaligned memory access in ext4_fc_reserve_space() As is done elsewhere in the file, build the struct ext4_fc_tl on the stack and memcpy() it into the buffer, rather than directly writing it to a potentially-unaligned location in the buffer. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-6-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 64b4a25c3de81a69724e888ec2db3533b43816e2 Author: Eric Biggers Date: Sun Nov 6 14:48:38 2022 -0800 ext4: add missing validation of fast-commit record lengths Validate the inode and filename lengths in fast-commit journal records so that a malicious fast-commit journal cannot cause a crash by having invalid values for these. Also validate EXT4_FC_TAG_DEL_RANGE. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-5-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 594bc43b410316d70bb42aeff168837888d96810 Author: Eric Biggers Date: Sun Nov 6 14:48:37 2022 -0800 ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-4-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 4c0d5778385cb3618ff26a561ce41de2b7d9de70 Author: Eric Biggers Date: Sun Nov 6 14:48:36 2022 -0800 ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature") extended the scope of the transaction in ext4_unlink() too far, making it include the call to ext4_find_entry(). However, ext4_find_entry() can deadlock when called from within a transaction because it may need to set up the directory's encryption key. Fix this by restoring the transaction to its original scope. Reported-by: syzbot+1a748d0007eeac3ab079@syzkaller.appspotmail.com Fixes: a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-3-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 0fbcb5251fc81b58969b272c4fb7374a7b922e3e Author: Eric Biggers Date: Sun Nov 6 14:48:35 2022 -0800 ext4: disable fast-commit of encrypted dir operations fast-commit of create, link, and unlink operations in encrypted directories is completely broken because the unencrypted filenames are being written to the fast-commit journal instead of the encrypted filenames. These operations can't be replayed, as encryption keys aren't present at journal replay time. It is also an information leak. Until if/when we can get this working properly, make encrypted directory operations ineligible for fast-commit. Note that fast-commit operations on encrypted regular files continue to be allowed, as they seem to work. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: # v5.10+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221106224841.279231-2-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit a71248b1accb2b42e4980afef4fa4a27fa0e36f5 Author: Baokun Li Date: Wed Nov 2 16:06:33 2022 +0800 ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710 CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370 Call Trace: dump_stack_lvl+0x73/0x9f print_report+0x25d/0x759 kasan_report+0xc0/0x120 __asan_load8+0x99/0x140 __list_add_valid+0x28/0x1a0 ext4_orphan_cleanup+0x564/0x9d0 [ext4] __ext4_fill_super+0x48e2/0x5300 [ext4] ext4_fill_super+0x19f/0x3a0 [ext4] get_tree_bdev+0x27b/0x450 ext4_get_tree+0x19/0x30 [ext4] vfs_get_tree+0x49/0x150 path_mount+0xaae/0x1350 do_mount+0xe2/0x110 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup --- loop1: assume last_orphan is 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan) ext4_truncate --> return 0 ext4_inode_attach_jinode --> return -ENOMEM iput(inode) --> free inode<12> --- loop2: last_orphan is still 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan); // use inode<12> and trigger UAF To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221102080633.1630225-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 105c78e12468413e426625831faa7db4284e1fec Author: Eric Biggers Date: Tue Nov 1 22:33:12 2022 -0700 ext4: don't allow journal inode to have encrypt flag Mounting a filesystem whose journal inode has the encrypt flag causes a NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt' mount option is used. The problem is that when jbd2_journal_init_inode() calls bmap(), it eventually finds its way into ext4_iomap_begin(), which calls fscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if the inode is encrypted, then its encryption key must already be set up. That's not the case here, since the journal inode is never "opened" like a normal file would be. Hence the crash. A reproducer is: mkfs.ext4 -F /dev/vdb debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808" mount /dev/vdb /mnt -o inlinecrypt To fix this, make ext4 consider journal inodes with the encrypt flag to be invalid. (Note, maybe other flags should be rejected on the journal inode too. For now, this is just the minimal fix for the above issue.) I've marked this as fixing the commit that introduced the call to fscrypt_limit_io_blocks(), since that's what made an actual crash start being possible. But this fix could be applied to any version of ext4 that supports the encrypt feature. Reported-by: syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com Fixes: 38ea50daa7a4 ("ext4: support direct I/O with fscrypt using blk-crypto") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221102053312.189962-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 3bf678a0f9c017c9ba7c581541dbc8453452a7ae Author: Gaosheng Cui Date: Mon Oct 31 13:58:33 2022 +0800 ext4: fix undefined behavior in bit shift for ext4_check_flag_values Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in fs/ext4/ext4.h:591:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ext4_init_fs+0x5a/0x277 do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 Fixes: 9a4c80194713 ("ext4: ensure Inode flags consistency are checked at build time") Signed-off-by: Gaosheng Cui Link: https://lore.kernel.org/r/20221031055833.3966222-1-cuigaosheng1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 991ed014de0840c5dc405b679168924afb2952ac Author: Baokun Li Date: Wed Oct 26 12:23:10 2022 +0800 ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:203! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 945 Comm: cat Not tainted 6.0.0-next-20221007-dirty #349 RIP: 0010:ext4_es_end.isra.0+0x34/0x42 RSP: 0018:ffffc9000143b768 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8881769cd0b8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8fc27cf7 RDI: 00000000ffffffff RBP: ffff8881769cd0bc R08: 0000000000000000 R09: ffffc9000143b5f8 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881769cd0a0 R13: ffff8881768e5668 R14: 00000000768e52f0 R15: 0000000000000000 FS: 00007f359f7f05c0(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f359f5a2000 CR3: 000000017130c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __es_tree_search.isra.0+0x6d/0xf5 ext4_es_cache_extent+0xfa/0x230 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_mpage_readpages+0x48e/0xe40 ext4_readahead+0x47/0x50 read_pages+0x82/0x530 page_cache_ra_unbounded+0x199/0x2a0 do_page_cache_ra+0x47/0x70 page_cache_ra_order+0x242/0x400 ondemand_readahead+0x1e8/0x4b0 page_cache_sync_ra+0xf4/0x110 filemap_get_pages+0x131/0xb20 filemap_read+0xda/0x4b0 generic_file_read_iter+0x13a/0x250 ext4_file_read_iter+0x59/0x1d0 vfs_read+0x28f/0x460 ksys_read+0x73/0x160 __x64_sys_read+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ================================================================== In the above issue, ioctl invokes the swap_inode_boot_loader function to swap inode<5> and inode<12>. However, inode<5> contain incorrect imode and disordered extents, and i_nlink is set to 1. The extents check for inode in the ext4_iget function can be bypassed bacause 5 is EXT4_BOOT_LOADER_INO. While links_count is set to 1, the extents are not initialized in swap_inode_boot_loader. After the ioctl command is executed successfully, the extents are swapped to inode<12>, in this case, run the `cat` command to view inode<12>. And Bug_ON is triggered due to the incorrect extents. When the boot loader inode is not initialized, its imode can be one of the following: 1) the imode is a bad type, which is marked as bad_inode in ext4_iget and set to S_IFREG. 2) the imode is good type but not S_IFREG. 3) the imode is S_IFREG. The BUG_ON may be triggered by bypassing the check in cases 1 and 2. Therefore, when the boot loader inode is bad_inode or its imode is not S_IFREG, initialize the inode to avoid triggering the BUG. Signed-off-by: Baokun Li Reviewed-by: Jason Yan Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221026042310.3839669-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023 Author: Baokun Li Date: Wed Oct 26 12:23:09 2022 +0800 ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode There are many places that will get unhappy (and crash) when ext4_iget() returns a bad inode. However, if iget the boot loader inode, allows a bad inode to be returned, because the inode may not be initialized. This mechanism can be used to bypass some checks and cause panic. To solve this problem, we add a special iget flag EXT4_IGET_BAD. Only with this flag we'd be returning bad inode from ext4_iget(), otherwise we always return the error code if the inode is bad inode.(suggested by Jan Kara) Signed-off-by: Baokun Li Reviewed-by: Jason Yan Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221026042310.3839669-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 07342ec259df2a35d6a34aebce010567a80a0e15 Author: Baokun Li Date: Wed Oct 26 12:23:08 2022 +0800 ext4: add helper to check quota inums Before quota is enabled, a check on the preset quota inums in ext4_super_block is added to prevent wrong quota inodes from being loaded. In addition, when the quota fails to be enabled, the quota type and quota inum are printed to facilitate fault locating. Signed-off-by: Baokun Li Reviewed-by: Jason Yan Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221026042310.3839669-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit d323877484765aaacbb2769b06e355c2041ed115 Author: Baokun Li Date: Wed Oct 26 12:23:07 2022 +0800 ext4: fix bug_on in __es_tree_search caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP: 0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the __es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode(). Signed-off-by: Baokun Li Reviewed-by: Chaitanya Kulkarni Reviewed-by: Jason Yan Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221026042310.3839669-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 78742d4d056df7d2fad241c90185d281bf924844 Author: Luís Henriques Date: Tue Oct 11 16:57:58 2022 +0100 ext4: remove trailing newline from ext4_msg() message The ext4_msg() function adds a new line to the message. Remove extra '\n' from call to ext4_msg() in ext4_orphan_cleanup(). Signed-off-by: Luís Henriques Link: https://lore.kernel.org/r/20221011155758.15287-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit d87a7b4c77a997d5388566dd511ca8e6b8e8a0a8 Author: Bixuan Cui Date: Tue Oct 11 19:33:44 2022 +0800 jbd2: use the correct print format The print format error was found when using ftrace event: <...>-1406 [000] .... 23599442.895823: jbd2_end_commit: dev 252,8 transaction -1866216965 sync 0 head -1866217368 <...>-1406 [000] .... 23599442.896299: jbd2_start_commit: dev 252,8 transaction -1866216964 sync 0 Use the correct print format for transaction, head and tid. Fixes: 879c5e6b7cb4 ('jbd2: convert instrumentation from markers to tracepoints') Signed-off-by: Bixuan Cui Reviewed-by: Jason Yan Link: https://lore.kernel.org/r/1665488024-95172-1-git-send-email-cuibixuan@linux.alibaba.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit ce87a957f1d50205964728b2f1bc6e40243c7b85 Merge: 837e8ac871499 db401875f4381 Author: Jakub Kicinski Date: Thu Dec 8 18:46:33 2022 -0800 Merge branch 'mlxsw-add-spectrum-1-ip6gre-support' Petr Machata says: ==================== mlxsw: Add Spectrum-1 ip6gre support Ido Schimmel writes: Currently, mlxsw only supports ip6gre offload on Spectrum-2 and newer ASICs. Spectrum-1 can also offload ip6gre tunnels, but it needs double entry router interfaces (RIFs) for the RIFs representing these tunnels. In addition, the RIF index needs to be even. This is handled in patches #1-#3. The implementation can otherwise be shared between all Spectrum generations. This is handled in patches #4-#5. Patch #6 moves a mlxsw ip6gre selftest to a shared directory, as ip6gre is no longer only supported on Spectrum-2 and newer ASICs. This work is motivated by users that require multiple GRE tunnels that all share the same underlay VRF. Currently, mlxsw only supports decapsulation based on the underlay destination IP (i.e., not taking the GRE key into account), so users need to configure these tunnels with different source IPs and IPv6 addresses are easier to spare than IPv4. Tested using existing ip6gre forwarding selftests. ==================== Link: https://lore.kernel.org/r/cover.1670414573.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit db401875f438168c5804b295b93a28c7730bb57a Author: Ido Schimmel Date: Wed Dec 7 13:36:47 2022 +0100 selftests: mlxsw: Move IPv6 decap_error test to shared directory Now that Spectrum-1 gained ip6gre support we can move the test out of the Spectrum-2 directory. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit 7ec5364351ed841cde48ef1e68259b8738d858aa Author: Ido Schimmel Date: Wed Dec 7 13:36:46 2022 +0100 mlxsw: spectrum_ipip: Add Spectrum-1 ip6gre support As explained in the previous patch, the existing Spectrum-2 ip6gre implementation can be reused for Spectrum-1. Change the Spectrum-1 ip6gre operations structure to use the common operations. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit ab30e4d4b29ba530c65406e8a146630d0663c570 Author: Ido Schimmel Date: Wed Dec 7 13:36:45 2022 +0100 mlxsw: spectrum_ipip: Rename Spectrum-2 ip6gre operations There are two main differences between Spectrum-1 and newer ASICs in terms of IP-in-IP support: 1. In Spectrum-1, RIFs representing ip6gre tunnels require two entries in the RIF table. 2. In Spectrum-2 and newer ASICs, packets ingress the underlay (during encapsulation) and egress the underlay (during decapsulation) via a special generic loopback RIF. The first difference was handled in previous patches by adding the 'double_rif_entry' field to the Spectrum-1 operations structure of ip6gre RIFs. The second difference is handled during RIF creation, by only creating a generic loopback RIF in Spectrum-2 and newer ASICs. Therefore, the ip6gre operations can be shared between Spectrum-1 and newer ASIC in a similar fashion to how the ipgre operations are shared. Rename the operations to not be Spectrum-2 specific and move them earlier in the file so that they could later be used for Spectrum-1. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit 5ca1b208c5d107fd4b9e7801200dea18ab1af8e7 Author: Ido Schimmel Date: Wed Dec 7 13:36:44 2022 +0100 mlxsw: spectrum_router: Add support for double entry RIFs In Spectrum-1, loopback router interfaces (RIFs) used for IP-in-IP encapsulation with an IPv6 underlay require two RIF entries and the RIF index must be even. Prepare for this change by extending the RIF parameters structure with a 'double_entry' field that indicates if the RIF being created requires two RIF entries or not. Only set it for RIFs representing ip6gre tunnels in Spectrum-1. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit 1a2f65b4a277fca10bb24d5615e512971a87587a Author: Ido Schimmel Date: Wed Dec 7 13:36:43 2022 +0100 mlxsw: spectrum_router: Parametrize RIF allocation size Currently, each router interface (RIF) consumes one entry in the RIFs table. This is going to change in subsequent patches where some RIFs will consume two table entries. Prepare for this change by parametrizing the RIF allocation size. For now, always pass '1'. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit 40ef76de8a7fabb30dafebae4035d3e7eebb47a9 Author: Ido Schimmel Date: Wed Dec 7 13:36:42 2022 +0100 mlxsw: spectrum_router: Use gen_pool for RIF index allocation Currently, each router interface (RIF) consumes one entry in the RIFs table and there are no alignment constraints. This is going to change in subsequent patches where some RIFs will consume two table entries and their indexes will need to be aligned to the allocation size (even). Prepare for this change by converting the RIF index allocation to use gen_pool with the 'gen_pool_first_fit_order_align' algorithm. No Kconfig changes necessary as mlxsw already selects 'GENERIC_ALLOCATOR'. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: Petr Machata Signed-off-by: Jakub Kicinski commit 26d6506a50403e4c5440ae124fa66747ed07b0ca Merge: 6798152be4e7e 292064cce7969 Author: Alexei Starovoitov Date: Thu Dec 8 18:25:32 2022 -0800 Merge branch 'Dynptr refactorings' Kumar Kartikeya Dwivedi says: ==================== This is part 1 of https://lore.kernel.org/bpf/20221018135920.726360-1-memxor@gmail.com. This thread also gives some background on why the refactor is being done: https://lore.kernel.org/bpf/CAEf4Bzb4beTHgVo+G+jehSj8oCeAjRbRcm6MRe=Gr+cajRBwEw@mail.gmail.com As requested in patch 6 by Alexei, it only includes patches which refactors the code, on top of which further fixes will be made in part 2. The refactor itself fixes another issue as a side effect. No functional change is intended (except a few modified log messages). Changelog: ---------- v1 -> v2 v1: https://lore.kernel.org/bpf/20221115000130.1967465-1-memxor@gmail.com * Address feedback from Joanne and David, add acks Fixes v1 -> v1 Fixes v1: https://lore.kernel.org/bpf/20221018135920.726360-1-memxor@gmail.com * Collect acks from Joanne and David * Fix misc nits pointed out by Joanne, David * Split move of reg->off alignment check for dynptr into separate change (Alexei) ==================== Signed-off-by: Alexei Starovoitov commit 292064cce7969787f13ed9988733aadc12fe0ca2 Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:41 2022 +0530 selftests/bpf: Add test for dynptr reinit in user_ringbuf callback The original support for bpf_user_ringbuf_drain callbacks simply short-circuited checks for the dynptr state, allowing users to pass PTR_TO_DYNPTR (now CONST_PTR_TO_DYNPTR) to helpers that initialize a dynptr. This bug would have also surfaced with other dynptr helpers in the future that changed dynptr view or modified it in some way. Include test cases for all cases, i.e. both bpf_dynptr_from_mem and bpf_ringbuf_reserve_dynptr, and ensure verifier rejects both of them. Without the fix, both of these programs load and pass verification. While at it, remove sys_nanosleep target from failure cases' SEC definition, as there is no such tracepoint. Acked-by: David Vernet Acked-by: Joanne Koong Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-8-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 76d16077bef0954528ec3896710f9eda8b2b4db1 Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:40 2022 +0530 bpf: Use memmove for bpf_dynptr_{read,write} It may happen that destination buffer memory overlaps with memory dynptr points to. Hence, we must use memmove to correctly copy from dynptr to destination buffer, or source buffer to dynptr. This actually isn't a problem right now, as memcpy implementation falls back to memmove on detecting overlap and warns about it, but we shouldn't be relying on that. Acked-by: Joanne Koong Acked-by: David Vernet Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f6ee298fa140f6b5bae3acf6d6108741278bcced Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:39 2022 +0530 bpf: Move PTR_TO_STACK alignment check to process_dynptr_func After previous commit, we are minimizing helper specific assumptions from check_func_arg_reg_off, making it generic, and offloading checks for a specific argument type to their respective functions called after check_func_arg_reg_off has been called. This allows relying on a consistent set of guarantees after that call and then relying on them in code that deals with registers for each argument type later. This is in line with how process_spin_lock, process_timer_func, process_kptr_func check reg->var_off to be constant. The same reasoning is used here to move the alignment check into process_dynptr_func. Note that it also needs to check for constant var_off, and accumulate the constant var_off when computing the spi in get_spi, but that fix will come in later changes. Acked-by: Joanne Koong Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 184c9bdb8f65d9f909b3a089a83bc0b0f1e1ea4c Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:38 2022 +0530 bpf: Rework check_func_arg_reg_off While check_func_arg_reg_off is the place which performs generic checks needed by various candidates of reg->type, there is some handling for special cases, like ARG_PTR_TO_DYNPTR, OBJ_RELEASE, and ARG_PTR_TO_RINGBUF_MEM. This commit aims to streamline these special cases and instead leave other things up to argument type specific code to handle. The function will be restrictive by default, and cover all possible cases when OBJ_RELEASE is set, without having to update the function again (and missing to do that being a bug). This is done primarily for two reasons: associating back reg->type to its argument leaves room for the list getting out of sync when a new reg->type is supported by an arg_type. The other case is ARG_PTR_TO_RINGBUF_MEM. The problem there is something we already handle, whenever a release argument is expected, it should be passed as the pointer that was received from the acquire function. Hence zero fixed and variable offset. There is nothing special about ARG_PTR_TO_RINGBUF_MEM, where technically its target register type PTR_TO_MEM | MEM_RINGBUF can already be passed with non-zero offset to other helper functions, which makes sense. Hence, lift the arg_type_is_release check for reg->off and cover all possible register types, instead of duplicating the same kind of check twice for current OBJ_RELEASE arg_types (alloc_mem and ptr_to_btf_id). For the release argument, arg_type_is_dynptr is the special case, where we go to actual object being freed through the dynptr, so the offset of the pointer still needs to allow fixed and variable offset and process_dynptr_func will verify them later for the release argument case as well. This is not specific to ARG_PTR_TO_DYNPTR though, we will need to make this exception for any future object on the stack that needs to be released. In this sense, PTR_TO_STACK as a candidate for object on stack argument is a special case for release offset checks, and they need to be done by the helper releasing the object on stack. Since the check has been lifted above all register type checks, remove the duplicated check that is being done for PTR_TO_BTF_ID. Acked-by: Joanne Koong Acked-by: David Vernet Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 270605317366e4535d8d9fc3d9da1ad0fb3c9d45 Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:37 2022 +0530 bpf: Rework process_dynptr_func Recently, user ringbuf support introduced a PTR_TO_DYNPTR register type for use in callback state, because in case of user ringbuf helpers, there is no dynptr on the stack that is passed into the callback. To reflect such a state, a special register type was created. However, some checks have been bypassed incorrectly during the addition of this feature. First, for arg_type with MEM_UNINIT flag which initialize a dynptr, they must be rejected for such register type. Secondly, in the future, there are plans to add dynptr helpers that operate on the dynptr itself and may change its offset and other properties. In all of these cases, PTR_TO_DYNPTR shouldn't be allowed to be passed to such helpers, however the current code simply returns 0. The rejection for helpers that release the dynptr is already handled. For fixing this, we take a step back and rework existing code in a way that will allow fitting in all classes of helpers and have a coherent model for dealing with the variety of use cases in which dynptr is used. First, for ARG_PTR_TO_DYNPTR, it can either be set alone or together with a DYNPTR_TYPE_* constant that denotes the only type it accepts. Next, helpers which initialize a dynptr use MEM_UNINIT to indicate this fact. To make the distinction clear, use MEM_RDONLY flag to indicate that the helper only operates on the memory pointed to by the dynptr, not the dynptr itself. In C parlance, it would be equivalent to taking the dynptr as a point to const argument. When either of these flags are not present, the helper is allowed to mutate both the dynptr itself and also the memory it points to. Currently, the read only status of the memory is not tracked in the dynptr, but it would be trivial to add this support inside dynptr state of the register. With these changes and renaming PTR_TO_DYNPTR to CONST_PTR_TO_DYNPTR to better reflect its usage, it can no longer be passed to helpers that initialize a dynptr, i.e. bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr. A note to reviewers is that in code that does mark_stack_slots_dynptr, and unmark_stack_slots_dynptr, we implicitly rely on the fact that PTR_TO_STACK reg is the only case that can reach that code path, as one cannot pass CONST_PTR_TO_DYNPTR to helpers that don't set MEM_RDONLY. In both cases such helpers won't be setting that flag. The next patch will add a couple of selftest cases to make sure this doesn't break. Fixes: 205715673844 ("bpf: Add bpf_user_ringbuf_drain() helper") Acked-by: Joanne Koong Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ac50fe51ce873f4299928e312ce2042e35ab5c08 Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:36 2022 +0530 bpf: Propagate errors from process_* checks in check_func_arg Currently, we simply ignore the errors in process_spin_lock, process_timer_func, process_kptr_func, process_dynptr_func. Instead, bubble up the error by storing and checking err variable. Acked-by: Joanne Koong Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 6b75bd3d036745b9be30917909f03602099adbdb Author: Kumar Kartikeya Dwivedi Date: Thu Dec 8 02:11:35 2022 +0530 bpf: Refactor ARG_PTR_TO_DYNPTR checks into process_dynptr_func ARG_PTR_TO_DYNPTR is akin to ARG_PTR_TO_TIMER, ARG_PTR_TO_KPTR, where the underlying register type is subjected to more special checks to determine the type of object represented by the pointer and its state consistency. Move dynptr checks to their own 'process_dynptr_func' function so that is consistent and in-line with existing code. This also makes it easier to reuse this code for kfunc handling. Then, reuse this consolidated function in kfunc dynptr handling too. Note that for kfuncs, the arg_type constraint of DYNPTR_TYPE_LOCAL has been lifted. Acked-by: David Vernet Acked-by: Joanne Koong Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207204141.308952-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 837e8ac871499d337212e2161c046f5adf1bad33 Merge: ff36c447e2330 010b6761a9fc5 Author: Jakub Kicinski Date: Thu Dec 8 16:07:53 2022 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net No conflicts. Signed-off-by: Jakub Kicinski commit c3991107a28a5ad0bd90660ca3bbf8c2c220ea98 Author: Douglas Anderson Date: Thu Dec 8 18:16:59 2022 -0800 Input: elants_i2c - delay longer with reset asserted The elan touchscreen datasheet says that the reset GPIO only needs to be asserted for 500us in order to reset the regulator. The problem is that some boards need a level shifter between the signals on the GPIO controller and the signals on the touchscreen. All of these extra components on the line can slow the transition of the signals. On one board, we measured the reset line and saw that it took almost 1.8ms to go low. Even after we bumped up the "drive strength" of the signal from the default 2mA to 8mA we still saw it take 421us for the signal to go low. In order to account for this let's lengthen the amount of time that we keep the reset asserted. Let's bump it up from 500us to 5000us. That's still a relatively short amount of time and is much safer. It should be noted that this fixes real problems. Case in point: 1. The touchscreen power rail may be shared with another device (like an eDP panel). That means that at probe time power might already be on. 2. In probe we grab the reset GPIO and assert it (make it low). 3. We turn on power (a noop since it was already on). 4. We wait 500us. 5. We deassert the reset GPIO. With the above case and only a 500us delay we saw only a partial reset asserted, which is bad. Giving it 5ms is overkill but feels safer in case someone else has a different level shifter setup. Note that bumping up the delay to 5000 means that some configs yell about using udelay(). We'll change to using usleep_range(). We give a small range here because: - This isn't a delay that happens very often so we don't need to worry about giving a big range to allow for power efficiency. - usleep_range() is known to almost always pick the upper bound and delay that long and we really don't want to slow down the power on of the touchscreen that much. Signed-off-by: Douglas Anderson Reviewed-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20221208180603.v2.5.I6edfb3f459662c041563a54e5b7df727c27caaba@changeid Signed-off-by: Dmitry Torokhov commit 66efff515a6500d4b4976fbab3bee8b92a1137fb Merge: 9e5737bd04579 347fafe0eb46d Author: Dave Airlie Date: Fri Dec 9 12:08:32 2022 +1000 Merge tag 'amd-drm-next-6.2-2022-12-07' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.2-2022-12-07: amdgpu: - DSC fixes for DCN 2.1 - HDMI PCON fixes - PSR fixes - DC DML fixes - Properly throttle on BO allocation - GFX 11.0.4 fixes - MMHUB fix - Make some functions static Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20221207232439.5908-1-alexander.deucher@amd.com commit 9e5737bd0457955690d871b3f4fc66dea40ea141 Merge: f06a4da3adf25 4670ac706ff9b Author: Dave Airlie Date: Fri Dec 9 12:08:12 2022 +1000 Merge tag 'amd-drm-next-6.2-2022-12-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.2-2022-12-02: amdgpu: - Fix CPU stalls when allocating large amounts of system memory - SR-IOV fixes - BACO fixes - Enable GC 11.0.4 - Enable PSP 13.0.11 - Enable SMU 13.0.11 - Enable NBIO 7.7.1 - Fix reported VCN capabilities for RDNA2 - Misc cleanups - PCI ref count fixes - DCN DPIA fixes - DCN 3.2.x fixes - Documentation updates - GC 11.x fixes - VCN RAS fixes - APU fix for passthrough - PSR fixes - GFX preemption support for gfx9 - SDMA fix for S0ix amdkfd: - Enable KFD support for GC 11.0.4 - Misc cleanups - Fix memory leak Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20221202160659.5987-1-alexander.deucher@amd.com commit f06a4da3adf252a6ecd37c4ea1c3540db0b27738 Merge: b2268e26869a5 b02897e56b4e1 Author: Dave Airlie Date: Fri Dec 9 11:53:23 2022 +1000 Merge tag 'drm-misc-next-fixes-2022-12-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Some deferred-io and damage worker reworks revert and make a fb function static Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20221208084040.yw4zavsjd25qsltf@houat commit 6798152be4e7e03e156c3c4ba3c06b80ff2bbd99 Merge: e60db051a4a70 822ed78fab13d Author: Alexei Starovoitov Date: Thu Dec 8 17:50:17 2022 -0800 Merge branch 'Misc optimizations for bpf mem allocator' Hou Tao says: ==================== From: Hou Tao Hi, The patchset is just misc optimizations for bpf mem allocator. Patch 1 fixes the OOM problem found during running hash-table update benchmark from qp-trie patchset [0]. The benchmark will add htab elements in batch and then delete elements in batch, so freed objects will stack on free_by_rcu and wait for the expiration of RCU grace period. There can be tens of thousands of freed objects and these objects are not available for new allocation, so adding htab element will continue to do new allocation. For the benchmark commmand: "./bench -w3 -d10 -a htab-update -p 16", even the maximum entries of htab is 16384, key_size is 255 and value_size is 4, the peak memory usage will reach 14GB or more. Increasing rcupdate.rcu_task_enqueue_lim will decrease the peak memory to 860MB, but it is still too many. Although the above case is contrived, it is better to fix it and the fixing is simple: just reusing the freed objects in free_by_rcu during allocation. After the fix, the peak memory usage will decrease to 26MB. Beside above case, the memory blow-up problem is also possible when allocation and freeing are done on total different CPUs. I'm trying to fix the blow-up problem by using a global per-cpu work to free these objects in free_by_rcu timely, but it doesn't work very well and I am still digging into it. Patch 2 is a left-over patch from rcu_trace_implies_rcu_gp() patchset [1]. After disscussing with Paul [2], I think it is also safe to skip rcu_barrier() when rcu_trace_implies_rcu_gp() returns true. Comments are always welcome. Change Log: v2: * Patch 1: repharse the commit message (Suggested by Yonghong & Alexei) * Add Acked-by for both patch 1 and 2 v1: https://lore.kernel.org/bpf/20221206042946.686847-1-houtao@huaweicloud.com [0]: https://lore.kernel.org/bpf/20220924133620.4147153-13-houtao@huaweicloud.com/ [1]: https://lore.kernel.org/bpf/20221014113946.965131-1-houtao@huaweicloud.com/ [2]: https://lore.kernel.org/bpf/20221021185002.GP5600@paulmck-ThinkPad-P17-Gen-1/ ==================== Signed-off-by: Alexei Starovoitov commit 822ed78fab13d5a54f8b8c030e8c5dc0fcd2cdae Author: Hou Tao Date: Fri Dec 9 09:09:47 2022 +0800 bpf: Skip rcu_barrier() if rcu_trace_implies_rcu_gp() is true If there are pending rcu callback, free_mem_alloc() will use rcu_barrier_tasks_trace() and rcu_barrier() to wait for the pending __free_rcu_tasks_trace() and __free_rcu() callback. If rcu_trace_implies_rcu_gp() is true, there will be no pending __free_rcu(), so it will be OK to skip rcu_barrier() as well. Acked-by: Yonghong Song Acked-by: Paul E. McKenney Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20221209010947.3130477-3-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 0893d6007db5cf397f3fc92b2a6935c3ed0c6f00 Author: Hou Tao Date: Fri Dec 9 09:09:46 2022 +0800 bpf: Reuse freed element in free_by_rcu during allocation When there are batched freeing operations on a specific CPU, part of the freed elements ((high_watermark - lower_watermark) / 2 + 1) will be indirectly moved into waiting_for_gp list through free_by_rcu list. After call_rcu_in_progress becomes false again, the remaining elements in free_by_rcu list will be moved to waiting_for_gp list by the next invocation of free_bulk(). However if the expiration of RCU tasks trace grace period is relatively slow, none element in free_by_rcu list will be moved. So instead of invoking __alloc_percpu_gfp() or kmalloc_node() to allocate a new object, in alloc_bulk() just check whether or not there is freed element in free_by_rcu list and reuse it if available. Acked-by: Yonghong Song Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20221209010947.3130477-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 39cb018aefa5e72dd10f833058cd2c49c88cb435 Author: Luca Weiss Date: Fri Dec 2 15:31:38 2022 -0800 dt-bindings: input: Convert ti,drv260x to DT schema Convert the drv260x haptics binding to DT schema format. The only notable change from .txt format is that vbat-supply is not actually required, so don't make it a required property. Acked-by: Andrew Davis Signed-off-by: Luca Weiss Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221118174831.69793-1-luca@z3ntu.xyz Signed-off-by: Dmitry Torokhov commit c4a5bcae72a87eba89c7b56c2dd21639f8452a48 Author: Fabio Estevam Date: Fri Dec 2 15:30:32 2022 -0800 dt-bindings: input: gpio-beeper: Convert to yaml schema Convert the bindings from plain text to yaml schema. Signed-off-by: Fabio Estevam Reviewed-by: Krzysztof Kozlowski Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20221120012135.2085631-1-festevam@gmail.com Signed-off-by: Dmitry Torokhov commit 61b2f0bdaa3c7e6956fdac0a7c1e8284b9b81d1d Merge: de59b6ed0618b 583286e2072ed Author: Palmer Dabbelt Date: Thu Dec 8 17:22:57 2022 -0800 Merge patch series "riscv: Fix crash during early errata patching" These are fixes, but due to the possible early boot fallout they're going in the merge window to get a bit more time to bake on linux-next. * b4-shazam-merge riscv: Move cast inside kernel_mapping_[pv]a_to_[vp]a riscv: Fix crash during early errata patching Link: https://lore.kernel.org/r/20221126060920.65009-1-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit 583286e2072ed25c31b7db14d69fdf03f1fae7ba Author: Samuel Holland Date: Sat Nov 26 00:09:20 2022 -0600 riscv: Move cast inside kernel_mapping_[pv]a_to_[vp]a Before commit 44c922572952 ("RISC-V: enable XIP"), these macros cast their argument to unsigned long. That commit moved the cast after an assignment to an unsigned long variable, rendering it ineffectual. Move the cast back, so we can remove the cast at each call site. Reviewed-by: Alexandre Ghiti Reviewed-by: Heiko Stuebner Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20221126060920.65009-2-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit 0c49688174f5347c3f8012e84c0ffa0d2b2890c8 Author: Samuel Holland Date: Sat Nov 26 00:09:19 2022 -0600 riscv: Fix crash during early errata patching The patch function for the T-Head PBMT errata calls __pa_symbol() before relocation. This crashes when CONFIG_DEBUG_VIRTUAL is enabled, because __pa_symbol() forwards to __phys_addr_symbol(), and __phys_addr_symbol() checks against the absolute kernel start/end address. Fix this by checking against the kernel map instead of a symbol address. Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head") Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20221126060920.65009-1-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit 40b85eec8b65c6fe936a5afaf743c1dce0ba982c Author: Liam Beguin Date: Sat Nov 19 22:02:57 2022 -0500 clk: lmk04832: fix kernel-doc warnings Fix syntax generating the following kernel-doc warnings: drivers/clk/clk-lmk04832.c:189: warning: cannot understand function prototype: 'struct lmk04832_device_info ' drivers/clk/clk-lmk04832.c:193: warning: Function parameter or member 'pid' not described in 'lmk04832_device_info' drivers/clk/clk-lmk04832.c:193: warning: Function parameter or member 'maskrev' not described in 'lmk04832_device_info' drivers/clk/clk-lmk04832.c:193: warning: Function parameter or member 'num_channels' not described in 'lmk04832_device_info' drivers/clk/clk-lmk04832.c:193: warning: Function parameter or member 'vco0_range' not described in 'lmk04832_device_info' drivers/clk/clk-lmk04832.c:193: warning: Function parameter or member 'vco1_range' not described in 'lmk04832_device_info' drivers/clk/clk-lmk04832.c:420: warning: No description found for return value of 'lmk04832_check_vco_ranges' drivers/clk/clk-lmk04832.c:459: warning: No description found for return value of 'lmk04832_calc_pll2_params' Signed-off-by: Liam Beguin Link: https://lore.kernel.org/r/20221120030257.531153-5-liambeguin@gmail.com Signed-off-by: Stephen Boyd commit 739d5e6abba5fa50bba3fb6cc5e75851d989a8ce Author: Liam Beguin Date: Sat Nov 19 22:02:56 2022 -0500 clk: lmk04832: drop superfluous #include iwyu warnings: (new ones prefixed by >>) >> drivers/clk/clk-lmk04832.c:15:1: iwyu: warning: superfluous #include >> drivers/clk/clk-lmk04832.c:20:1: iwyu: warning: superfluous #include Reported-by: kernel test robot Link: https://lore.kernel.org/all/202107110620.926Sm95z-lkp@intel.com/ Signed-off-by: Liam Beguin Link: https://lore.kernel.org/r/20221120030257.531153-4-liambeguin@gmail.com Signed-off-by: Stephen Boyd commit 992a35523d159ce0aea333716c236f0790332af8 Author: Liam Beguin Date: Sat Nov 19 22:02:55 2022 -0500 clk: lmk04832: drop unnecessary semicolons Semicolons on the closing brace of a function definition are unnecessary, remove them. Signed-off-by: Liam Beguin Link: https://lore.kernel.org/r/20221120030257.531153-3-liambeguin@gmail.com Signed-off-by: Stephen Boyd commit 6c634446b865738da8ea753b181722525128958e Author: Liam Beguin Date: Sat Nov 19 22:02:54 2022 -0500 clk: lmk04832: declare variables as const when possible Fix the following warning reported by the kernel test robot. cppcheck possible warnings: (new ones prefixed by >>, may not real problems) >> drivers/clk/clk-lmk04832.c:357:15: warning: Variable 'pll2_p' can be declared with const [constVariable] unsigned int pll2_p[] = {8, 2, 2, 3, 4, 5, 6, 7}; Reported-by: kernel test robot Link: https://lore.kernel.org/all/202203312017.5YW13Jr4-lkp@intel.com/ Signed-off-by: Liam Beguin Link: https://lore.kernel.org/r/20221120030257.531153-2-liambeguin@gmail.com Signed-off-by: Stephen Boyd commit 0b8ba891ad4d1ef6bfa4c72efc83f9f9f855f68b Author: Xiu Jianfeng Date: Wed Nov 23 11:16:22 2022 +0800 clk: socfpga: Fix memory leak in socfpga_gate_init() Free @socfpga_clk and @ops on the error path to avoid memory leak issue. Fixes: a30a67be7b6e ("clk: socfpga: Don't have get_parent for single parent ops") Signed-off-by: Xiu Jianfeng Link: https://lore.kernel.org/r/20221123031622.63171-1-xiujianfeng@huawei.com Acked-by: Dinh Nguyen Signed-off-by: Stephen Boyd commit 3c79ace9c0d0ba4755e5673759acb36fd17e714a Author: Conor Dooley Date: Wed Nov 23 16:19:22 2022 +0000 clk: microchip: enable the MPFS clk driver by default if SOC_MICROCHIP_POLARFIRE With the intent of removing driver selects from Kconfig.socs in arch/riscv, essential drivers that were being selected there could instead by enabled by defaulting them to the value of the SoC's Kconfig symbol. Do so here & drop the depend on RISC-V - the SOC_ symbols are only defined there anyway. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20221123161921.81195-1-conor@kernel.org Signed-off-by: Stephen Boyd commit de59b6ed0618b909be78f6bc60874a57dd016063 Author: Jisheng Zhang Date: Wed Nov 23 23:02:57 2022 +0800 riscv: boot: add zstd support Support build the zstd compressed Image.zst. Similar as other compressed formats, the Image.zst is not self-decompressing and the bootloader still needs to handle decompression before launching the kernel image. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20221123150257.3108-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit b2268e26869a56e40964f0d912b58ffd076fd453 Merge: 077bd80083abb 7d579eff3e55a Author: Dave Airlie Date: Fri Dec 9 10:29:56 2022 +1000 Merge tag 'drm-intel-next-fixes-2022-12-01' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Multi-cast register fix (Matt) - Fix workarounds on gen2-3 (Tvrtko) - Bigjoiner fix (Ville) - Make Guc default_list a const data (Jani) - Acquire forcewake before uncore read (Umesh) - Selftest fix (Umesh) - HuC related fixes (Daniele) - Fix some incorrect return values (Janusz) - Fix a memory leak in bios related code (Xia) - Fix VBT send packet port selection (Mikko) - DG2's DMC fix bump for Register noclaims and few restore (Gustavo) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Y4jZBRw9KvlKgkr6@intel.com commit 4fe1b3a5f8fe2fdcedcaba9561e5b0ae5cb1d15b Author: Michael Guralnik Date: Thu Dec 8 06:23:46 2022 +0200 net/mlx5: Expose steering dropped packets counter Add rx steering discarded packets counter to the vnic_diag debugfs. Signed-off-by: Michael Guralnik Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 64b68e36964997e6a00297daf0fd6eab12e9fb82 Author: Or Har-Toov Date: Tue Nov 22 12:42:18 2022 +0200 net/mlx5: Refactor and expand rep vport stat group Expand representor vport stat group to support all counters from the vport stat group, to count all the traffic passing through the vport. Fix current implementation where fill_stats and update_stats use different structs. Signed-off-by: Or Har-Toov Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 7c33e73995e933475985ee0ca3cfa5b335da447e Author: Maor Dickman Date: Sun Oct 9 09:53:22 2022 +0300 net/mlx5e: multipath, support routes with more than 2 nexthops Today multipath offload is only supported when the number of nexthops is 2 which block the use of it in case of system with 2 NICs. This patch solve it by enabling multipath offload per NIC if 2 nexthops of the route are its uplinks. Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 6fda078d5f7521cf02f493b62d9d87abda3cb890 Author: Oz Shlomo Date: Wed Nov 2 14:36:51 2022 +0000 net/mlx5e: TC, add support for meter mtu offload Initialize the meter object with the TC police mtu parameter. Use the hardware range destination to compare the pkt len to the mtu setting. Assign the range destination hit/miss ft to the police conform/exceed attributes. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit d56713250a59aba48428345f80e1bff9dde897e1 Author: Oz Shlomo Date: Wed Aug 24 12:45:43 2022 +0000 net/mlx5e: meter, add mtu post meter tables TC police action may configure the maximum packet size to be handled by the policer, in addition to byte/packet rate. MTU check is realized in hardware using the range destination, specifying a hit ft, if packet len is in the range, or miss ft otherwise. Instantiate mtu green/red flow tables with a single match-all rule. Add the green/red actions to the hit/miss table accordingly. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit fd6fa761466cef5279a399ca6f21d8f84d5b2332 Author: Oz Shlomo Date: Thu Dec 1 12:35:36 2022 +0000 net/mlx5e: meter, refactor to allow multiple post meter tables TC police action may configure the maximum packet size to be handled by the policer, in addition to byte/packet rate. Currently the post meter table steers the packet according to the meter aso output. Refactor the code to allow both metering and range post actions as a pre-step for adding police mtu offload support. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit be6d5daeaa3bcd6ce414c20c61bd8ae8d38da49a Author: Yevgeny Kliteynik Date: Tue Nov 29 11:21:38 2022 +0200 net/mlx5: DR, Add support for range match action Add support for matching on range. The supported type of range is L2 frame size. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit 1207a772c09d43f2720ed4296b8a5a096d62365a Author: Yevgeny Kliteynik Date: Tue Nov 29 11:01:23 2022 +0200 net/mlx5: DR, Add function that tells if STE miss addr has been initialized Up until now miss address in all the STEs was used to connect miss lists and to link the last STE in the list to end anchor. Match range STE will require special handling because its miss address is part of the 'action'. That is, range action has hit and miss addresses. Since the range action is always the last action, need to make sure that its miss address isn't overwritten by the end anchor. Adding new function mlx5dr_ste_is_miss_addr_set() to answer the question whether the STE's miss address has already been set as part of STE initialization. Use a callback that always returns false right now. Once match range is added, a different callback will be used for that STE type. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Erez Shitrit Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit f31bda789f1d7216c0e8d24c55d35dc4e97dc4ab Author: Yevgeny Kliteynik Date: Wed Nov 30 00:26:05 2022 +0200 net/mlx5: DR, Some refactoring of miss address handling In preparation for MATCH RANGE STE support, create a function to set the miss address of an STE. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Erez Shitrit Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 1339678fdde1c84ea8b4d6e3627f7742c87f95fa Author: Yevgeny Kliteynik Date: Thu Aug 25 15:35:59 2022 +0300 net/mlx5: DR, Manage definers with refcounts In many cases different actions will ask for the same definer format. Instead of allocating new definer general object and running out of definers, have an xarray of allocated definers and keep track of their usage with refcounts: allocate a new definer only when there isn't one with the same format already created, and destroy definer only when its refcount runs down to zero. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit c72a57ad6e9183eeb6739ae688b6417df4a512ac Author: Yevgeny Kliteynik Date: Sat Aug 6 02:36:54 2022 +0300 net/mlx5: DR, Handle FT action in a separate function As preparation for range action support, moving the handling of final ICM address for flow table action to a separate function. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 0a8c20e23ff2d042295a20d09b0dde1492554ef7 Author: Yevgeny Kliteynik Date: Fri Aug 5 13:42:24 2022 +0300 net/mlx5: DR, Rework is_fw_table function This patch handles the following two changes w.r.t. is_fw_table function: 1. When SW steering is asked to create/destroy FW table, we allow for creation/destruction of only termination tables. Rename mlx5_dr_is_fw_table both to comply with the static function naming and to reflect that we're actually checking for FW termination table. 2. When the action 'go to flow table' is created, the destination flow table can be any FW table, not only termination table. Adding function to check if the dest table is FW table. This function will also be used by the later creation of range match action, so putting it the header file. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit e046b86e2900005726dd8f10217f778dff1b5929 Author: Yevgeny Kliteynik Date: Tue May 31 16:25:17 2022 +0300 net/mlx5: DR, Add functions to create/destroy MATCH_DEFINER general object SW steering is able to match only on the exact values of the packet fields, as requested by the user: the user provides mask for the fields that are of interest, and the exact values to be matched on when the traffic is handled. Match Definer is a general FW object that defines which fields in the packet will be referenced by the mask and tag of each STE. Match definer ID is part of STE fields, and it defines how the HW needs to interpret the STE's mask/tag values. Till now SW steering used the definers that were managed by FW and implemented the STE layout as described by the HW spec. Now that we're adding a new type of STE, SW steering needs to define for the HW how it should interpret this new STE's layout. This is done with a programmable match definer. The programmable definer allows to selects which fields will be included in the definer, and their layout: it has up to 9 DW selectors 8 Byte selectors. Each selector indicates a DW/Byte worth of fields out of the table that is defined by HW spec by referencing the offset of the required DW/Byte. This patch adds dr_cmd function to create and destroy MATCH_DEFINER general object. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 38bf24c38d19dc4ba5ec684ac2afa2f8e256db1e Author: Yevgeny Kliteynik Date: Mon Aug 15 12:45:28 2022 +0300 net/mlx5: fs, add match on ranges API Range is a new flow destination type which allows matching on a range of values instead of matching on a specific value. Range flow destination has the following fields: - hit_ft: flow table to forward the traffic in case of hit - miss_ft: flow table to forward the traffic in case of miss - field: which packet characteristic to match on - min: minimal value for the selected field - max: maximal value for the selected field Note: - In order to match, the value in the packet should meet the following criteria: min <= value < max - Currently, the only supported field type is L2 packet length Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit f1543c7abab25d93bc8e9fae79b4cb3153ed6669 Author: Yevgeny Kliteynik Date: Tue May 31 13:55:28 2022 +0300 net/mlx5: mlx5_ifc updates for MATCH_DEFINER general object Update full structure of match definer and add an ID of the SELECT match definer type. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 558480d3e7d9a21b18354afdc308cd867efbba49 Merge: 049696a39d2fb bf3d7b1d8499c Author: Palmer Dabbelt Date: Thu Dec 8 15:57:11 2022 -0800 Merge patch series "RISC-V interrupt controller select cleanup" Conor Dooley says: From: Conor Dooley Submitted a patch yesterday defaulting the SiFive PLIC driver to enabled [0], and in the ensuing conversation Marc suggested just doing a select at the arch level and dropping the user selectability completely. * b4-shazam-merge: RISC-V: stop selecting SIFIVE_PLIC at the SoC level irqchip/riscv-intc: remove user selectability of RISCV_INTC irqchip/sifive-plic: remove user selectability of SIFIVE_PLIC Link: https://lore.kernel.org/r/20221118104300.85016-1-conor@kernel.org Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/87zgceszp8.wl-maz@kernel.org/ Signed-off-by: Palmer Dabbelt commit bf3d7b1d8499ca46874c7373d2043ecbe252cccc Author: Conor Dooley Date: Fri Nov 18 10:43:01 2022 +0000 RISC-V: stop selecting SIFIVE_PLIC at the SoC level The SIFIVE_PLIC driver is used by all current RISC-V SoCs & will be, where possible, used for future implementations. Rather than having each driver select the option on a case-by-case basis, do so at the arch level. Signed-off-by: Conor Dooley Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20221118104300.85016-4-conor@kernel.org Signed-off-by: Palmer Dabbelt commit d8fb13070c3c99b6a17b75fda28943f9261e23e7 Author: Conor Dooley Date: Fri Nov 18 10:43:00 2022 +0000 irqchip/riscv-intc: remove user selectability of RISCV_INTC Since commit e71ee06e3ca3 ("RISC-V: Force select RISCV_INTC for CONFIG_RISCV") the driver has been enabled at the arch level - and is mandatory anyway. There's no point exposing this as a choice to users, so stop bothering. Signed-off-by: Conor Dooley Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20221118104300.85016-3-conor@kernel.org Signed-off-by: Palmer Dabbelt commit fdb1742aff436399f5769a7559bbb71c7f37a85f Author: Conor Dooley Date: Fri Nov 18 10:42:59 2022 +0000 irqchip/sifive-plic: remove user selectability of SIFIVE_PLIC The SiFive PLIC driver is used by all current implementations, including those that do not have a SiFive PLIC. The current driver supports more than just SiFive PLICs at present and, where possible, future PLIC implementations will also use this driver. As every supported RISC-V SoC selects the driver directly in Kconfig.socs there's no point in exposing this kconfig option to users. The Kconfig help text, in its current form, is misleading. There's no point doing anything about that though, as it will no longer be user selectable. Remove it. Suggested-by: Marc Zyngier Signed-off-by: Conor Dooley Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20221118104300.85016-2-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 049696a39d2fbaad1b35b08cbc65d9e17c0406bc Merge: e1ceb09641631 497bcbe3ce046 Author: Palmer Dabbelt Date: Thu Dec 8 15:45:28 2022 -0800 Merge patch series "Add PMEM support for RISC-V" Anup Patel says: The Linux NVDIMM PEM drivers require arch support to map and access the persistent memory device. This series adds RISC-V PMEM support using recently added Svpbmt and Zicbom support. * b4-shazam-merge: RISC-V: Enable PMEM drivers RISC-V: Implement arch specific PMEM APIs RISC-V: Fix MEMREMAP_WB for systems with Svpbmt Link: https://lore.kernel.org/r/20221114090536.1662624-1-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 497bcbe3ce0466123a834f2777a8a762bd5d7aae Author: Anup Patel Date: Mon Nov 14 14:35:36 2022 +0530 RISC-V: Enable PMEM drivers We now have PMEM arch support available in RISC-V kernel so let us enable relevant drivers in defconfig. Signed-off-by: Anup Patel Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221114090536.1662624-4-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt commit a49ab905a1fc8630a94221f9a06ce0dafb266576 Author: Anup Patel Date: Mon Nov 14 14:35:35 2022 +0530 RISC-V: Implement arch specific PMEM APIs The NVDIMM PMEM driver expects arch specific APIs for cache maintenance and if arch does not provide these APIs then NVDIMM PMEM driver will always use MEMREMAP_WT to map persistent memory which in-turn maps as UC memory type defined by the RISC-V Svpbmt specification. Now that the Svpbmt and Zicbom support is available in RISC-V kernel, we implement PMEM APIs using ALT_CMO_OP() macros so that the NVDIMM PMEM driver can use MEMREMAP_WB to map persistent memory. Co-developed-by: Mayuresh Chitale Signed-off-by: Mayuresh Chitale Signed-off-by: Anup Patel Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221114090536.1662624-3-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt commit b91676fc16cd384a81e3af52c641aa61985cc231 Author: Anup Patel Date: Mon Nov 14 14:35:34 2022 +0530 RISC-V: Fix MEMREMAP_WB for systems with Svpbmt Currently, the memremap() called with MEMREMAP_WB maps memory using the generic ioremap() function which breaks on system with Svpbmt because memory mapped using _PAGE_IOREMAP page attributes is treated as strongly-ordered non-cacheable IO memory. To address this, we implement RISC-V specific arch_memremap_wb() which maps memory using _PAGE_KERNEL page attributes resulting in write-back cacheable mapping on systems with Svpbmt. Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Co-developed-by: Mayuresh Chitale Signed-off-by: Mayuresh Chitale Signed-off-by: Anup Patel Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20221114090536.1662624-2-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt commit e1ceb096416311be1564de69ea40bb872d7cc327 Merge: 4bd1d80efb5af b0f4c74eadbf6 Author: Palmer Dabbelt Date: Thu Dec 8 15:31:44 2022 -0800 Merge patch "RISC-V: Fix unannoted hardirqs-on in return to userspace slow-path" I'm merging this in as a single patch to make it easier to handle the backports. * b4-shazam-merge: RISC-V: Fix unannoted hardirqs-on in return to userspace slow-path Link: https://lore.kernel.org/r/20221111223108.1976562-1-abrestic@rivosinc.com Signed-off-by: Palmer Dabbelt commit b0f4c74eadbf69a3298f38566bfaa2e202541f2f Author: Andrew Bresticker Date: Fri Nov 11 17:31:08 2022 -0500 RISC-V: Fix unannoted hardirqs-on in return to userspace slow-path The return to userspace path in entry.S may enable interrupts without the corresponding lockdep annotation, producing a splat[0] when DEBUG_LOCKDEP is enabled. Simply calling __trace_hardirqs_on() here gets a bit messy due to the use of RA to point back to ret_from_exception, so just move the whole slow-path loop into C. It's more readable and it lets us use local_irq_{enable,disable}(), avoiding the need for manual annotations altogether. [0]: ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(!lockdep_hardirqs_enabled()) WARNING: CPU: 2 PID: 1 at kernel/locking/lockdep.c:5512 check_flags+0x10a/0x1e0 Modules linked in: CPU: 2 PID: 1 Comm: init Not tainted 6.1.0-rc4-00160-gb56b6e2b4f31 #53 Hardware name: riscv-virtio,qemu (DT) epc : check_flags+0x10a/0x1e0 ra : check_flags+0x10a/0x1e0 status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [] lock_is_held_type+0x78/0x14e [] __might_resched+0x26/0x22c [] __might_sleep+0x3c/0x66 [] get_signal+0x9e/0xa70 [] do_notify_resume+0x6e/0x422 [] ret_from_exception+0x0/0x10 irq event stamp: 44512 hardirqs last enabled at (44511): [] _raw_spin_unlock_irqrestore+0x54/0x62 hardirqs last disabled at (44512): [] __trace_hardirqs_off+0xc/0x14 softirqs last enabled at (44472): [] __do_softirq+0x3de/0x51e softirqs last disabled at (44467): [] irq_exit+0xd6/0x104 ---[ end trace 0000000000000000 ]--- possible reason: unannotated irqs-on. Signed-off-by: Andrew Bresticker Fixes: 3c4697982982 ("riscv: Enable LOCKDEP_SUPPORT & fixup TRACE_IRQFLAGS_SUPPORT") Link: https://lore.kernel.org/r/20221111223108.1976562-1-abrestic@rivosinc.com Signed-off-by: Palmer Dabbelt commit e60db051a4a70bff151eb59774c64af3a0266794 Author: Stanislav Fomichev Date: Tue Dec 6 15:27:39 2022 -0800 selftests/bpf: Bring test_offload.py back to life Bpftool has new extra libbpf_det_bind probing map we need to exclude. Also skip trying to load netdevsim modules if it's already loaded (builtin). v2: - drop iproute2->bpftool changes (Toke) Signed-off-by: Stanislav Fomichev Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221206232739.2504890-1-sdf@google.com commit 4bd1d80efb5af640f99157f39b50fb11326ce641 Author: Sergey Matyukevich Date: Mon Aug 29 23:52:19 2022 +0300 riscv: mm: notify remote harts about mmu cache updates Current implementation of update_mmu_cache function performs local TLB flush. It does not take into account ASID information. Besides, it does not take into account other harts currently running the same mm context or possible migration of the running context to other harts. Meanwhile TLB flush is not performed for every context switch if ASID support is enabled. Patch [1] proposed to add ASID support to update_mmu_cache to avoid flushing local TLB entirely. This patch takes into account other harts currently running the same mm context as well as possible migration of this context to other harts. For this purpose the approach from flush_icache_mm is reused. Remote harts currently running the same mm context are informed via SBI calls that they need to flush their local TLBs. All the other harts are marked as needing a deferred TLB flush when this mm context runs on them. [1] https://lore.kernel.org/linux-riscv/20220821013926.8968-1-tjytimi@163.com/ Signed-off-by: Sergey Matyukevich Fixes: 65d4b9c53017 ("RISC-V: Implement ASID allocator") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.com/#t Signed-off-by: Palmer Dabbelt commit ff36c447e2330625066d193a25a8f94c1408d9d9 Merge: ddda6326eef99 0e706f7961a44 Author: Jakub Kicinski Date: Thu Dec 8 14:27:50 2022 -0800 Merge branch 'mlx4-better-big-tcp-support' Eric Dumazet says: ==================== mlx4: better BIG-TCP support mlx4 uses a bounce buffer in TX whenever the tx descriptors wrap around the right edge of the ring. Size of this bounce buffer was hard coded and can be increased if/when needed. ==================== Link: https://lore.kernel.org/r/20221207141237.2575012-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0e706f7961a44f4be13cf9b5eedb70f0ab2724b8 Author: Eric Dumazet Date: Wed Dec 7 14:12:37 2022 +0000 net/mlx4: small optimization in mlx4_en_xmit() Test against MLX4_MAX_DESC_TXBBS only matters if the TX bounce buffer is going to be used. Signed-off-by: Eric Dumazet Cc: Wei Wang Reviewed-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 26782aad00ccb8f8e5ae6221358fa79cdafc8548 Author: Eric Dumazet Date: Wed Dec 7 14:12:36 2022 +0000 net/mlx4: MLX4_TX_BOUNCE_BUFFER_SIZE depends on MAX_SKB_FRAGS Google production kernel has increased MAX_SKB_FRAGS to 45 for BIG-TCP rollout. Unfortunately mlx4 TX bounce buffer is not big enough whenever an skb has up to 45 page fragments. This can happen often with TCP TX zero copy, as one frag usually holds 4096 bytes of payload (order-0 page). Tested: Kernel built with MAX_SKB_FRAGS=45 ip link set dev eth0 gso_max_size 185000 netperf -t TCP_SENDFILE I made sure that "ethtool -G eth0 tx 64" was properly working, ring->full_size being set to 15. Signed-off-by: Eric Dumazet Reported-by: Wei Wang Reviewed-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 35f31ff0c0b62b9e864fdb92bc1af9212818d624 Author: Eric Dumazet Date: Wed Dec 7 14:12:35 2022 +0000 net/mlx4: rename two constants MAX_DESC_SIZE is really the size of the bounce buffer used when reaching the right side of TX ring buffer. MAX_DESC_TXBBS get a MLX4_ prefix. Signed-off-by: Eric Dumazet Reviewed-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 95af1f1c4c9f9f08bbdb40812248b7bc5868a1da Author: Jacob Keller Date: Mon Dec 5 11:52:53 2022 -0800 ice: reschedule ice_ptp_wait_for_offset_valid during reset If the ice_ptp_wait_for_offest_valid function is scheduled to run while the driver is resetting, it will exit without completing calibration. The work function gets scheduled by ice_ptp_port_phy_restart which will be called as part of the reset recovery process. It is possible for the first execution to occur before the driver has completely cleared its resetting flags. Ensure calibration completes by rescheduling the task until reset is fully completed. Reported-by: Siddaraju DH Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f029a34394e7239f4111507b402ab234f990ec94 Author: Siddaraju DH Date: Mon Dec 5 11:52:52 2022 -0800 ice: make Tx and Rx vernier offset calibration independent The Tx and Rx calibration and timestamp generation blocks are independent. However, the ice driver waits until both blocks are ready before configuring either block. This can result in delay of configuring one block because we have not yet received a packet in the other block. There is no reason to wait to finish programming Tx just because we haven't received a packet. Similarly there is no reason to wait to program Rx just because we haven't transmitted a packet. Instead of checking both offset status before programming either block, refactor the ice_phy_cfg_tx_offset_e822 and ice_phy_cfg_rx_offset_e822 functions so that they perform their own offset status checks. Additionally, make them also check the offset ready bit to determine if the offset values have already been programmed. Call the individual configure functions directly in ice_ptp_wait_for_offset_valid. The functions will now correctly check status, and program the offsets if ready. Once the offset is programmed, the functions will exit quickly after just checking the offset ready register. Remove the ice_phy_calc_vernier_e822 in ice_ptp_hw.c, as well as the offset valid check functions in ice_ptp.c entirely as they are no longer necessary. With this change, the Tx and Rx blocks will each be enabled as soon as possible without waiting for the other block to complete calibration. This can enable timestamps faster in setups which have a low rate of transmitted or received packets. In particular, it can stop a situation where one port never receives traffic, and thus never finishes calibration of the Tx block, resulting in continuous faults reported by the ptp4l daemon application. Signed-off-by: Siddaraju DH Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e3ba5248669310537cac55d63dd3c4059b862e00 Author: Jacob Keller Date: Mon Dec 5 11:52:51 2022 -0800 ice: only check set bits in ice_ptp_flush_tx_tracker The ice_ptp_flush_tx_tracker function is called to clear all outstanding Tx timestamp requests when the port is being brought down. This function iterates over the entire list, but this is unnecessary. We only need to check the bits which are actually set in the ready bitmap. Replace this logic with for_each_set_bit, and follow a similar flow as in ice_ptp_tx_tstamp_cleanup. Note that it is safe to call dev_kfree_skb_any on a NULL pointer as it will perform a no-op so we do not need to verify that the skb is actually NULL. The new implementation also avoids clearing (and thus reading!) the PHY timestamp unless the index is marked as having a valid timestamp in the timestamp status bitmap. This ensures that we properly clear the status registers as appropriate. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit d40fd60093325cd7b77bc8622cb9593cd27fdaa6 Author: Jacob Keller Date: Mon Dec 5 11:52:50 2022 -0800 ice: handle flushing stale Tx timestamps in ice_ptp_tx_tstamp In the event of a PTP clock time change due to .adjtime or .settime, the ice driver needs to update the cached copy of the PHC time and also discard any outstanding Tx timestamps. This is required because otherwise the wrong copy of the PHC time will be used when extending the Tx timestamp. This could result in reporting incorrect timestamps to the stack. The current approach taken to handle this is to call ice_ptp_flush_tx_tracker, which will discard any timestamps which are not yet complete. This is problematic for two reasons: 1) it could lead to a potential race condition where the wrong timestamp is associated with a future packet. This can occur with the following flow: 1. Thread A gets request to transmit a timestamped packet, and picks an index and transmits the packet 2. Thread B calls ice_ptp_flush_tx_tracker and sees the index in use, marking is as disarded. No timestamp read occurs because the status bit is not set, but the index is released for re-use 3. Thread A gets a new request to transmit another timestamped packet, picks the same (now unused) index and transmits that packet. 4. The PHY transmits the first packet and updates the timestamp slot and generates an interrupt. 5. The ice_ptp_tx_tstamp thread executes and sees the interrupt and a valid timestamp but associates it with the new Tx SKB and not the one that actual timestamp for the packet as expected. This could result in the previous timestamp being assigned to a new packet producing incorrect timestamps and leading to incorrect behavior in PTP applications. This is most likely to occur when the packet rate for Tx timestamp requests is very high. 2) on E822 hardware, we must avoid reading a timestamp index more than once each time its status bit is set and an interrupt is generated by hardware. We do have some extensive checks for the unread flag to ensure that only one of either the ice_ptp_flush_tx_tracker or ice_ptp_tx_tstamp threads read the timestamp. However, even with this we can still have cases where we "flush" a timestamp that was actually completed in hardware. This can lead to cases where we don't read the timestamp index as appropriate. To fix both of these issues, we must avoid calling ice_ptp_flush_tx_tracker outside of the teardown path. Rather than using ice_ptp_flush_tx_tracker, introduce a new state bitmap, the stale bitmap. Start this as cleared when we begin a new timestamp request. When we're about to extend a timestamp and send it up to the stack, first check to see if that stale bit was set. If so, drop the timestamp without sending it to the stack. When we need to update the cached PHC timestamp out of band, just mark all currently outstanding timestamps as stale. This will ensure that once hardware completes the timestamp we'll ignore it correctly and avoid reporting bogus timestamps to userspace. With this change, we fix potential issues caused by calling ice_ptp_flush_tx_tracker during normal operation. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit c1f3414df2e86e63d603712f81443af6cf07f8a3 Author: Jacob Keller Date: Mon Dec 5 11:52:49 2022 -0800 ice: cleanup allocations in ice_ptp_alloc_tx_tracker The ice_ptp_alloc_tx_tracker function must allocate the timestamp array and the bitmap for tracking the currently in use indexes. A future change is going to add yet another allocation to this function. If these allocations fail we need to ensure that we properly cleanup and ensure that the pointers in the ice_ptp_tx structure are NULL. Simplify this logic by allocating to local variables first. If any allocation fails, then free everything and exit. Only update the ice_ptp_tx structure if all allocations succeed. This ensures that we have no side effects on the Tx structure unless all allocations have succeeded. Thus, no code will see an invalid pointer and we don't need to re-assign NULL on cleanup. This is safe because kernel "free" functions are designed to be NULL safe and perform no action if passed a NULL pointer. Thus its safe to simply always call kfree or bitmap_free even if one of those pointers was NULL. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3ad5c10bf21d1d69ac1117a89b3ce2271a832b34 Author: Jacob Keller Date: Mon Dec 5 11:52:47 2022 -0800 ice: protect init and calibrating check in ice_ptp_request_ts When requesting a new timestamp, the ice_ptp_request_ts function does not hold the Tx tracker lock while checking init and calibrating. This means that we might issue a new timestamp request just after the Tx timestamp tracker starts being deinitialized. This could lead to incorrect access of the timestamp structures. Correct this by moving the init and calibrating checks under the lock, and updating the flows which modify these fields to use the lock. Note that we do not need to hold the lock while checking for tx->init in ice_ptp_tx_tstamp. This is because the teardown function will use synchronize_irq after clearing the flag to ensure that the threaded interrupt completes. Either a) the tx->init flag will be cleared before the ice_ptp_tx_tstamp function starts, thus it will exit immediately, or b) the threaded interrupt will be executing and the synchronize_irq will wait until the threaded interrupt has completed at which point we know the init field has definitely been set and new interrupts will not execute the Tx timestamp thread function. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 895fa59647cd64da99eebd1199cf27ecce08c17c Author: Li Qiong Date: Tue Dec 6 15:44:14 2022 +0800 netfilter: flowtable: add a 'default' case to flowtable datapath Add a 'default' case in case return a uninitialized value of ret, this should not ever happen since the follow transmit path types: - FLOW_OFFLOAD_XMIT_UNSPEC - FLOW_OFFLOAD_XMIT_TC are never observed from this path. Add this check for safety reasons. Signed-off-by: Li Qiong Signed-off-by: Pablo Neira Ayuso commit ddda6326eef9961faef4735c6dd596475e7bdb65 Merge: bde55dd9ccda7 3603f26633e76 Author: Jakub Kicinski Date: Thu Dec 8 13:04:57 2022 -0800 Merge branch 'mlx5-Support-tc-police-jump-conform-exceed-attribute' Saeed Mahameed says: ==================== Support tc police jump conform-exceed attribute The tc police action conform-exceed option defines how to handle packets which exceed or conform to the configured bandwidth limit. One of the possible conform-exceed values is jump, which skips over a specified number of actions. This series adds support for conform-exceed jump action. The series adds platform support for branching actions by providing true/false flow attributes to the branching action. This is necessary for supporting police jump, as each branch may execute a different action list. The first five patches are preparation patches: - Patches 1 and 2 add support for actions with no destinations (e.g. drop) - Patch 3 refactor the code for subsequent function reuse - Patch 4 defines an abstract way for identifying terminating actions - Patch 5 updates action list validations logic considering branching actions The following three patches introduce an interface for abstracting branching actions: - Patch 6 introduces an abstract api for defining branching actions - Patch 7 generically instantiates the branching flow attributes using the abstract API Patch 8 adds the platform support for jump actions, by executing the following sequence: a. Store the jumping flow attr b. Identify the jump target action while iterating the actions list. c. Instantiate a new flow attribute after the jump target action. This is the flow attribute that the branching action should jump to. d. Set the target post action id on: d.1. The jumping attribute, thus realizing the jump functionality. d.2. The attribute preceding the target jump attr, if not terminating. The next patches apply the platform's branching attributes to the police action: - Patch 9 is a refactor patch - Patch 10 initializes the post meter table with the red/green flow attributes, as were initialized by the platform - Patch 11 enables the offload of meter actions using jump conform-exceed value. ==================== Link: https://lore.kernel.org/all/20221203221337.29267-1-saeed@kernel.org/ Signed-off-by: Jakub Kicinski commit 3603f26633e7624cb33f47fc92843db55c798097 Author: Oz Shlomo Date: Sat Dec 3 14:13:33 2022 -0800 net/mlx5e: TC, allow meter jump control action Separate the matchall police action validation from flower validation. Isolate the action validation logic in the police action parser. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-12-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 0d8c38d44f338bbe5772532127fdbacc9f608ac8 Author: Oz Shlomo Date: Sat Dec 3 14:13:32 2022 -0800 net/mlx5e: TC, init post meter rules with branching attributes Instantiate the post meter actions with the platform initialized branching action attributes. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-11-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 3fcb94e393576aa64315964b42eeb1db580957d3 Author: Oz Shlomo Date: Sat Dec 3 14:13:31 2022 -0800 net/mlx5e: TC, rename post_meter actions Currently post meter supports only the pipe/drop conform-exceed policy. This assumption is reflected in several variable names. Rename the following variables as a pre-step for using the generalized branching action platform. Rename fwd_green_rule/drop_red_rule to green_rule/red_rule respectively. Repurpose red_counter/green_counter to act_counter/drop_counter to allow police conform-exceed configurations that do not drop. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-10-saeed@kernel.org Signed-off-by: Jakub Kicinski commit c84fa1ab94a77c069503fb816c7aa310a6d10e31 Author: Oz Shlomo Date: Sat Dec 3 14:13:30 2022 -0800 net/mlx5e: TC, initialize branching action with target attr Identify the jump target action when iterating the action list. Initialize the jump target attr with the jumping attribute during the parsing phase. Initialize the jumping attr post action with the target during the offload phase. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-9-saeed@kernel.org Signed-off-by: Jakub Kicinski commit f86488cb4685bbb885057afa0b61bb8afc1d6bb1 Author: Oz Shlomo Date: Sat Dec 3 14:13:29 2022 -0800 net/mlx5e: TC, initialize branch flow attributes Initialize flow attribute for drop, accept, pipe and jump branching actions. Instantiate a flow attribute instance according to the specified branch control action. Store the branching attributes on the branching action flow attribute during the parsing phase. Then, during the offload phase, allocate the relevant mod header objects to the branching actions. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-8-saeed@kernel.org Signed-off-by: Jakub Kicinski commit ec5878552b73cbb7e7d72f9a1a3d8a23a43a0bb2 Author: Oz Shlomo Date: Sat Dec 3 14:13:28 2022 -0800 net/mlx5e: TC, set control params for branching actions Extend the act tc api to set the branch control params aligning with the police conform/exceed use case. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-7-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 6442638251f3679a05a75e69d5096680c14a210e Author: Oz Shlomo Date: Sat Dec 3 14:13:27 2022 -0800 net/mlx5e: TC, validate action list per attribute Currently the entire flow action list is validate for offload limitations. For example, flow with both forward and drop actions are declared invalid due to hardware restrictions. However, a multi-table hardware model changes the limitations from a flow scope to a single flow attribute scope. Apply offload limitations to flow attributes instead of the entire flow. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-6-saeed@kernel.org Signed-off-by: Jakub Kicinski commit d3f6b0df9128c00c54e11702f62b967fc63c85f3 Author: Oz Shlomo Date: Sat Dec 3 14:13:26 2022 -0800 net/mlx5e: TC, add terminating actions Extend act api to identify actions that terminate action list. Pre-step for terminating branching actions. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-5-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 8facc02f22f17879351419df9b253e06dc1f618b Author: Oz Shlomo Date: Sat Dec 3 14:13:25 2022 -0800 net/mlx5e: TC, reuse flow attribute post parser processing After the tc action parsing phase the flow attribute is initialized with relevant eswitch offload objects such as tunnel, vlan, header modify and counter attributes. The post processing is done both for fdb and post-action attributes. Reuse the flow attribute post parsing logic by both fdb and post-action offloads. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-4-saeed@kernel.org Signed-off-by: Jakub Kicinski commit f07d8afb1ceae57767cf80c134b7a03e9c589276 Author: Oz Shlomo Date: Sat Dec 3 14:13:24 2022 -0800 net/mlx5: fs, assert null dest pointer when dest_num is 0 Currently create_flow_handle() assumes a null dest pointer when there are no destinations. This might not be the case as the caller may pass an allocated dest array while setting the dest_num parameter to 0. Assert null dest array for flow rules that have no destinations (e.g. drop rule). Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-3-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 5a5624d1edf44e808481dedaf59eae61fd66e052 Author: Oz Shlomo Date: Sat Dec 3 14:13:23 2022 -0800 net/mlx5e: E-Switch, handle flow attribute with no destinations Rules with drop action are not required to have a destination. Currently the destination list is allocated with the maximum number of destinations and passed to the fs_core layer along with the actual number of destinations. Remove redundant passing of dest pointer when count of dest is 0. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20221203221337.29267-2-saeed@kernel.org Signed-off-by: Jakub Kicinski commit f04facfb993de47e2133b2b842d72b97b1c50162 Author: Fan Ni Date: Mon Nov 7 21:22:31 2022 +0000 cxl/region: Fix memdev reuse check Due to a typo, the check of whether or not a memdev has already been used as a target for the region (above code piece) will always be skipped. Given a memdev with more than one HDM decoder, an interleaved region can be created that maps multiple HPAs to the same DPA. According to CXL spec 3.0 8.1.3.8.4, "Aliasing (mapping more than one Host Physical Address (HPA) to a single Device Physical Address) is forbidden." Fix this by using existing iterator for memdev reuse check. Cc: Fixes: 384e624bb211 ("cxl/region: Attach endpoint decoders") Signed-off-by: Fan Ni Link: https://lore.kernel.org/r/20221107212153.745993-1-fan.ni@samsung.com Signed-off-by: Dan Williams commit 5fb45f95eec682621748b7cb012c6a8f0f981e6a Author: Qingfang DENG Date: Thu Dec 8 20:35:29 2022 +0800 netfilter: flowtable: really fix NAT IPv6 offload The for-loop was broken from the start. It translates to: for (i = 0; i < 4; i += 4) which means the loop statement is run only once, so only the highest 32-bit of the IPv6 address gets mangled. Fix the loop increment. Fixes: 0e07e25b481a ("netfilter: flowtable: fix NAT IPv6 offload mangling") Fixes: 5c27d8d76ce8 ("netfilter: nf_flow_table_offload: add IPv6 support") Signed-off-by: Qingfang DENG Signed-off-by: Pablo Neira Ayuso commit f0ae124019faaa03f8b4c3fbe52ae35ab3a8dbda Author: Jacob Keller Date: Mon Dec 5 11:52:46 2022 -0800 ice: synchronize the misc IRQ when tearing down Tx tracker Since commit 1229b33973c7 ("ice: Add low latency Tx timestamp read") the ice driver has used a threaded IRQ for handling Tx timestamps. This change did not add a call to synchronize_irq during ice_ptp_release_tx_tracker. Thus it is possible that an interrupt could occur just as the tracker is being removed. This could lead to a use-after-free of the Tx tracker structure data. Fix this by calling sychronize_irq in ice_ptp_release_tx_tracker after we've cleared the init flag. In addition, make sure that we re-check the init flag at the end of ice_ptp_tx_tstamp before we exit ensuring that we will stop polling for new timestamps once the tracker de-initialization has begun. Refactor the ts_handled variable into "more_timestamps" so that we can simply directly assign this boolean instead of relying on an initialized value of true. This makes the new combined check easier to read. With this change, the ice_ptp_release_tx_tracker function will now wait for the threaded interrupt to complete if it was executing while the init flag was cleared. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 10e4b4a3a3e1b7007a72988bb0a7c741b19d90d7 Author: Jacob Keller Date: Mon Dec 5 11:52:45 2022 -0800 ice: check Tx timestamp memory register for ready timestamps The PHY for E822 based hardware has a register which indicates which timestamps are valid in the PHY timestamp memory block. Each bit in the register indicates whether the associated index in the timestamp memory is valid. Hardware sets this bit when the timestamp is captured, and clears the bit when the timestamp is read. Use of this register is important as reading timestamp registers can impact the way that hardware generates timestamp interrupts. This occurs because the PHY has an internal value which is incremented when hardware captures a timestamp and decremented when software reads a timestamp. Reading timestamps which are not marked as valid still decrement the internal value and can result in the Tx timestamp interrupt not triggering in the future. To prevent this, use the timestamp memory value to determine which timestamps are ready to be read. The ice_get_phy_tx_tstamp_ready function reads this value. For E810 devices, this just always returns with all bits set. Skip any timestamp which is not set in this bitmap, avoiding reading extra timestamps on E822 devices. The stale check against a cached timestamp value is no longer necessary for PHYs which support the timestamp ready bitmap properly. E810 devices still need this. Introduce a new verify_cached flag to the ice_ptp_tx structure. Use this to determine if we need to perform the verification against the cached timestamp value. Set this to 1 for the E810 Tx tracker init function. Notice that many of the fields in ice_ptp_tx are simple 1 bit flags. Save some structure space by using bitfields of length 1 for these values. Modify the ICE_PTP_TS_VALID check to simply drop the timestamp immediately so that in an event of getting such an invalid timestamp the driver does not attempt to re-read the timestamp again in a future poll of the register. With these changes, the driver now reads each timestamp register exactly once, and does not attempt any re-reads. This ensures the interrupt tracking logic in the PHY will not get stuck. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0dd9286263923860a1829778e232a501b49c485f Author: Jacob Keller Date: Mon Dec 5 11:52:44 2022 -0800 ice: handle discarding old Tx requests in ice_ptp_tx_tstamp Currently the driver uses the PTP kthread to process handling and discarding of stale Tx timestamp requests. The function ice_ptp_tx_tstamp_cleanup is used for this. A separate thread creates complications for the driver as we now have both the main Tx timestamp processing IRQ checking timestamps as well as the kthread. Rather than using the kthread to handle this, simply check for stale timestamps within the ice_ptp_tx_tstamp function. This function must already process the timestamps anyways. If a Tx timestamp has been waiting for 2 seconds we simply clear the bit and discard the SKB. This avoids the complication of having separate threads polling, reducing overall CPU work. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 6b1ff5d392283b737abc038f7ab1509d9b8311c7 Author: Jacob Keller Date: Mon Dec 5 11:52:43 2022 -0800 ice: always call ice_ptp_link_change and make it void The ice_ptp_link_change function is currently only called for E822 based hardware. Future changes are going to extend this function to perform additional tasks on link change. Always call this function, moving the E810 check from the callers down to just before we call the E822-specific function required to restart the PHY. This function also returns an error value, but none of the callers actually check it. In general, the errors it produces are more likely systemic problems such as invalid or corrupt port numbers. No caller checks these, and so no warning is logged. Re-order the flag checks so that ICE_FLAG_PTP is checked first. Drop the unnecessary check for ICE_FLAG_PTP_SUPPORTED, as ICE_FLAG_PTP will not be set except when ICE_FLAG_PTP_SUPPORTED is set. Convert the port checks to WARN_ON_ONCE, in order to generate a kernel stack trace when they are hit. Convert the function to void since no caller actually checks these return values. Co-developed-by: Dave Ertman Signed-off-by: Dave Ertman Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 11722c39c8d91cfb97197f8f5e2d45c9ebf27bb6 Author: Jacob Keller Date: Mon Dec 5 11:52:42 2022 -0800 ice: fix misuse of "link err" with "link status" The ice_ptp_link_change function has a comment which mentions "link err" when referring to the current link status. We are storing the status of whether link is up or down, which is not an error. It is appears that this use of err accidentally got included due to an overzealous search and replace when removing the ice_status enum and local status variable. Fix the wording to use the correct term. Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 407b66c07e9837cd11564746faaac4f32a0c5c5b Author: Karol Kolacinski Date: Mon Dec 5 11:52:41 2022 -0800 ice: Reset TS memory for all quads In E822 products, the owner PF should reset memory for all quads, not only for the one where assigned lport is. Signed-off-by: Karol Kolacinski Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0357d5cab8e497517d19b745d386573b97e2bc4b Author: Milena Olech Date: Mon Dec 5 11:52:40 2022 -0800 ice: Remove the E822 vernier "bypass" logic The E822 devices support an extended "vernier" calibration which enables higher precision timestamps by accounting for delays in the PHY, and compensating for them. These delays are measured by hardware as part of its vernier calibration logic. The driver currently starts the PHY in "bypass" mode which skips the compensation. Then it later attempts to switch from bypass to vernier. This unfortunately does not work as expected. Instead of properly compensating for the delays, the hardware continues operating in bypass without the improved precision expected. Because we cannot dynamically switch between bypass and vernier mode, refactor the driver to always operate in vernier mode. This has a slight downside: Tx timestamp and Rx timestamp requests that occur as the very first packet set after link up will not complete properly and may be reported to applications as missing timestamps. This occurs frequently in test environments where traffic is light or targeted specifically at testing PTP. However, in practice most environments will have transmitted or received some data over the network before such initial requests are made. Signed-off-by: Milena Olech Signed-off-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 6b5cbc8c4ec71e49dc8d2c393b105e8007a02b41 Author: Sergey Temerkhanov Date: Mon Dec 5 11:52:39 2022 -0800 ice: Use more generic names for ice_ptp_tx fields Some supported devices have per-port timestamp memory blocks while others have shared ones within quads. Rename the struct ice_ptp_tx fields to reflect the block entities it works with Signed-off-by: Sergey Temerkhanov Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit c2cc0ce72a5ed3e01705e14221d97e96ed7a37b8 Author: Yang Jihong Date: Thu Dec 8 09:37:24 2022 +0800 bpf: Fix comment error in fixup_kfunc_call function insn->imm for kfunc is the relative address of __bpf_call_base, instead of __bpf_base_call, Fix the comment error. Signed-off-by: Yang Jihong Link: https://lore.kernel.org/r/20221208013724.257848-1-yangjihong1@huawei.com Signed-off-by: Alexei Starovoitov commit d35af0a7feb077c43ff0233bba5a8c6e75b73e35 Author: Björn Töpel Date: Wed Dec 7 11:35:40 2022 +0100 bpf: Do not zero-extend kfunc return values In BPF all global functions, and BPF helpers return a 64-bit value. For kfunc calls, this is not the case, and they can return e.g. 32-bit values. The return register R0 for kfuncs calls can therefore be marked as subreg_def != DEF_NOT_SUBREG. In general, if a register is marked with subreg_def != DEF_NOT_SUBREG, some archs (where bpf_jit_needs_zext() returns true) require the verifier to insert explicit zero-extension instructions. For kfuncs calls, however, the caller should do sign/zero extension for return values. In other words, the compiler is responsible to insert proper instructions, not the verifier. An example, provided by Yonghong Song: $ cat t.c extern unsigned foo(void); unsigned bar1(void) { return foo(); } unsigned bar2(void) { if (foo()) return 10; else return 20; } $ clang -target bpf -mcpu=v3 -O2 -c t.c && llvm-objdump -d t.o t.o: file format elf64-bpf Disassembly of section .text: 0000000000000000 : 0: 85 10 00 00 ff ff ff ff call -0x1 1: 95 00 00 00 00 00 00 00 exit 0000000000000010 : 2: 85 10 00 00 ff ff ff ff call -0x1 3: bc 01 00 00 00 00 00 00 w1 = w0 4: b4 00 00 00 14 00 00 00 w0 = 0x14 5: 16 01 01 00 00 00 00 00 if w1 == 0x0 goto +0x1 6: b4 00 00 00 0a 00 00 00 w0 = 0xa 0000000000000038 : 7: 95 00 00 00 00 00 00 00 exit If the return value of 'foo()' is used in the BPF program, the proper zero-extension will be done. Currently, the verifier correctly marks, say, a 32-bit return value as subreg_def != DEF_NOT_SUBREG, but will fail performing the actual zero-extension, due to a verifier bug in opt_subreg_zext_lo32_rnd_hi32(). load_reg is not properly set to R0, and the following path will be taken: if (WARN_ON(load_reg == -1)) { verbose(env, "verifier bug. zext_dst is set, but no reg is defined\n"); return -EFAULT; } A longer discussion from v1 can be found in the link below. Correct the verifier by avoiding doing explicit zero-extension of R0 for kfunc calls. Note that R0 will still be marked as a sub-register for return values smaller than 64-bit. Fixes: 83a2881903f3 ("bpf: Account for BPF_FETCH in insn_has_def32()") Link: https://lore.kernel.org/bpf/20221202103620.1915679-1-bjorn@kernel.org/ Suggested-by: Yonghong Song Signed-off-by: Björn Töpel Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20221207103540.396496-1-bjorn@kernel.org Signed-off-by: Alexei Starovoitov commit e8dfdf3162eb549d064b8c10b1564f7e8ee82591 Author: Ard Biesheuvel Date: Fri Oct 28 16:39:14 2022 +0200 arm64: efi: Recover from synchronous exceptions occurring in firmware Unlike x86, which has machinery to deal with page faults that occur during the execution of EFI runtime services, arm64 has nothing like that, and a synchronous exception raised by firmware code brings down the whole system. With more EFI based systems appearing that were not built to run Linux (such as the Windows-on-ARM laptops based on Qualcomm SOCs), as well as the introduction of PRM (platform specific firmware routines that are callable just like EFI runtime services), we are more likely to run into issues of this sort, and it is much more likely that we can identify and work around such issues if they don't bring down the system entirely. Since we already use a EFI runtime services call wrapper in assembler, we can quite easily add some code that captures the execution state at the point where the call is made, allowing us to revert to this state and proceed execution if the call triggered a synchronous exception. Given that the kernel and the firmware don't share any data structures that could end up in an indeterminate state, we can happily continue running, as long as we mark the EFI runtime services as unavailable from that point on. Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas commit 870af777da22505851174a34c0228042d7ed5f5f Author: Yangtao Li Date: Fri Nov 25 19:47:36 2022 +0800 f2fs: do some cleanup for f2fs module init Just for cleanup, no functional changes. Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit 398bb30d4f4e857ee1352130c6935f0fb16d7af2 Author: Chao Yu Date: Sat Nov 26 10:38:07 2022 +0800 MAINTAINERS: Add f2fs bug tracker link As f2fs component in bugzilla.kernel.org was created and used since 2018-7. Signed-off-by: Chao Yu Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit 5bcd655fffaec24e849bda1207446f5cc821713e Author: Christoph Hellwig Date: Mon Nov 28 10:43:46 2022 +0100 f2fs: remove the unused flush argument to change_curseg Signed-off-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8442d94b8ac8d5d8300725a9ffa9def526b71170 Author: Christoph Hellwig Date: Mon Nov 28 10:43:45 2022 +0100 f2fs: open code allocate_segment_by_default allocate_segment_by_default has just two callers, which use very different code pathes inside it based on the force paramter. Just open code the logic in the two callers using a new helper to decided if a new segment should be allocated. Signed-off-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1c8a8ec0a0e9a1176022a35c4daf04fe1594d270 Author: Christoph Hellwig Date: Mon Nov 28 10:43:44 2022 +0100 f2fs: remove struct segment_allocation default_salloc_ops There is only single instance of these ops, so remove the indirection and call allocate_segment_by_default directly. Signed-off-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7991dbff6849f67e823b7cc0c15e5a90b0549b9f Author: Zhihao Cheng Date: Thu Dec 8 22:28:02 2022 +0800 dm thin: Use last transaction's pmd->root when commit failed Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata: Kernel panic - not syncing: softlockup: hung tasks CPU: 7 PID: 2669225 Comm: kworker/u16:3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: dm-thin do_worker [dm_thin_pool] Call Trace: dump_stack+0x9c/0xd3 panic+0x35d/0x6b9 watchdog_timer_fn.cold+0x16/0x25 __run_hrtimer+0xa2/0x2d0 RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio] __bufio_new+0x11f/0x4f0 [dm_bufio] new_read+0xa3/0x1e0 [dm_bufio] dm_bm_read_lock+0x33/0xd0 [dm_persistent_data] ro_step+0x63/0x100 [dm_persistent_data] btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data] dm_btree_lookup+0x16f/0x210 [dm_persistent_data] dm_thin_find_block+0x12c/0x210 [dm_thin_pool] __process_bio_read_only+0xc5/0x400 [dm_thin_pool] process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool] process_one_work+0x3c5/0x730 Following process may generate a broken btree mixed with fresh and stale btree nodes, which could get dm thin trapped in an infinite loop while looking up data block: Transaction 1: pmd->root = A, A->B->C // One path in btree pmd->root = X, X->Y->Z // Copy-up Transaction 2: X,Z is updated on disk, Y write failed. // Commit failed, dm thin becomes read-only. process_bio_read_only dm_thin_find_block __find_block dm_btree_lookup(pmd->root) The pmd->root points to a broken btree, Y may contain stale node pointing to any block, for example X, which gets dm thin trapped into a dead loop while looking up Z. Fix this by setting pmd->root in __open_metadata(), so that dm thin will use the last transaction's pmd->root if commit failed. Fetch a reproducer in [Link]. Linke: https://bugzilla.kernel.org/show_bug.cgi?id=216790 Cc: stable@vger.kernel.org Fixes: 991d9fa02da0 ("dm: add thin provisioning target") Signed-off-by: Zhihao Cheng Acked-by: Joe Thornber Signed-off-by: Mike Snitzer commit c1ddc3dad85dda4421e852c72f7596cdb10e9fc6 Author: Michal Simek Date: Thu Dec 8 13:38:50 2022 +0100 PCI: xilinx-nwl: Fix coding style violations Fix code alignments and remove additional newline. Link: https://lore.kernel.org/r/17c75e7003bb8c43a0f45ae3d7c45cac230ef852.1670503129.git.michal.simek@amd.com Signed-off-by: Michal Simek Signed-off-by: Bjorn Helgaas commit c83ce312081cf024b00a8a7fe785a90ba94b69fb Merge: da060ab86eb0d 67327f125801f Author: Arnd Bergmann Date: Thu Dec 8 17:44:12 2022 +0100 Merge tag 'asahi-soc-dt-6.2-v3' of https://github.com/AsahiLinux/linux into soc/dt Apple SoC DT updates for 6.2 (v3). One final update for 6.2. This includes: * L1/L2 cache topology for t8103 * A bunch of typo, style, and minor functional fixes * tag 'asahi-soc-dt-6.2-v3' of https://github.com/AsahiLinux/linux: arm64: dts: apple: t6002: Fix GPU power domains arm64: dts: apple: t600x-pmgr: Fix search & replace typo arm64: dts: apple: Add t8103 L1/L2 cache properties and nodes arm64: dts: apple: Rename dart-sio* to sio-dart* arch: arm64: apple: t600x: Use standard "iommu" node name arch: arm64: apple: t8103: Use standard "iommu" node name Link: https://lore.kernel.org/r/488ad4e9-04dc-1774-3bbe-d313ef30f14d@marcan.st Signed-off-by: Arnd Bergmann commit ab4620f58d38206687b9f99d9d2cc1d5a2640985 Author: Hans de Goede Date: Thu Dec 8 15:23:35 2022 +0100 ACPI: EC: Fix ECDT probe ordering issues ACPI-2.0 says that the EC OpRegion handler must be available immediately (like the standard default OpRegion handlers): Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ... 2. OSPM must make Embedded Controller operation regions, accessed via the Embedded Controllers described in ECDT, available before executing any control method. These operation regions may become inaccessible after OSPM runs _REG(EmbeddedControl, 0)." So acpi_bus_init() calls acpi_ec_ecdt_probe(), which calls acpi_install_address_space_handler() to install the EC's OpRegion handler, early on. This not only installs the OpRegion handler, but also calls the EC's _REG method. The _REG method call is a problem because it may rely on initialization done by the _INI methods of one of the PCI / _SB root devs, see for example: https://bugzilla.kernel.org/show_bug.cgi?id=214899 . Generally speaking _REG methods are executed when the ACPI-device they are part of has a driver bound to it. Where as _INI methods must be executed at table load time (according to the spec). The problem here is that the early acpi_install_address_space_handler() call causes the _REG handler to run too early. To allow fixing this the ACPICA code now allows to split the OpRegion handler installation and the executing of _REG into 2 separate steps. This commit uses this ACPICA functionality to fix the EC probe ordering by delaying the executing of _REG for ECDT described ECs till the matching EC device in the DSDT gets parsed and acpi_ec_add() for it gets called. This moves the calling of _REG for the EC on devices with an ECDT to the same point in time where it is called on devices without an ECDT table. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214899 Reported-and-tested-by: Johannes Penßel Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit a5072078dbfaa9d70130805766dfa34bbb7bf2a7 Author: Hans de Goede Date: Thu Dec 8 15:23:34 2022 +0100 ACPI: EC: Fix EC address space handler unregistration When an ECDT table is present the EC address space handler gets registered on the root node. So to unregister it properly the unregister call also must be done on the root node. Store the ACPI handle used for the acpi_install_address_space_handler() call and use te same handle for the acpi_remove_address_space_handler() call. Reported-by: Rafael J. Wysocki Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 0634033dd104da8bf3903ff9b7f57ae81c6e1640 Merge: 54c516aeb8b39 b423f240a66ad Author: Rafael J. Wysocki Date: Thu Dec 8 17:39:45 2022 +0100 Merge back ACPI EC changes for 6.2-rc1 commit 54c516aeb8b39eeae6450b7d8076d381568dca46 Author: Hans de Goede Date: Thu Dec 8 15:23:33 2022 +0100 ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps ACPI-2.0 says that the EC op_region handler must be available immediately (like the standard default op_region handlers): Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ... 2. OSPM must make Embedded Controller operation regions, accessed via the Embedded Controllers described in ECDT, available before executing any control method. These operation regions may become inaccessible after OSPM runs _REG(EmbeddedControl, 0)." So the OS must probe the ECDT described EC and install the OpRegion handler before calling acpi_enable_subsystem() and acpi_initialize_objects(). This is a problem because calling acpi_install_address_space_handler() does not just install the op_region handler, it also runs the EC's _REG method. This _REG method may rely on initialization done by the _INI methods of one of the PCI / _SB root devices. For the other early/default op_region handlers the op_region handler install and the _REG execution is split into 2 separate steps: 1. acpi_ev_install_region_handlers(), called early from acpi_load_tables() 2. acpi_ev_initialize_op_regions(), called from acpi_initialize_objects() To fix the EC op_region issue, add 2 bew functions: 1. acpi_install_address_space_handler_no_reg() 2. acpi_execute_reg_methods() to allow doing things in 2 steps for other op_region handlers, like the EC handler, too. Note that the comment describing acpi_ev_install_region_handlers() even has an alinea describing this problem. Using the new methods allows users to avoid this problem. Link: https://github.com/acpica/acpica/pull/786 Link: https://bugzilla.kernel.org/show_bug.cgi?id=214899 Reported-and-tested-by: Johannes Penßel Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 7a9d74e7e403cb2e60d4d00c05f2f3ab2a33d0c3 Author: Hans de Goede Date: Thu Dec 8 15:23:32 2022 +0100 ACPICA: include/acpi/acpixf.h: Fix indentation A bunch of the functions declared in include/acpi/acpixf.h have their name aligned a space after the '(' of e.g. the `ACPI_EXTERNAL_RETURN_STATUS(acpi_status` line above rather then being directly aligned after the '('. This breaks applying patches generated from the ACPICA upstream git, remove the extra space before the function-names and all the arguments to fix this. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 7dfb216eda99bbfc2a8c3b03d2eec63314f52b3c Author: Amadeusz Sławiński Date: Thu Dec 8 23:40:16 2022 +0100 ACPICA: Fix operand resolution In our tests we get UBSAN warning coming from ACPI parser. This is caused by trying to resolve operands when there is none. [ 0.000000] Linux version 5.15.0-rc3chromeavsrel1.0.184+ (root@...) (gcc (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1 SMP PREEMPT Sat Oct 16 00:08:27 UTC 2021 ... [ 14.719508] ================================================================================ [ 14.719551] UBSAN: array-index-out-of-bounds in /.../linux/drivers/acpi/acpica/dswexec.c:401:12 [ 14.719594] index -1 is out of range for type 'acpi_operand_object *[9]' [ 14.719621] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc3chromeavsrel1.0.184+ #1 [ 14.719657] Hardware name: Intel Corp. Geminilake/GLK RVP2 LP4SD (07), BIOS GELKRVPA.X64.0214.B50.2009111159 09/11/2020 [ 14.719694] Call Trace: [ 14.719712] dump_stack_lvl+0x38/0x49 [ 14.719749] dump_stack+0x10/0x12 [ 14.719775] ubsan_epilogue+0x9/0x45 [ 14.719801] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 14.719835] acpi_ds_exec_end_op+0x1d7/0x6b5 [ 14.719870] acpi_ps_parse_loop+0x942/0xb34 ... Problem happens because WalkState->NumOperands is 0 and it is used when trying to access into operands table. Actual code is: WalkState->Operands [WalkState->NumOperands -1] which causes out of bound access. Improve the check before above access to check if ACPI opcode should have any arguments (operands) at all. Link: https://github.com/acpica/acpica/pull/745 Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Signed-off-by: Rafael J. Wysocki commit fa4e1f880424833b767d7f72ffe1f499fac02b88 Merge: 76dcd734eca23 470188b09e92d Author: Rafael J. Wysocki Date: Thu Dec 8 17:37:32 2022 +0100 Merge back ACPICA changes for 6.2-rc1 commit 761c61c15903db41343532882b0443addb8c2faf Author: Jens Axboe Date: Thu Dec 8 09:36:02 2022 -0700 io_uring/msg_ring: flag target ring as having task_work, if needed Before the recent change, we didn't even wake the targeted task when posting the cqe remotely. Now we do wake it, but we do want to ensure that the recipient knows there's potential work there that needs to get processed to get the CQE posted. OR in IORING_SQ_TASKRUN for that purpose. Link: https://lore.kernel.org/io-uring/2843c6b4-ba9a-b67d-e0f4-957f42098489@kernel.dk/ Fixes: 6d043ee1164c ("io_uring: do msg_ring in target task via tw") Signed-off-by: Jens Axboe commit 0b3d0cb7c0bed2fd6454f77ed75e7a662c6efd12 Author: Yang Yingliang Date: Thu Dec 8 23:19:16 2022 +0800 platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() In some error paths before device_register(), the names allocated by dev_set_name() are not freed. Move dev_set_name() front to device_register(), so the name can be freed while calling put_device(). Fixes: 54b34aa0a729 ("platform/x86: intel_scu_ipc: Split out SCU IPC functionality from the SCU driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221208151916.2404977-1-yangyingliang@huawei.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 52f31ed228212ba572c44e15e818a3a5c74122c0 Author: Dave Chinner Date: Thu Dec 8 08:29:22 2022 -0800 xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING Resulting in a UAF if the shrinker races with some other dquot freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is removed from the LRU. This can occur if a dquot purge races with drop_caches. Reported-by: syzbot+912776840162c13db1a3@syzkaller.appspotmail.com Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit bde55dd9ccda7a3f5f735d89e855691362745248 Author: Oleksij Rempel Date: Mon Dec 5 06:29:04 2022 +0100 net: dsa: microchip: add stats64 support for ksz8 series of switches Add stats64 support for ksz8xxx series of switches. Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20221205052904.2834962-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit f596da3efaf4130ff61cd029558845808df9bf99 Author: Yang Jihong Date: Tue Nov 22 12:04:10 2022 +0800 blktrace: Fix output non-blktrace event when blk_classic option enabled When the blk_classic option is enabled, non-blktrace events must be filtered out. Otherwise, events of other types are output in the blktrace classic format, which is unexpected. The problem can be triggered in the following ways: # echo 1 > /sys/kernel/debug/tracing/options/blk_classic # echo 1 > /sys/kernel/debug/tracing/events/enable # echo blk > /sys/kernel/debug/tracing/current_tracer # cat /sys/kernel/debug/tracing/trace_pipe Fixes: c71a89615411 ("blktrace: add ftrace plugin") Signed-off-by: Yang Jihong Link: https://lore.kernel.org/r/20221122040410.85113-1-yangjihong1@huawei.com Signed-off-by: Jens Axboe commit eaabc245b02a0e0063068178624d2fc12ba91d69 Author: Dmitry Torokhov Date: Tue Dec 6 17:44:57 2022 -0800 tpm: st33zp24: remove pointless checks on probe Remove tests for SPI device or I2C client to be non-NULL because driver core will never call driver's probe method without having a valid device structure. Signed-off-by: Dmitry Torokhov Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f5264068071964b56dc02c9dab3d11574aaca6ff Author: Michael Kelley Date: Fri Nov 11 11:38:53 2022 -0800 tpm/tpm_crb: Fix error message in __crb_relinquish_locality() The error message in __crb_relinquish_locality() mentions requestAccess instead of Relinquish. Fix it. Fixes: 888d867df441 ("tpm: cmd_ready command can be issued only after granting locality") Signed-off-by: Michael Kelley Acked-by: Tomas Winkler Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2b7d07f7acaac2c7750e420dcf4414588ede6d03 Author: Yuan Can Date: Thu Nov 24 03:19:26 2022 +0000 tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() The ftpm_mod_init() returns the driver_register() directly without checking its return value, if driver_register() failed, the ftpm_tee_plat_driver is not unregistered. Fix by unregister ftpm_tee_plat_driver when driver_register() failed. Fixes: 9f1944c23c8c ("tpm_ftpm_tee: register driver on TEE bus") Signed-off-by: Yuan Can Reviewed-by: Maxim Uvarov Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit db9622f762104459ff87ecdf885cc42c18053fd9 Author: Hanjun Guo Date: Thu Nov 17 19:23:42 2022 +0800 tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_table() should be added to release the ACPI memory. Fixes: 4cb586a188d4 ("tpm_tis: Consolidate the platform and acpi probe flow") Cc: stable@vger.kernel.org Signed-off-by: Hanjun Guo Signed-off-by: Jarkko Sakkinen commit 37e90c374dd11cf4919c51e847c6d6ced0abc555 Author: Hanjun Guo Date: Thu Nov 17 19:23:41 2022 +0800 tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so the TPM2 table is not used after the init, should be freed, call acpi_put_table() to fix the memory leak. Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface") Cc: stable@vger.kernel.org Signed-off-by: Hanjun Guo Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8740a12ca2e2959531ad253bac99ada338b33d80 Author: Hanjun Guo Date: Thu Nov 17 19:23:40 2022 +0800 tpm: acpi: Call acpi_put_table() to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, but the acpi_get_table() should be coupled with acpi_put_table() to release the ACPI memory, add the acpi_put_table() properly to fix the memory leak. While we are at it, remove the redundant empty line at the end of the tpm_read_log_acpi(). Fixes: 0bfb23746052 ("tpm: Move eventlog files to a subdirectory") Fixes: 85467f63a05c ("tpm: Add support for event log pointer found in TPM2 ACPI table") Cc: stable@vger.kernel.org Signed-off-by: Hanjun Guo Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 7bfda9c73fa9710a842a7d6f89b024351c80c19c Author: Eddie James Date: Mon Nov 7 11:14:23 2022 -0600 tpm: Add flag to use default cancellation policy The check for cancelled request depends on the VID of the chip, but some chips share VID which shouldn't share their cancellation behavior. This is the case for the Nuvoton NPCT75X, which should use the default cancellation check, not the Winbond one. To avoid changing the existing behavior, add a new flag to indicate that the chip should use the default cancellation check and set it for the I2C TPM2 TIS driver. Fixes: bbc23a07b072 ("tpm: Add tpm_tis_i2c backend for tpm_tis_core") Signed-off-by: Eddie James Tested-by: Joel Stanley Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 561d6ef75628db9cce433e573aa3cdb6b3bba903 Author: Eddie James Date: Wed Aug 17 15:03:33 2022 -0500 tpm: tis_i2c: Fix sanity check interrupt enable mask The sanity check mask for TPM_INT_ENABLE register was off by 8 bits, resulting in failure to probe if the TPM_INT_ENABLE register was a valid value. Fixes: bbc23a07b072 ("tpm: Add tpm_tis_i2c backend for tpm_tis_core") Signed-off-by: Eddie James Reviewed-by: Jarkko Sakkinen Tested-by: Joel Stanley Signed-off-by: Jarkko Sakkinen commit 1506fba28b53fd159c7028c4809a4a3143a38eb7 Author: Sumit Garg Date: Thu Nov 10 16:41:40 2022 +0530 KEYS: trusted: tee: Make registered shm dependency explicit TEE trusted keys support depends on registered shared memory support since the key buffers are needed to be registered with OP-TEE. So make that dependency explicit to not register trusted keys support if underlying implementation doesn't support registered shared memory. Signed-off-by: Sumit Garg Tested-by: Jerome Forissier Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e10de46bc3c60d938ced069e85f3e7d009a656d2 Author: Ard Biesheuvel Date: Fri Oct 21 14:33:09 2022 +0200 tpm: Avoid function type cast of put_device() The TPM code registers put_device() as a devm cleanup handler, and casts the reference to the right function pointer type for this to be permitted by the compiler. However, under kCFI, this is rejected at runtime, resulting in a splat like CFI failure at devm_action_release+0x24/0x3c (target: put_device+0x0/0x24; expected type: 0xa488ebfc) Internal error: Oops - CFI: 0000000000000000 [#1] PREEMPT SMP Modules linked in: ... CPU: 20 PID: 454 Comm: systemd-udevd Not tainted 6.1.0-rc1+ #51 Hardware name: Socionext SynQuacer E-series DeveloperBox, BIOS build #1 Oct 3 2022 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : devm_action_release+0x24/0x3c lr : devres_release_all+0xb4/0x114 sp : ffff800009bb3630 x29: ffff800009bb3630 x28: 0000000000000000 x27: 0000000000000011 x26: ffffaa6f9922c0c8 x25: 0000000000000002 x24: 000000000000000f x23: ffff800009bb3648 x22: ffff7aefc3be2100 x21: ffff7aefc3be2e00 x20: 0000000000000005 x19: ffff7aefc1e1ec10 x18: ffff800009af70a8 x17: 00000000a488ebfc x16: 0000000094ee7df3 x15: 0000000000000000 x14: 4075c5c2ef7affff x13: e46a91c5c5e2ef42 x12: ffff7aefc2c57540 x11: 0000000000000001 x10: 0000000000000001 x9 : 0000000100000000 x8 : ffffaa6fa09b39b4 x7 : 7f7f7f7f7f7f7f7f x6 : 8000000000000000 x5 : 000000008020000e x4 : ffff7aefc2c57500 x3 : ffff800009bb3648 x2 : ffff800009bb3648 x1 : ffff7aefc3be2e80 x0 : ffff7aefc3bb7000 Call trace: devm_action_release+0x24/0x3c devres_release_all+0xb4/0x114 really_probe+0xb0/0x49c __driver_probe_device+0x114/0x180 driver_probe_device+0x48/0x1ec __driver_attach+0x118/0x284 bus_for_each_dev+0x94/0xe4 driver_attach+0x24/0x34 bus_add_driver+0x10c/0x220 driver_register+0x78/0x118 __platform_driver_register+0x24/0x34 init_module+0x20/0xfe4 [tpm_tis_synquacer] do_one_initcall+0xd4/0x248 do_init_module+0x44/0x28c load_module+0x16b4/0x1920 Fix this by going through a helper function of the correct type. Signed-off-by: Ard Biesheuvel Reviewed-by: Kees Cook Reviewed-by: Jason Gunthorpe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 3f8019093775cc338c8e895bc9a41f4922766de6 Author: Dmitry Torokhov Date: Fri Sep 30 22:51:41 2022 -0700 tpm: st33zp24: switch to using gpiod API Switch the driver from legacy gpio API (that uses flat GPIO numbering) to the newer gpiod API (which used descriptors and respects line polarities specified in ACPI or device tree). Because gpio handling code for SPI and I2C variants duplicates each other it is moved into the core code for the driver. Also, it seems that the driver never assigned tpm_dev->io_lpcpd in the past, so gpio-based power management was most likely not working ever. Signed-off-by: Dmitry Torokhov Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 04593028d7c1156df9aa69841980529d7f20f9fe Author: Dmitry Torokhov Date: Fri Sep 30 22:51:40 2022 -0700 tpm: st33zp24: drop support for platform data Drop support for platform data from the driver because there are no users of st33zp24_platform_data structure in the mainline kernel. Signed-off-by: Dmitry Torokhov Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 56fb8d90031f71fa8af48fdff8498b9263b9c759 Author: Christophe JAILLET Date: Mon Dec 5 20:16:48 2022 +0100 block: sed-opal: Don't include There is no need to include here. Prefer the less invasive and which are needed in this .h file itself. Signed-off-by: Christophe JAILLET Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/c1d479b39e30fe70c4579a1af035d4db49421f56.1670069909.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jens Axboe commit c1f480b2d092960ecf8bb0bd1f27982c33ada42a Author: Luca Boccassi Date: Tue Dec 6 09:29:13 2022 +0000 sed-opal: allow using IOC_OPAL_SAVE for locking too Usually when closing a crypto device (eg: dm-crypt with LUKS) the volume key is not required, as it requires root privileges anyway, and root can deny access to a disk in many ways regardless. Requiring the volume key to lock the device is a peculiarity of the OPAL specification. Given we might already have saved the key if the user requested it via the 'IOC_OPAL_SAVE' ioctl, we can use that key to lock the device if no key was provided here and the locking range matches, and the user sets the appropriate flag with 'IOC_OPAL_SAVE'. This allows integrating OPAL with tools and libraries that are used to the common behaviour and do not ask for the volume key when closing a device. Callers can always pass a non-zero key and it will be used regardless, as before. Suggested-by: Štěpán Horáček Signed-off-by: Luca Boccassi Reviewed-by: Christoph Hellwig Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20221206092913.4625-1-luca.boccassi@gmail.com Signed-off-by: Jens Axboe commit 37754595e94779db869e6ef803f038fa956d08ff Author: Kemeng Shi Date: Tue Dec 6 17:33:07 2022 +0800 blk-cgroup: Fix typo in comment Replace assocating with associating. Replace intiailized with initialized. Signed-off-by: Kemeng Shi Acked-by: Tejun Heo Reviewed-by: Mukesh Ojha Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20221206093307.378249-1-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe commit e80355dd25aeab0e260911829e1495e17219bf1a Author: ye xingchen Date: Thu Dec 8 15:45:17 2022 +0800 platform/x86: sony-laptop: Convert to use sysfs_emit_at() API Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212081545178689771@zte.com.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e84cfa364339e28f3f4bcc1dcc265dbb210bceea Author: ye xingchen Date: Fri Dec 2 17:21:54 2022 +0800 platform/x86/dell: alienware-wmi: Use sysfs_emit() instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212021721543696124@zte.com.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit d240849c75f4efc931f38d3529dcbcbd76adbd81 Author: ye xingchen Date: Fri Dec 2 17:05:12 2022 +0800 platform/x86: uv_sysfs: Use sysfs_emit() instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Reviewed-by: Justin Ernst Link: https://lore.kernel.org/r/202212021705128095546@zte.com.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 37aa6b98237082a4bf882b4d986329b94ebd447d Author: Chen Zhongjin Date: Tue Dec 6 09:50:33 2022 +0800 vme: Use root_device_register() not underlined version root_device_register and __root_device_register have exactly same effect. Use the not underlined version to keep usage consistency. Signed-off-by: Chen Zhongjin Link: https://lore.kernel.org/r/20221206015033.125827-1-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman commit c7912f27dedd874d49eadf78b5b6fbfdec52c7c3 Author: Colin Ian King Date: Wed Dec 7 09:33:31 2022 +0000 staging: rtl8192e: Fix spelling mistake "ContryIE" -> "CountryIE" There is a spelling mistake in a netdev_info message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20221207093331.2280355-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit 81c25247a2a03a0f97e4805d7aff7541ccff6baa Author: Daniel Scally Date: Tue Dec 6 16:12:03 2022 +0000 usb: gadget: uvc: Rename bmInterfaceFlags -> bmInterlaceFlags In the specification documents for the Uncompressed and MJPEG USB Video Payloads, the field name is bmInterlaceFlags - it has been misnamed within the kernel. Although renaming the field does break the kernel's interface to userspace it should be low-risk in this instance. The field is read only and hardcoded to 0, so there was never any value in anyone reading it. A search of the uvc-gadget application and all the forks that I could find for it did not reveal any users either. Fixes: cdda479f15cd ("USB gadget: video class function driver") Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20221206161203.1562827-1-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit d406d26745aba3365ab9171b2d5cbea9c1757305 Author: Paulo Alcantara Date: Mon Dec 5 23:31:53 2022 -0300 cifs: skip alloc when request has no pages When smb3_init_transform_rq() was being called with requests (@old_rq) which had no pages, it was unnecessarily allocating a single page for every request in @new_rq. Fix this by skipping page array allocation when requests have no pages (e.g. !smb_rqst::rq_npages). Also get rid of deprecated kmap() and use kmap_local_page() instead while we're at it. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit ebaad77c89921c8237ca17791d5462bd289052d0 Author: Christoph Hellwig Date: Wed Nov 16 14:18:35 2022 +0100 cifs: remove ->writepage ->writepage is a very inefficient method to write back data, and only used through write_cache_pages or a a fallback when no ->migrate_folio method is present. Now that cifs implements ->migrate_folio and doesn't call generic_writepages, the writepage method can be removed. Signed-off-by: Christoph Hellwig Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit bff9018d3a52c45711bd63c446a2c80c0275e935 Author: Christoph Hellwig Date: Wed Nov 16 14:18:34 2022 +0100 cifs: stop using generic_writepages generic_writepages is just a wrapper that calls ->writepages on a range, and thus in the way of eventually removing ->writepage. Switch cifs to just open code it in preparation of removing ->writepage. [note: I suspect just integrating the small wsize case with the rest of the writeback code might be a better idea here, but that needs someone more familiar with the code] Signed-off-by: Christoph Hellwig Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9381666e289852f93be9d7f4f7844017e04f6315 Author: Christoph Hellwig Date: Wed Nov 16 14:18:33 2022 +0100 cifs: wire up >migrate_folio CIFS does not use page private data that needs migration, so it can just wire up filemap_migrate_folio. This prepares for removing ->writepage, which is used as a fallback if no migrate_folio method is set. Signed-off-by: Christoph Hellwig Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 64ce47cb1b29d7d6aab6dcc287ae1fddb4876bd5 Author: Volker Lendecke Date: Fri Nov 25 12:37:44 2022 +0100 cifs: Parse owner/group for stat in smb311 posix extensions stat was returning default owner and group (unlike readdir) for SMB3.1.1 POSIX extensions Signed-off-by: Volker Lendecke Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 83fb8abec29383eb0cf35495d21669e38548771b Author: Volker Lendecke Date: Fri Nov 25 12:26:00 2022 +0100 cifs: Add "extbuf" and "extbuflen" args to smb2_compound_op() Will carry the variable-sized reply from SMB_FIND_FILE_POSIX_INFO Signed-off-by: Volker Lendecke Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 0bf588274f73b29d7058042a6b7cc2b764502cc1 Author: Volker Lendecke Date: Wed Nov 23 17:51:21 2022 +0100 Fix path in cifs/usage.rst /sys/module/... not /proc/module/... Signed-off-by: Volker Lendecke Signed-off-by: Steve French commit ade23d7b7ec5c38bd43ec44ccb753cb7ea8ac08a Author: Quentin Schulz Date: Wed Dec 7 14:19:17 2022 +0100 usb: dwc2: power on/off phy for peripheral mode in dual-role mode The PHY power is handled for peripheral mode but only when the device is forced into this peripheral mode. It is missing when the device is operating in peripheral mode when dual-role mode is enabled, so let's update the condition to match this scenario. Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20221206-dwc2-gadget-dual-role-v1-2-36515e1092cd@theobroma-systems.com Signed-off-by: Greg Kroah-Hartman commit 42a317d076b58f08413219b1679d211783c2e5f3 Author: Quentin Schulz Date: Wed Dec 7 14:19:16 2022 +0100 usb: dwc2: disable lpm feature on Rockchip SoCs LPM feature of DWC2 module integrated in Rockchip SoCs doesn't work properly or needs some additional handling, so disable it for now. Without disabling LPM feature, the USB ADB communication fail with the following error log: dwc2 ff580000.usb: new address 27 dwc2 ff580000.usb: Failed to exit L1 sleep state in 200us. dwc2 ff580000.usb: dwc2_hsotg_send_reply: cannot queue req dwc2 ff580000.usb: dwc2_hsotg_process_req_status: failed to send reply dwc2 ff580000.usb: dwc2_hsotg_enqueue_setup: failed queue (-11) dwc2 ff580000.usb: Failed to exit L1 sleep state in 200us. [diff vs vendor kernel: added lpm_clock_gating, besl and hird_threshold_en settings as seen in commit 53febc956900 ("usb: dwc2: disable Link Power Management on STM32MP15 HS OTG")] Signed-off-by: William Wu Signed-off-by: Frank Wang Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20221206-dwc2-gadget-dual-role-v1-1-36515e1092cd@theobroma-systems.com Signed-off-by: Greg Kroah-Hartman commit 2a81a7aa420b80865fdd82ec383fe365e18f922b Author: Frank Wunderlich Date: Sun Nov 27 12:41:36 2022 +0100 dt-bindings: usb: mtk-xhci: add support for mt7986 Add compatible string for mt7986. Signed-off-by: Frank Wunderlich Acked-by: Krzysztof Kozlowski Reviewed-by: Chunfeng Yun Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/20221127114142.156573-3-linux@fw-web.de Signed-off-by: Greg Kroah-Hartman commit 63130462c919ece0ad0d9bb5a1f795ef8d79687e Author: Ferry Toth Date: Mon Dec 5 21:15:27 2022 +0100 usb: dwc3: core: defer probe on ulpi_read_id timeout Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present"), Dual Role support on Intel Merrifield platform broke due to rearranging the call to dwc3_get_extcon(). It appears to be caused by ulpi_read_id() masking the timeout on the first test write. In the past dwc3 probe continued by calling dwc3_core_soft_reset() followed by dwc3_get_extcon() which happend to return -EPROBE_DEFER. On deferred probe ulpi_read_id() finally succeeded. Due to above mentioned rearranging -EPROBE_DEFER is not returned and probe completes without phy. On Intel Merrifield the timeout on the first test write issue is reproducible but it is difficult to find the root cause. Using a mainline kernel and rootfs with buildroot ulpi_read_id() succeeds. As soon as adding ftrace / bootconfig to find out why, ulpi_read_id() fails and we can't analyze the flow. Using another rootfs ulpi_read_id() fails even without adding ftrace. We suspect the issue is some kind of timing / race, but merely retrying ulpi_read_id() does not resolve the issue. As we now changed ulpi_read_id() to return -ETIMEDOUT in this case, we need to handle the error by calling dwc3_core_soft_reset() and request -EPROBE_DEFER. On deferred probe ulpi_read_id() is retried and succeeds. Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Signed-off-by: Ferry Toth Link: https://lore.kernel.org/r/20221205201527.13525-3-ftoth@exalondelft.nl Signed-off-by: Greg Kroah-Hartman commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac Author: Ferry Toth Date: Mon Dec 5 21:15:26 2022 +0100 usb: ulpi: defer ulpi_register on ulpi_read_id timeout Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") Dual Role support on Intel Merrifield platform broke due to rearranging the call to dwc3_get_extcon(). It appears to be caused by ulpi_read_id() on the first test write failing with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via DT when the test write fails and returns 0 in that case, even if DT does not provide the phy. As a result usb probe completes without phy. Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write fails. The user should then handle it appropriately. A follow up patch will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out. Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") Cc: stable@vger.kernel.org Acked-by: Heikki Krogerus Signed-off-by: Ferry Toth Link: https://lore.kernel.org/r/20221205201527.13525-2-ftoth@exalondelft.nl Signed-off-by: Greg Kroah-Hartman commit 9bae996ffa28ac03b6d95382a2a082eb219e745a Author: Icenowy Zheng Date: Tue Dec 6 13:52:25 2022 +0800 usb: misc: onboard_usb_hub: add Genesys Logic GL850G hub support Genesys Logic GL850G is a 4-port USB 2.0 STT hub that has a reset pin to toggle and a 3.3V core supply exported (although an integrated LDO is available for powering it with 5V). Add the support for this hub, for controlling the reset pin and the core power supply. Signed-off-by: Icenowy Zheng Acked-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20221206055228.306074-4-uwu@icenowy.me Signed-off-by: Greg Kroah-Hartman commit 4e3a4fcd871274c0233ea498c685b118a21ff3d0 Author: Icenowy Zheng Date: Tue Dec 6 13:52:24 2022 +0800 dt-bindings: usb: Add binding for Genesys Logic GL850G hub controller The Genesys Logic GL850G is a USB 2.0 Single TT hub controller that features 4 downstream ports, an internal 5V-to-3.3V LDO regulator (can be bypassed) and an external reset pin. Add a device tree binding for its USB protocol part. The internal LDO is not covered by this and can just be modelled as a fixed regulator. Signed-off-by: Icenowy Zheng Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221206055228.306074-3-uwu@icenowy.me Signed-off-by: Greg Kroah-Hartman commit 38cea8e31e9ef143187135d714aed4d7bd18463c Author: Icenowy Zheng Date: Tue Dec 6 13:52:23 2022 +0800 dt-bindings: vendor-prefixes: add Genesys Logic Genesys Logic, Inc. is a manufacturer for interface chips, especially USB hubs. https://www.genesyslogic.com.tw/ Signed-off-by: Icenowy Zheng Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221206055228.306074-2-uwu@icenowy.me Signed-off-by: Greg Kroah-Hartman commit 0cd142b4665ee3133cd80539b5a430be5fd326c6 Author: Yi Yang Date: Fri Dec 2 09:21:26 2022 +0800 usb: fotg210-udc: fix potential memory leak in fotg210_udc_probe() In fotg210_udc_probe(), if devm_clk_get() or clk_prepare_enable() fails, 'fotg210' will not be freed, which will lead to a memory leak. Fix it by moving kfree() to a proper location. In addition，we can use "return -ENOMEM" instead of "goto err" to simplify the code. Fixes: 718a38d092ec ("fotg210-udc: Handle PCLK") Reviewed-by: Andrzej Pietrasiewicz Reviewed-by: Linus Walleij Signed-off-by: Yi Yang Link: https://lore.kernel.org/r/20221202012126.246953-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 59d54aa09020fe52061d4cda51d474f5bd5e6be1 Author: Sven Peter Date: Mon Nov 28 17:23:04 2022 +0100 usb: typec: tipd: Set mode of operation for USB Type-C connector Forward the mode of operation to the typec subsystem such that it can configure the mux correctly. Reviewed-by: Heikki Krogerus Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20221128162304.80125-1-sven@svenpeter.dev Signed-off-by: Greg Kroah-Hartman commit 6f1f0ad910f73f5533b65e1748448d334e0ec697 Author: Jean Delvare Date: Fri Nov 25 17:04:44 2022 +0100 usb: gadget: udc: drop obsolete dependencies on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. It is actually better to always build such drivers with OF enabled, so that the test builds are closer to how each driver will actually be built on its intended target. Building them without OF may not test much as the compiler will optimize out potentially large parts of the code. In the worst case, this could even pop false positive warnings. Dropping COMPILE_TEST here improves the quality of our testing and avoids wasting time on non-existent issues. Cc: Greg Kroah-Hartman Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Claudiu Beznea Cc: Michal Simek Acked-by: Nicolas Ferre Signed-off-by: Jean Delvare Link: https://lore.kernel.org/r/20221125170444.36620123@endymion.delvare Signed-off-by: Greg Kroah-Hartman commit ecec4b20d29c3d6922dafe7d2555254a454272d2 Author: Ivaylo Dimitrov Date: Fri Nov 25 20:21:15 2022 +0200 usb: musb: remove extra check in musb_gadget_vbus_draw The checks for musb->xceiv and musb->xceiv->set_power duplicate those in usb_phy_set_power(), so there is no need of them. Moreover, not calling usb_phy_set_power() results in usb_phy_set_charger_current() not being called, so current USB config max current is not propagated through USB charger framework and charger drivers may try to draw more current than allowed or possible. Fix that by removing those extra checks and calling usb_phy_set_power() directly. Tested on Motorola Droid4 and Nokia N900 Fixes: a9081a008f84 ("usb: phy: Add USB charger support") Cc: stable Signed-off-by: Ivaylo Dimitrov Link: https://lore.kernel.org/r/1669400475-4762-1-git-send-email-ivo.g.dimitrov.75@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4c92670b16727365699fe4b19ed32013bab2c107 Author: Szymon Heidrich Date: Tue Dec 6 15:13:01 2022 +0100 usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes. Fixes: cdda479f15cd ("USB gadget: video class function driver") Cc: stable Reviewed-by: Laurent Pinchart Reviewed-by: Daniel Scally Signed-off-by: Szymon Heidrich Link: https://lore.kernel.org/r/20221206141301.51305-1-szymon.heidrich@gmail.com Signed-off-by: Greg Kroah-Hartman commit 97a48da1619ba6bd42a0e5da0a03aa490a9496b1 Author: Miaoqian Lin Date: Tue Dec 6 12:17:31 2022 +0400 usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init of_icc_get() alloc resources for path handle, we should release it when not need anymore. Like the release in dwc3_qcom_interconnect_exit() function. Add icc_put() in error handling to fix this. Fixes: bea46b981515 ("usb: dwc3: qcom: Add interconnect support in dwc3 driver") Cc: stable Acked-by: Thinh Nguyen Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20221206081731.818107-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit dc18a4c7b3bd447cef2395deeb1f6ac16dfaca0e Author: Yang Yingliang Date: Sat Dec 3 15:10:27 2022 +0800 usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/tcpc@60/connector If wusb3801_hw_init() fails, fwnode_handle_put() needs be called to avoid refcount leak. Fixes: d016cbe4d7ac ("usb: typec: Support the WUSB3801 port controller") Reviewed-by: Heikki Krogerus Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221203071027.3808308-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit c35ca10f53c51eeb610d3f8fbc6dd6d511b58a58 Author: Jiasheng Jiang Date: Thu Dec 8 19:00:58 2022 +0800 usb: storage: Add check for kcalloc As kcalloc may return NULL pointer, the return value should be checked and return error if fails as same as the ones in alauda_read_map. Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Acked-by: Alan Stern Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20221208110058.12983-1-jiasheng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 727cc0147f5066e359aca65cc6cc5e6d64cc15d8 Author: Yu Liao Date: Tue Nov 29 09:11:01 2022 +0800 platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method() is not freed after the call, so it leads to memory leak. The method results in ACPI buffer is not used, so just pass NULL to wmi_evaluate_method() which fixes the memory leak. Fixes: 99b38b4acc0d ("platform/x86: add MXM WMI driver.") Signed-off-by: Yu Liao Link: https://lore.kernel.org/r/20221129011101.2042315-1-liaoyu15@huawei.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 82710ecd0e5d401c36ad21f00d644672005233b9 Merge: 4b6be020bd6b1 63b8ed26cd093 Author: Greg Kroah-Hartman Date: Thu Dec 8 16:24:46 2022 +0100 Merge tag 'usb-serial-6.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 6.2-rc1 Here are the USB-serial updates for 6.2-rc1, including: - B0 hangup support for cp210x - avoid requesting a zero DTE rate which could potentially confuse buggy firmware in XR devices Included are also some new device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: xr: avoid requesting zero DTE rate USB: serial: cp210x: add support for B0 hangup USB: serial: cp210x: add Kamstrup RF sniffer PIDs USB: serial: option: add Quectel EM05-G modem commit b03ae77e7e057f4b3b858f10c840557e71448a91 Author: Hans de Goede Date: Sun Nov 27 23:19:28 2022 +0100 platform/x86: x86-android-tablets: Add Advantech MICA-071 extra button The Advantech MICA-071 is a standard Windows tablet, but it has an extra "quick launch" button which is not described in the ACPI tables in anyway. Use the x86-android-tablets infra to create a gpio-button device for this. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221127221928.123660-1-hdegoede@redhat.com commit b6c14ff1deaafd30036ec36d5205acd5a578b1cd Author: Hans de Goede Date: Sun Nov 27 19:24:58 2022 +0100 platform/x86: x86-android-tablets: Add Lenovo Yoga Tab 3 (YT3-X90F) charger + fuel-gauge data The Lenovo Yoga Tab 3 (YT3-X90F) is an Intel Cherry Trail based tablet which ships with Android as Factory OS. Its DSDT contains a bunch of I2C devices which are not actually there, causing various resource conflicts. Use acpi_quirk_skip_i2c_client_enumeration() to not enumerate these. The YT3-X90F has quite a bit of exotic hardware, this adds initial support by manually instantiating the i2c-clients for the 2 charger + 2 fuel-gauge chips used for the 2 batteries. Support for other parts of the hw will be added by follow-up patches. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20221127182458.104528-1-hdegoede@redhat.com commit 902ce18ab1f4444ff9d49865bea35a07adcc03fd Author: Hans de Goede Date: Thu Dec 8 12:02:24 2022 +0100 platform/x86: x86-android-tablets: Add Medion Lifetab S10346 data The Medion Lifetab S10346 is a x86 ACPI tablet which ships with Android x86 as factory OS. Its DSDT contains a bunch of I2C devices which are not actually there, causing various resource conflicts. Enumeration of these is skipped through the acpi_quirk_skip_i2c_client_enumeration(). Add support for manually instantiating the I2C devices which are actually present on this tablet by adding the necessary device info to the x86-android-tablets module. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20221208110224.107354-1-hdegoede@redhat.com commit 832c3f66f53f1eb20f424b916a311ad82074ef0d Merge: 695c5d3a8055d a6365c2da9faf Author: Kalle Valo Date: Thu Dec 8 16:54:33 2022 +0200 Merge tag 'iwlwifi-next-for-kalle-2022-12-07' of http://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next An additional set of patches intended for v6.2. It contains: * Adjustments for the new HW * Adjustments for FW API update * A few small fixes and cleanups * Improvements for debug dumps mechanism commit 695c5d3a8055dcb97966496ade51968c9a75f5c6 Author: Jun ASAKA Date: Wed Dec 7 11:39:26 2022 +0800 wifi: rtl8xxxu: fixing IQK failures for rtl8192eu Fixing "Path A RX IQK failed" and "Path B RX IQK failed" issues for rtl8192eu chips by replacing the arguments with the ones in the updated official driver as shown below. 1. https://github.com/Mange/rtl8192eu-linux-driver 2. vendor driver version: 5.6.4 Signed-off-by: Jun ASAKA Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221207033926.11777-1-JunASAKA@zzy040330.moe commit e48c45318d3d38460c585dce6379ef77d65a069e Author: Peter Kosyh Date: Tue Dec 6 13:49:19 2022 +0300 wifi: rtlwifi: btcoexist: fix conditions branches that are never executed Commit 40ca18823515 ("rtlwifi: btcoex: 23b 1ant: fine tune for wifi not connected") introduced never executed branches. Compile test only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Peter Kosyh Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221206104919.739746-1-pkosyh@yandex.ru commit 49ebca0d9018ff3517b24972f6f2a9f3d0dc956f Author: Peter Kosyh Date: Mon Dec 5 11:53:42 2022 +0300 wifi: rtlwifi: rtl8192se: remove redundant rtl_get_bbreg() call Extra rtl_get_bbreg() call looks like redundant reading. The read has already been done in the "else" branch. Compile test only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Peter Kosyh Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221205085342.677329-1-pkosyh@yandex.ru commit 87caeef032fc3921bc866ad7becb6ed51aa8b27b Author: Sascha Hauer Date: Fri Dec 2 09:12:24 2022 +0100 wifi: rtw88: Add rtw8723du chipset support Add support for the rtw8723du chipset based on https://github.com/ulli-kroll/rtw88-usb.git Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-12-s.hauer@pengutronix.de commit 07cef03b8d44dee7488de3d1585387e603c78676 Author: Sascha Hauer Date: Fri Dec 2 09:12:23 2022 +0100 wifi: rtw88: Add rtw8822cu chipset support Add support for the rtw8822cu chipset based on https://github.com/ulli-kroll/rtw88-usb.git Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-11-s.hauer@pengutronix.de commit 45794099f5e1d7abc5eb07e6eec7e1e5c6cb540d Author: Sascha Hauer Date: Fri Dec 2 09:12:22 2022 +0100 wifi: rtw88: Add rtw8822bu chipset support Add support for the rtw8822bu chipset based on https://github.com/ulli-kroll/rtw88-usb.git Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-10-s.hauer@pengutronix.de commit aff5ffd718de23cb8603f2e229204670e2644334 Author: Sascha Hauer Date: Fri Dec 2 09:12:21 2022 +0100 wifi: rtw88: Add rtw8821cu chipset support Add support for the rtw8821cu chipset based on https://github.com/ulli-kroll/rtw88-usb.git Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-9-s.hauer@pengutronix.de commit a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Author: Sascha Hauer Date: Fri Dec 2 09:12:20 2022 +0100 wifi: rtw88: Add common USB chip support Add the common bits and pieces to add USB support to the RTW88 driver. This is based on https://github.com/ulli-kroll/rtw88-usb.git which itself is first written by Neo Jou. Signed-off-by: neo_jou Signed-off-by: Hans Ulli Kroll Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-8-s.hauer@pengutronix.de commit 78d5bf925f30bf9f79a69ce77386902672defe68 Author: Sascha Hauer Date: Fri Dec 2 09:12:19 2022 +0100 wifi: rtw88: iterate over vif/sta list non-atomically The driver uses ieee80211_iterate_active_interfaces_atomic() and ieee80211_iterate_stations_atomic() in several places and does register accesses in the iterators. This doesn't cope with upcoming USB support as registers can only be accessed non-atomically. Split these into a two stage process: First use the atomic iterator functions to collect all active interfaces or stations on a list, then iterate over the list non-atomically and call the iterator on each entry. Signed-off-by: Sascha Hauer Suggested-by: Ping-Ke shih Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-7-s.hauer@pengutronix.de commit 8647f7f0b9080bc2d2f6e02524782f2f02f159bc Author: Sascha Hauer Date: Fri Dec 2 09:12:18 2022 +0100 wifi: rtw88: Drop coex mutex coex->mutex is used in rtw_coex_info_request() only. Most callers of this function hold rtwdev->mutex already, except for one callsite in the debugfs code. The debugfs code alone doesn't justify the extra lock, so acquire rtwdev->mutex there as well and drop the now unnecessary spinlock. Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-6-s.hauer@pengutronix.de commit 1e2701f4079a7906ff3fb43a315925d303e289d8 Author: Sascha Hauer Date: Fri Dec 2 09:12:17 2022 +0100 wifi: rtw88: Drop h2c.lock The h2c.lock spinlock is used in rtw_fw_send_h2c_command() and rtw_fw_send_h2c_packet(). Most callers call this with rtwdev->mutex held, except from one callsite in the debugfs code. The debugfs code alone doesn't justify the extra lock, so acquire rtwdev->mutex in debugfs and drop the now unnecessary spinlock. Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-5-s.hauer@pengutronix.de commit d57ca103e54e2b3eea7e2603548c58bcc4155541 Author: Sascha Hauer Date: Fri Dec 2 09:12:16 2022 +0100 wifi: rtw88: Drop rf_lock The rtwdev->rf_lock spinlock protects the rf register accesses in rtw_read_rf() and rtw_write_rf(). Most callers of these functions hold rtwdev->mutex already with the exception of the callsites in the debugfs code. The debugfs code doesn't justify an extra lock, so acquire the mutex there as well before calling rf register accessors and drop the now unnecessary spinlock. Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-4-s.hauer@pengutronix.de commit 69020957bcb783184af1a86c8483139557cec751 Author: Sascha Hauer Date: Fri Dec 2 09:12:15 2022 +0100 wifi: rtw88: Call rtw_fw_beacon_filter_config() with rtwdev->mutex held rtw_fw_beacon_filter_config() is called once with rtwdev->mutex held and once without the mutex held. Call it consistently with rtwdev->mutex held. Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-3-s.hauer@pengutronix.de commit 1d89660494402168565e0637268486ae28bad642 Author: Sascha Hauer Date: Fri Dec 2 09:12:14 2022 +0100 wifi: rtw88: print firmware type in info message It's confusing to read two different firmware versions in the syslog for the same device: rtw_8822cu 2-1:1.2: Firmware version 9.9.4, H2C version 15 rtw_8822cu 2-1:1.2: Firmware version 9.9.11, H2C version 15 Print the firmware type in this message to make clear these are really two different firmwares for different purposes: rtw_8822cu 1-1.4:1.2: WOW Firmware version 9.9.4, H2C version 15 rtw_8822cu 1-1.4:1.2: Firmware version 9.9.11, H2C version 15 Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202081224.2779981-2-s.hauer@pengutronix.de commit a0e78d5c6082fc953fef5af7293be0145c67dba4 Author: Po-Hao Huang Date: Fri Dec 2 14:15:27 2022 +0800 wifi: rtw89: add join info upon create interface To support multiple vifs, fw need more information of each role. Send this info to make things work as expected. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202061527.505668-5-pkshih@realtek.com commit 8fc5d4338620b81b1b265c725b38aced8acf8d72 Author: Po-Hao Huang Date: Fri Dec 2 14:15:26 2022 +0800 wifi: rtw89: fix unsuccessful interface_add flow Remove according vifs from list if we couldn't set this interface up. Otherwise the rtwvif_list could contain unreferenced objects. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202061527.505668-4-pkshih@realtek.com commit d592b9f742643f07db53ac34baf6bbd3ce9478dc Author: Po-Hao Huang Date: Fri Dec 2 14:15:25 2022 +0800 wifi: rtw89: stop mac port function when stop_ap() Disable hardware beacon related functions when ap stops. So hardware won't transmit beacons while interface is already removed. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202061527.505668-3-pkshih@realtek.com commit fb2b8cec81d75b2b20bdbc2fca7a60a68bc78aac Author: Po-Hao Huang Date: Fri Dec 2 14:15:24 2022 +0800 wifi: rtw89: add mac TSF sync function If the interface is in AP/P2P GO mode, we adjust the TSF with random offset to avoid TBTT of different vifs to overlap and collide. For every new interface added, we adjust the value and resync for all interfaces. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202061527.505668-2-pkshih@realtek.com commit 13eb07e0be1b95f1e1fab721fb0f38117edfe80b Author: Zong-Zhe Yang Date: Fri Dec 2 14:05:21 2022 +0800 wifi: rtw89: request full firmware only once if it's early requested Under some condition, we now have to do early request full firmware when rtw89_early_fw_feature_recognize(). In this case, we can avoid requesting full firmware twice during probing driver. So, we pass out full firmware from rtw89_early_fw_feature_recognize() if it's requested successfully. And then, if firmware is settled, we have no need to request full firmware again during normal initizating flow. Setting firmware flow is updated to be as the following. platform | early recognizing | normally initizating ----------------------------------------------------------------------- deny reading | request full FW | (no more FW requesting) partial file | | (obtain FW from early pahse) ----------------------------------------------------------------------- able to read | request partial FW | async request full FW partial file | (quite small chunk) | Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202060521.501512-3-pkshih@realtek.com commit 3ddfe3bdd3cf199676737fbd8cb7878b962acd2a Author: Zong-Zhe Yang Date: Fri Dec 2 14:05:20 2022 +0800 wifi: rtw89: don't request partial firmware if SECURITY_LOADPIN_ENFORCE Kernel logs on platform enabling SECURITY_LOADPIN_ENFORCE ------ ``` LoadPin: firmware old-api-denied obj= pid=810 cmdline="modprobe -q -- rtw89_8852ce" rtw89_8852ce 0000:01:00.0: loading /lib/firmware/rtw89/rtw8852c_fw.bin failed with error -1 rtw89_8852ce 0000:01:00.0: Direct firmware load for rtw89/rtw8852c_fw.bin failed with error -1 rtw89_8852ce 0000:01:00.0: failed to early request firmware: -1 ``` Trace ------ ``` request_partial_firmware_into_buf() > _request_firmware() >> fw_get_filesystem_firmware() >>> kernel_read_file_from_path_initns() >>>> kernel_read_file() >>>>> security_kernel_read_file() // It will iterate enabled LSMs' hooks for kernel_read_file. // With loadpin, it hooks loadpin_read_file. ``` If SECURITY_LOADPIN_ENFORCE is enabled, doing kernel_read_file() on partial files will be denied and return -EPERM (-1). Then, the outer API based on it, e.g. request_partial_firmware_into_buf(), will get the error. In the case, we cannot get the firmware stuffs right, even though there might be no error other than a permission issue on reading a partial file. So we have to request full firmware if SECURITY_LOADPIN_ENFORCE is enabled. It makes us still have a chance to do early firmware work on this kind of platforms. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221202060521.501512-2-pkshih@realtek.com commit c2f2924bc7f9ea75ef8d95863e710168f8196256 Author: Wang Yufen Date: Fri Dec 2 13:35:42 2022 +0800 wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() Fix to return a negative error code instead of 0 when brcmf_chip_set_active() fails. In addition, change the return value for brcmf_pcie_exit_download_state() to keep consistent. Fixes: d380ebc9b6fb ("brcmfmac: rename chip download functions") Signed-off-by: Wang Yufen Reviewed-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1669959342-27144-1-git-send-email-wangyufen@huawei.com commit 7de16123d9e230d4aff17a466eac820645c8a796 Author: Bitterblue Smith Date: Thu Dec 1 16:16:46 2022 +0200 wifi: rtl8xxxu: Introduce rtl8xxxu_update_ra_report The ra_report struct is used for reporting the TX rate via sta_statistics. The code which fills it out is duplicated in two places, and the RTL8188EU will need it in a third place. Move this code into a new function rtl8xxxu_update_ra_report. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/0777ad35-fe03-473c-2e02-e3390bef5dd0@gmail.com commit 76c16af2cb10282274596e21add2c9f0b95c941b Author: Bitterblue Smith Date: Thu Dec 1 16:15:08 2022 +0200 wifi: rtl8xxxu: Fix the channel width reporting The gen 2 chips RTL8192EU and RTL8188FU periodically send the driver reports about the TX rate, and the driver passes these reports to sta_statistics. The reports from RTL8192EU may or may not include the channel width. The reports from RTL8188FU do not include it. Only access the c2h->ra_report.bw field if the report (skb) is big enough. The other problem fixed here is that the code was actually never changing the channel width initially reported by rtl8xxxu_bss_info_changed because the value of RATE_INFO_BW_20 is 0. Fixes: 0985d3a410ac ("rtl8xxxu: Feed current txrate information for mac80211") Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/5b41f1ae-72e7-6b7a-2459-b736399a1c40@gmail.com commit dd469a754afdb782ba3033cee102147493dc39f4 Author: Bitterblue Smith Date: Thu Dec 1 16:13:57 2022 +0200 wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h This struct is used to access a sequence of bytes received from the wifi chip. It must not have any padding bytes between the members. This doesn't change anything on my system, possibly because currently none of the members need more than byte alignment. Fixes: b2b43b7837ba ("rtl8xxxu: Initial functionality to handle C2H events for 8723bu") Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1a270918-da22-ff5f-29fc-7855f740c5ba@gmail.com commit 8041f2bffbf1c0854d9f6675ad01dc6ca72f71dd Author: Arend van Spriel Date: Tue Nov 29 14:54:46 2022 +0100 wifi: brcmfmac: introduce BRCMFMAC exported symbols namespace Using a namespace variant to make clear it is only intended to be used by the vendor-specific modules. The symbol will only truly export the symbols when the driver and consequently the vendor-specific part are built as kernel modules. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-8-arend.vanspriel@broadcom.com commit 7205f9f2fc55be611dbd3364f6b1b361aa21a52d Author: Arend van Spriel Date: Tue Nov 29 14:54:45 2022 +0100 wifi: brcmfmac: add vendor name in revinfo debugfs file Upon probe the driver determines the vendor supporting the device. Expose this information in the revinfo debugfs file. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-7-arend.vanspriel@broadcom.com commit b1d94be570c28be9bda6931e300e4ff74be82452 Author: Arend van Spriel Date: Tue Nov 29 14:54:44 2022 +0100 wifi: brcmfmac: add support Broadcom BCA firmware api Broadcom BCA division develops its own firmware api and as such will likely diverge over time (or already has). Add support for handling this. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-6-arend.vanspriel@broadcom.com commit f74f1ec22dc232be0296739148d126e9158eadf9 Author: Arend van Spriel Date: Tue Nov 29 14:54:43 2022 +0100 wifi: brcmfmac: add support for Cypress firmware api Cypress uses the brcmfmac driver and releases firmware which will likely diverge over time (or already has). So adding support for handling that. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-5-arend.vanspriel@broadcom.com commit d6a5c562214f26e442c8ec3ff1e28e16675d1bcf Author: Arend van Spriel Date: Tue Nov 29 14:54:42 2022 +0100 wifi: brcmfmac: add support for vendor-specific firmware api The driver is being used by multiple vendors who develop the firmware api independently. So far the firmware api as used by the driver has not diverged (yet). This change adds framework for supporting multiple firmware apis. The vendor-specific support code has to provide a number of callback operations. Right now it is only attach and detach callbacks so no real functionality as the api is still common. This code only adds WCC variant anyway, which is selected for all devices right now. The vendor-specific part will be built in a separate module when the driver is configured to be built as a module through Kconfig, ie. when CONFIG_BRCMFMAC=m. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-4-arend.vanspriel@broadcom.com commit da6d9c8ecd00e20218461007948f2b0a8e7fa242 Author: Arend van Spriel Date: Tue Nov 29 14:54:41 2022 +0100 wifi: brcmfmac: add firmware vendor info in driver info In order to determine the vendor that released a firmware image for a specific device, the device table now sets the vendor identifier in driver info and it is stored in struct brcmf_bus::fwvid during probe. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-3-arend.vanspriel@broadcom.com commit 76821aad49cebc69eca86800f41e8133104e91d3 Author: Arend van Spriel Date: Tue Nov 29 14:54:40 2022 +0100 wifi: brcmfmac: add function to unbind device to bus layer api Introduce a new bus callback .remove() which will unbind the device from the driver. This allows the common driver layer to stop handling a device. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129135446.151065-2-arend.vanspriel@broadcom.com commit 5107778d0061db58b1683bb412418d5b3cf0b0e0 Author: Jiapeng Chong Date: Tue Nov 29 14:24:07 2022 +0800 wifi: ipw2x00: Remove some unused functions Functions write_nic_auto_inc_address() and write_nic_dword_auto_inc() are defined in the ipw2100.c file, but not called elsewhere, so remove these unused functions. drivers/net/wireless/intel/ipw2x00/ipw2100.c:427:20: warning: unused function 'write_nic_dword_auto_inc'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3285 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221129062407.83157-1-jiapeng.chong@linux.alibaba.com commit 37fecbb80721c4e72ba3e43d4f07ba9ec15b68fd Author: Christoph Niedermaier Date: Wed Nov 30 11:14:26 2022 +0100 dt-bindings: mfd: da9062: Correct file name for watchdog Replace the watchdog file name with the name currently in use. Signed-off-by: Christoph Niedermaier Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221130101426.5318-1-cniedermaier@dh-electronics.com commit 14f8c55d48e02157519fbcb3a5de557abd8a06e2 Author: Yang Yingliang Date: Fri Nov 25 15:36:26 2022 +0800 mfd: pm8008: Fix return value check in pm8008_probe() In case of error, the function devm_regmap_init_i2c() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: 6b149f3310a4 ("mfd: pm8008: Add driver for QCOM PM8008 PMIC") Signed-off-by: Yang Yingliang Reviewed-by: Bjorn Andersson Acked-by: Guru Das Srinagesh Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221125073626.1868229-1-yangyingliang@huawei.com commit ecc6aaabcedc276128315f57755364106017c606 Author: Hans de Goede Date: Thu Dec 8 12:02:02 2022 +0100 ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 The Medion Lifetab S10346 is a x86 tablet which ships with Android x86 as factory OS. The Android x86 kernel fork ignores I2C devices described in the DSDT, except for the PMIC and Audio codecs. As usual the Medion Lifetab S10346's DSDT contains a bunch of extra I2C devices which are not actually there, causing various resource conflicts. Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Medion Lifetab S10346 to the acpi_quirk_skip_dmi_ids table to woraround this. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit cb83cb0dfa821b9c91cc9b2e3473f0ea42e11461 Author: Matti Vaittinen Date: Wed Nov 23 11:19:49 2022 +0200 mfd: rohm: Use dev_err_probe() The dev_err_probe() has (at least) following benefits over dev_err() when printing an error print for a failed function call at a device driver probe: - Omit error level print if error is 'EPRBE_DEFER' - Standardized print format for returned error - return the error value allowing shortening calls like: if (ret) { dev_err(...); return ret; } to if (ret) return dev_err_probe(...); Convert the ROHM BD71828, ROHM BD718x7 and ROHM BD9576 core drivers to use the dev_err_probe() when returned error is not hard-coded constant. Signed-off-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/Y33lte0PKd2u6dyR@fedora commit 96836a35ffb3bcdf412d5753363daf5ee3e68548 Author: Jean Delvare Date: Tue Nov 22 15:41:34 2022 +0100 mfd: Drop obsolete dependencies on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. It is actually better to always build such drivers with OF enabled, so that the test builds are closer to how each driver will actually be built on its intended target. Building them without OF may not test much as the compiler will optimize out potentially large parts of the code. In the worst case, this could even pop false positive warnings. Dropping COMPILE_TEST here improves the quality of our testing and avoids wasting time on non-existent issues. As a minor optimization, this also lets us drop of_match_ptr(), as we now know what it will resolve to, we might as well save cpp some work. Signed-off-by: Jean Delvare Cc: Lee Jones Cc: Bartosz Golaszewski Cc: Chanwoo Choi Cc: Krzysztof Kozlowski Cc: Bartlomiej Zolnierkiewicz Cc: Luca Ceresoli Cc: "Jonathan Neuschäfer" Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221122154134.58a7a18b@endymion.delvare commit 7ef5c57758c4bbf8d5476c3fefcb585e150d116a Author: Christoph Niedermaier Date: Tue Nov 22 10:58:31 2022 +0100 dt-bindings: mfd: da9062: Move IRQ to optional properties Move IRQ to optional properties, because the MFD DA9061/62 is usable without IRQ. This makes the chip usable for designs that don't have the IRQ pin connected. Signed-off-by: Christoph Niedermaier Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221122095833.3957-2-cniedermaier@dh-electronics.com commit 8f3cbcd6b440032ebc7f7d48a1689dcc70a4eb98 Author: ChiYuan Huang Date: Tue Dec 6 15:22:21 2022 +0800 regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/ From the analysis of Yingliang CPU A |CPU B mt6370_probe() | devm_mfd_add_devices() | |mt6370_regulator_probe() | regulator_register() | //allocate init_data and add it to devres | regulator_of_get_init_data() i2c_unregister_device() | device_del() | devres_release_all() | // init_data is freed | release_nodes() | | // using init_data causes UAF | regulator_register() It's common to use mfd core to create child device for the regulator. In order to do the DT lookup for init data, the child that registered the regulator would pass its parent as the parameter. And this causes init data resource allocated to its parent, not itself. The issue happen when parent device is going to release and regulator core is still doing some operation of init data constraint for the regulator of child device. To fix it, this patch expand 'regulator_register' API to use the different devices for init data allocation and DT lookup. Reported-by: Yang Yingliang Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/1670311341-32664-1-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown commit f24f21c4122e837fa031cc512a7f20eb8c554c5e Merge: 64fdcbcc06496 a39818a3fb2bf Author: Michael Ellerman Date: Thu Dec 8 23:57:47 2022 +1100 Merge branch 'topic/objtool' into next Merge the powerpc objtool support, which we were keeping in a topic branch in case of any merge conflicts. commit e48dee96046246980d476714b3f6684d45f29c13 Author: Christophe JAILLET Date: Sun Nov 20 14:01:43 2022 +0100 mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code Use devm_of_platform_populate() instead of hand-writing it. This simplifies the code. Signed-off-by: Christophe JAILLET Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/fd997dc92b9cee219e9c55e22959a94f4bbf570b.1668949256.git.christophe.jaillet@wanadoo.fr commit 36579aca877a62f67ecd77eb3edefc4c86292406 Author: Christophe JAILLET Date: Sun Nov 20 18:19:01 2022 +0100 mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() If an error occurs after the clk_prepare_enable() call, a corresponding clk_disable_unprepare() should be called. Simplify code and switch to devm_clk_get_enabled() to fix it. Fixes: 3526403353c2 ("mfd: qcom_rpm: Handle message RAM clock") Signed-off-by: Christophe JAILLET Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/e39752476d02605b2be46cab7115f71255ce13a8.1668949256.git.christophe.jaillet@wanadoo.fr commit f359c3e5794ce1897e95d95f5c3f804018077b52 Author: Minghao Chi Date: Tue Nov 22 09:45:58 2022 +0800 mfd: stm32-lptimer: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Minghao Chi Signed-off-by: ye xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202211220945587336502@zte.com.cn commit 959ecba7f5b7a821fc3bf742223f58c489db4bee Author: Uwe Kleine-König Date: Mon Nov 21 11:24:54 2022 +0100 mfd: rohm-bd9576: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221121102454.15664-1-u.kleine-koenig@pengutronix.de commit 65f15e43d9c2e1c263617c9c21501f3b7d09728d Author: Minghao Chi Date: Thu Nov 17 14:07:24 2022 +0800 mfd: fsl-imx25-tsadc: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Minghao Chi Signed-off-by: ye xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202211171407248212856@zte.com.cn commit 3a6f994f848a69deb2bf3cd9d130dd0c09730e55 Author: Kris Bahnsen Date: Wed Dec 7 15:08:53 2022 -0800 spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode The addition of 3WIRE support would affect MOSI direction even when still in standard (4 wire) mode. This can lead to MOSI being at an invalid logic level when a device driver sets an SPI message with a NULL tx_buf. spi.h states that if tx_buf is NULL then "zeros will be shifted out ... " If MOSI is tristated then the data shifted out is subject to pull resistors, keepers, or in the absence of those, noise. This issue came to light when using spi-gpio connected to an ADS7843 touchscreen controller. MOSI pulled high when clocking MISO data in caused the SPI device to interpret this as a command which would put the device in an unexpected and non-functional state. Fixes: 4b859db2c606 ("spi: spi-gpio: add SPI_3WIRE support") Fixes: 5132b3d28371 ("spi: gpio: Support 3WIRE high-impedance turn-around") Signed-off-by: Kris Bahnsen Link: https://lore.kernel.org/r/20221207230853.6174-1-kris@embeddedTS.com Signed-off-by: Mark Brown commit 2a17ddfdca25ac4cbb0d317362608ec32f98fd82 Author: Rob Herring Date: Tue Dec 6 15:15:55 2022 -0600 dt-bindings: Add missing 'unevaluatedProperties' to regulator nodes Several regulator schemas are missing 'unevaluatedProperties' constraint which means any extra properties are allowed. Upon adding the constraint, there's numerous warnings from using the deprecated 'regulator-compatible' property. Remove the usage as examples shouldn't be using long since deprecated properties. Signed-off-by: Rob Herring Acked-by: Lee Jones Acked-by: Sebastian Reichel Acked-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20221206211554.92005-1-robh@kernel.org Signed-off-by: Mark Brown commit e85b1f5a9769ac30f4d2f6fb1cdcd9570c38e0c1 Author: Marek Vasut Date: Thu Dec 8 04:53:54 2022 +0100 ASoC: dt-bindings: fsl-sai: Reinstate i.MX93 SAI compatible string The ASoC: dt-bindings: fsl-sai: Fix mx6ul and mx7d compatible strings dropped i.MX93 SAI compatible string, reinstate it. Fixes: 81b6c043e7ba ("ASoC: dt-bindings: fsl-sai: Fix mx6ul and mx7d compatible strings") Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20221208035354.255438-1-marex@denx.de Signed-off-by: Mark Brown commit 31495d4f6f1308d817a69f9228063a344c5c7ba4 Author: Huacai Chen Date: Sun Sep 18 18:12:06 2022 +0800 platform/mips: Adjust Kconfig to keep consistency Drop the "if MIPS" and "endif" drivers/platform/Kconfig. Instead add a "depends on MIPS" to "menuconfig MIPS_PLATFORM_DEVICES" in drivers/ platform/mips/Kconfig, like all the other subdirs are doing. Suggested-by: Hans de Goede Signed-off-by: Huacai Chen Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit 6b2b0d839acaa84f05a77184370f793752e786e9 Merge: 7365df19e8ff7 5074ffbec67ac Author: Petr Mladek Date: Thu Dec 8 11:46:56 2022 +0100 Merge branch 'rework/console-list-lock' into for-linus commit 6f70a53afa21984e947e63fcc8919e9eaecd31ac Author: Alex Hung Date: Sat Nov 26 17:46:17 2022 -0700 platform/x86: wireless-hotkey: use ACPI HID as phys Removed the hardcoded "hpq6001" as phys but uses ACPI HID instead. Signed-off-by: Alex Hung Link: https://lore.kernel.org/r/20221127004617.722553-1-alex.hung@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ef92750e11d2289fced9ff2ce211f8f790225c86 Author: Xu Panda Date: Sat Dec 3 14:17:16 2022 +0800 MIPS: OCTEON: cvmx-bootmem: use strscpy() to instead of strncpy() The implementation of strscpy() is more robust and safer. Signed-off-by: Xu Panda Signed-off-by: Yang Yang Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit f5739014669a734e42af9e73deb1ca165f49b5ae Author: Geert Uytterhoeven Date: Fri Dec 2 17:49:25 2022 +0100 MIPS: mscc: jaguar2: Fix pca9545 i2c-mux node names "make dtbs_check": arch/mips/boot/dts/mscc/jaguar2_pcb110.dtb: pca9545@70: $nodename:0: 'pca9545@70' does not match '^(i2c-?)?mux' From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml arch/mips/boot/dts/mscc/jaguar2_pcb110.dtb: pca9545@70: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@0', 'i2c@1', 'i2c@2', 'i2c@3' were unexpected) From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml ... Fix this by renaming PCA9545 nodes to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Bogendoerfer commit 637d13b57d853dfc7f5743dfdfb9995c266a6031 Author: Colin Ian King Date: Fri Oct 7 21:40:54 2022 +0100 ovl: Kconfig: Fix spelling mistake "undelying" -> "underlying" There is a spelling mistake in a Kconfig description. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Miklos Szeredi commit 1fa9c5c5eddef0505b353031b7605c97e4257e62 Author: Miklos Szeredi Date: Fri Oct 7 17:35:26 2022 +0200 ovl: use inode instead of dentry where possible Passing dentry to some helpers is unnecessary. Simplify these cases. Signed-off-by: Miklos Szeredi commit cf4ef7801a8c880902a07712ba7ff61d8e954f85 Author: Stanislav Goriainov Date: Wed Aug 31 11:06:58 2022 +0300 ovl: Add comment on upperredirect reassignment If memory for uperredirect was allocated with kstrdup() in upperdir != NULL and d.redirect != NULL path, it may seem that it can be lost when upperredirect is reassigned later, but it's not possible. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0a2d0d3f2f291 ("ovl: Check redirect on index as well") Signed-off-by: Stanislav Goriainov Signed-off-by: Miklos Szeredi commit af4dcb6d78b2b05a0431dfd3f67713bba8dc0900 Author: Amir Goldstein Date: Tue Oct 4 13:34:33 2022 +0300 ovl: use plain list filler in indexdir and workdir cleanup Those two cleanup routines are using the helper ovl_dir_read() with the merge dir filler, which populates an rb tree, that is never used. The index dir entry names all have a long (42 bytes) constant prefix, so it is not surprising that perf top has demostrated high CPU usage by rb tree population during cleanup of a large index dir: - 9.53% ovl_fill_merge - 78.41% ovl_cache_entry_find_link.constprop.27 + 72.11% strncmp Use the plain list filler that does not populate the unneeded rb tree. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 8ea2876577b57805489e3044de7fcb0330c52f40 Author: Amir Goldstein Date: Tue Oct 4 13:34:32 2022 +0300 ovl: do not reconnect upper index records in ovl_indexdir_cleanup() ovl_indexdir_cleanup() is called on mount of overayfs with nfs_export feature to cleanup stale index records for lower and upper files that have been deleted while overlayfs was offline. This has the side effect (good or bad) of pre populating inode cache with all the copied up upper inodes, while verifying the index entries. For copied up directories, the upper file handles are decoded to conncted upper dentries. This has the even bigger side effect of reading the content of all the parent upper directories which may take significantly more time and IO than just reading the upper inodes. Do not request connceted upper dentries for verifying upper directory index entries, because we have no use for the connected dentry. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit cdf5c9d1af411057e33cfbeba02ce19478dedb1e Author: Jiangshan Yi Date: Mon Sep 5 13:47:36 2022 +0800 ovl: fix comment typos Fix two typos. Reported-by: k2ci Signed-off-by: Jiangshan Yi Signed-off-by: Miklos Szeredi commit 73db6a063c785bc3965f17569102a2a61ec10a4c Author: Christian Brauner Date: Fri Sep 9 11:07:47 2022 +0200 ovl: port to vfs{g,u}id_t and associated helpers A while ago we introduced a dedicated vfs{g,u}id_t type in commit 1e5267cd0895 ("mnt_idmapping: add vfs{g,u}id_t"). We already switched over a good part of the VFS. Ultimately we will remove all legacy idmapped mount helpers that operate only on k{g,u}id_t in favor of the new type safe helpers that operate on vfs{g,u}id_t. Cc: Seth Forshee (Digital Ocean) Cc: Amir Goldstein Cc: Christoph Hellwig Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Miklos Szeredi commit 5b0db51215e895a361bc63132caa7cca36a53d6a Author: Zhang Tianci Date: Thu Sep 1 16:29:29 2022 +0800 ovl: Use ovl mounter's fsuid and fsgid in ovl_link() There is a wrong case of link() on overlay: $ mkdir /lower /fuse /merge $ mount -t fuse /fuse $ mkdir /fuse/upper /fuse/work $ mount -t overlay /merge -o lowerdir=/lower,upperdir=/fuse/upper,\ workdir=work $ touch /merge/file $ chown bin.bin /merge/file // the file's caller becomes "bin" $ ln /merge/file /merge/lnkfile Then we will get an error(EACCES) because fuse daemon checks the link()'s caller is "bin", it denied this request. In the changing history of ovl_link(), there are two key commits: The first is commit bb0d2b8ad296 ("ovl: fix sgid on directory") which overrides the cred's fsuid/fsgid using the new inode. The new inode's owner is initialized by inode_init_owner(), and inode->fsuid is assigned to the current user. So the override fsuid becomes the current user. We know link() is actually modifying the directory, so the caller must have the MAY_WRITE permission on the directory. The current caller may should have this permission. This is acceptable to use the caller's fsuid. The second is commit 51f7e52dc943 ("ovl: share inode for hard link") which removed the inode creation in ovl_link(). This commit move inode_init_owner() into ovl_create_object(), so the ovl_link() just give the old inode to ovl_create_or_link(). Then the override fsuid becomes the old inode's fsuid, neither the caller nor the overlay's mounter! So this is incorrect. Fix this bug by using ovl mounter's fsuid/fsgid to do underlying fs's link(). Link: https://lore.kernel.org/all/20220817102952.xnvesg3a7rbv576x@wittgenstein/T Link: https://lore.kernel.org/lkml/20220825130552.29587-1-zhangtianci.1997@bytedance.com/t Signed-off-by: Zhang Tianci Signed-off-by: Jiachen Zhang Reviewed-by: Christian Brauner (Microsoft) Fixes: 51f7e52dc943 ("ovl: share inode for hard link") Cc: # v4.8 Signed-off-by: Miklos Szeredi commit cf8aa9bf97cadf85745506c6a3e244b22c268d63 Author: Kees Cook Date: Sat Sep 24 00:33:15 2022 -0700 ovl: Use "buf" flexible array for memcpy() destination The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21) Reported-by: syzbot+9d14351a171d0d1c7955@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000763a6c05e95a5985@google.com/ Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Signed-off-by: Miklos Szeredi commit 4b6be020bd6b126112c06648de17ead360919ab4 Author: Jiri Slaby (SUSE) Date: Thu Dec 8 10:07:48 2022 +0100 USB: sisusbvga: use module_usb_driver() Now, that we only do usb_register() and usb_sisusb_exit() in module_init() and module_exit() respectivelly, we can simply use module_usb_driver(). Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Yoshinori Sato Cc: Rich Felker Cc: Thomas Winischhofer Cc: Greg Kroah-Hartman Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-sh@vger.kernel.org Cc: linux-usb@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20221208090749.28056-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit a2f3d83cd74eb7cfc69c92d086ec4509cd9c58fb Author: Jiri Slaby (SUSE) Date: Thu Dec 8 10:07:47 2022 +0100 USB: sisusbvga: rename sisusb.c to sisusbvga.c As it's the only source for the sisusbvga module, there is no need for a 2-steps build. Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Yoshinori Sato Cc: Rich Felker Cc: Thomas Winischhofer Cc: Greg Kroah-Hartman Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-sh@vger.kernel.org Cc: linux-usb@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20221208090749.28056-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 74d58cd48a8f5848dfda8bc09d11c90f3ea42b0e Author: Jiri Slaby (SUSE) Date: Thu Dec 8 10:07:46 2022 +0100 USB: sisusbvga: remove console support It was marked as BROKEN since commit 862ee699fefe (USB: sisusbvga: Make console support depend on BROKEN) 2 years ago. Since noone stepped up to fix it, remove it completely. Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Yoshinori Sato Cc: Rich Felker Cc: Thomas Winischhofer Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-sh@vger.kernel.org Cc: linux-usb@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20221208090749.28056-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 37d244ad183f42f91910e47984a7636e970e9d1b Author: Leon Romanovsky Date: Fri Dec 2 22:14:57 2022 +0200 net/mlx5e: Open mlx5 driver to accept IPsec packet offload Enable configuration of IPsec packet offload through XFRM state add interface together with moving specific to IPsec packet mode limitations to specific switch-case section. Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit cee137a634318bfbda18ee5af45d300153b57fa5 Author: Leon Romanovsky Date: Fri Dec 2 22:14:56 2022 +0200 net/mlx5e: Handle ESN update events Extend event logic to update ESN state (esn_msb, esn_overlap) for an IPsec Offload context. Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 8c582ddfbb473c1d799c40b5140aed81278e2837 Author: Leon Romanovsky Date: Fri Dec 2 22:14:55 2022 +0200 net/mlx5e: Handle hardware IPsec limits events Enable object changed event to signal IPsec about hitting soft and hard limits. Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 1ed78fc033074c55221a80498204c539a3696877 Author: Leon Romanovsky Date: Fri Dec 2 22:14:54 2022 +0200 net/mlx5e: Update IPsec soft and hard limits Implement mlx5 IPsec callback to update current lifetime counters. Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 403b383a3ce3ebe12c26317978c34dd3d653c867 Author: Leon Romanovsky Date: Fri Dec 2 22:14:53 2022 +0200 net/mlx5e: Store all XFRM SAs in Xarray Instead of performing custom hash calculations, rely on FW that returns unique identifier to every created SA. That identifier is Xarray ready, which provides better semantic with efficient access. In addition, store both TX and RX SAs to allow correlation between event generated by HW when limits are armed and XFRM states. Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 7bddb659bd0fc4e9022d3a3a2260540c01856e68 Author: Leon Romanovsky Date: Fri Dec 2 22:14:52 2022 +0200 net/mlx5e: Provide intermediate pointer to access IPsec struct Improve readability by providing direct pointer to struct mlx5e_ipsec. Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 6721239672fe38187119afdafe996902ab24fd11 Author: Leon Romanovsky Date: Fri Dec 2 22:14:51 2022 +0200 net/mlx5e: Skip IPsec encryption for TX path without matching policy Software implementation of IPsec skips encryption of packets in TX path if no matching policy is found. So align HW implementation to this behavior, by requiring matching reqid for offloaded policy and SA. Reviewed-by: Raed Salem Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 81f8fba5ecaad53b6b32a81fe7ef06b772557647 Author: Raed Salem Date: Fri Dec 2 22:14:50 2022 +0200 net/mlx5e: Add statistics for Rx/Tx IPsec offloaded flows Add the following statistics: RX successfully IPsec flows: ipsec_rx_pkts : Number of packets passed Rx IPsec flow ipsec_rx_bytes : Number of bytes passed Rx IPsec flow Rx dropped IPsec policy packets: ipsec_rx_drop_pkts: Number of packets dropped in Rx datapath due to IPsec drop policy ipsec_rx_drop_bytes: Number of bytes dropped in Rx datapath due to IPsec drop policy TX successfully encrypted and encapsulated IPsec packets: ipsec_tx_pkts : Number of packets encrypted and encapsulated successfully ipsec_tx_bytes : Number of bytes encrypted and encapsulated successfully Tx dropped IPsec policy packets: ipsec_tx_drop_pkts: Number of packets dropped in Tx datapath due to IPsec drop policy ipsec_tx_drop_bytes: Number of bytes dropped in Tx datapath due to IPsec drop policy The above can be seen using: ethtool -S |grep ipsec Signed-off-by: Raed Salem Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 18f38fd267abf3be8330dd73ddeb838f2dd98f29 Author: Leon Romanovsky Date: Fri Dec 2 22:14:49 2022 +0200 net/mlx5e: Improve IPsec flow steering autogroup Flow steering API separates newly created rules based on their match criteria. Right now, all IPsec tables are created with one group and suffers from not-optimal FS performance. Count number of different match criteria for relevant tables, and set proper value at the table creation. Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 6b5c45e16e434efc6d323a8bc79e0eba49cd13f2 Author: Leon Romanovsky Date: Fri Dec 2 22:14:48 2022 +0200 net/mlx5e: Configure IPsec packet offload flow steering In packet offload mode, the HW is responsible to handle ESP headers, SPI numbers and trailers (ICV) together with different logic for RX and TX paths. In order to support packet offload mode, special logic is added to flow steering rules. Reviewed-by: Raed Salem Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 9af594d8a99ef726b5785a309fb230265d16fd8b Author: Leon Romanovsky Date: Fri Dec 2 22:14:47 2022 +0200 net/mlx5e: Use same coding pattern for Rx and Tx flows Remove intermediate variable in favor of having similar coding style for Rx and Tx add rule functions. Reviewed-by: Raed Salem Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit a5b8ca9471d394459152a2a7f8f5f8227ae3e3c0 Author: Leon Romanovsky Date: Fri Dec 2 22:14:46 2022 +0200 net/mlx5e: Add XFRM policy offload logic Implement mlx5 flow steering logic and mlx5 IPsec code support XFRM policy offload. Reviewed-by: Raed Salem Reviewed-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 8c17295bd4991b6d275248ff7f987f54dd5eb0e6 Author: Leon Romanovsky Date: Fri Dec 2 22:14:45 2022 +0200 net/mlx5e: Create IPsec policy offload tables Add empty table to be used for IPsec policy offload. Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 6cfe7bd0dfd33033683639039b5608d6534c19eb Author: Zhu Yanjun Date: Thu Dec 8 05:19:54 2022 -0500 RDMA/mlx5: Remove not-used IB_FLOW_SPEC_IB define IB_FLOW_SPEC_IB is not used in mlx5 and can be deleted. Signed-off-by: Zhu Yanjun Link: https://lore.kernel.org/r/20221208101954.687960-1-yanjun.zhu@intel.com Signed-off-by: Leon Romanovsky commit e8a292d6a786cab048a83496687d56f121277b88 Merge: 89ae65734a995 a8e052932a2aa Author: Steffen Klassert Date: Thu Dec 8 10:25:30 2022 +0100 Merge branch 'mlx5 IPsec packet offload support (Part I)' Leon Romanovsky says: ============ This series follows previously sent "Extend XFRM core to allow packet offload configuration" series [1]. It is first part with refactoring to mlx5 allow us natively extend mlx5 IPsec logic to support both crypto and packet offloads. ============ Signed-off-by: Steffen Klassert commit ff7a167961d1b97e0e205f245f806e564d3505e7 Author: Ard Biesheuvel Date: Mon Dec 5 11:31:25 2022 +0100 arm64: efi: Execute runtime services from a dedicated stack With the introduction of PRMT in the ACPI subsystem, the EFI rts workqueue is no longer the only caller of efi_call_virt_pointer() in the kernel. This means the EFI runtime services lock is no longer sufficient to manage concurrent calls into firmware, but also that firmware calls may occur that are not marshalled via the workqueue mechanism, but originate directly from the caller context. For added robustness, and to ensure that the runtime services have 8 KiB of stack space available as per the EFI spec, introduce a spinlock protected EFI runtime stack of 8 KiB, where the spinlock also ensures serialization between the EFI rts workqueue (which itself serializes EFI runtime calls) and other callers of efi_call_virt_pointer(). While at it, use the stack pivot to avoid reloading the shadow call stack pointer from the ordinary stack, as doing so could produce a gadget to defeat it. Signed-off-by: Ard Biesheuvel commit 67327f125801f98aec9e2cf5e1df16cf493a065f Author: Asahi Lina Date: Wed Dec 7 10:43:04 2022 +0900 arm64: dts: apple: t6002: Fix GPU power domains On t6002 (M1 Ultra), each die contains a self-contained GPU block. However, only the coprocessor and global management circuitry of the first die are used. This is what is represented by the "gpu" PS (the one in die1 is disabled). Nonetheless, this shared component drives the processing blocks in both dies, and therefore depends on the AFR fabric being powered up on both dies. Add an explicit dependency from the GPU block on die0 to AFR on die1, next to the existing die0 AFR dependency. Fixes: fa86294eb355 ("arm64: dts: apple: Add initial t6000/t6001/t6002 DTs") Signed-off-by: Asahi Lina Reviewed-by: Janne Grunau Signed-off-by: Hector Martin commit 2aa48e294622f7204d02de9758795171c0bd937a Author: Asahi Lina Date: Wed Dec 7 10:43:05 2022 +0900 arm64: dts: apple: t600x-pmgr: Fix search & replace typo It looks like the search-and-replace that happened to add die IDs to the t600x PMGR tree was a little bit too eager on a comment, and nobody noticed! Let's fix that. Fixes: fa86294eb355 ("arm64: dts: apple: Add initial t6000/t6001/t6002 DTs") Signed-off-by: Asahi Lina Reviewed-by: Janne Grunau Signed-off-by: Hector Martin commit d8b879c00f69a22738f6bb7198e763cfcc6b68f8 Merge: e1228581b38bd 020b232f79e97 Author: Jakub Kicinski Date: Wed Dec 7 20:17:35 2022 -0800 Merge branch 'net-ethernet-ti-am65-cpsw-fix-set-channel-operation' Roger Quadros says: ==================== net: ethernet: ti: am65-cpsw: Fix set channel operation This contains a critical bug fix for the recently merged suspend/resume support [1] that broke set channel operation. (ethtool -L eth0 tx ) As there were 2 dependent patches on top of the offending commit [1] first revert them and then apply them back after the correct fix. [1] fd23df72f2be ("net: ethernet: ti: am65-cpsw: Add suspend/resume support") ==================== Link: https://lore.kernel.org/r/20221206094419.19478-1-rogerq@kernel.org Signed-off-by: Jakub Kicinski commit 020b232f79e97ad06d5edc67a2dc34fe5bc271ef Author: Roger Quadros Date: Tue Dec 6 11:44:19 2022 +0200 net: ethernet: ti: am65-cpsw: Fix hardware switch mode on suspend/resume On low power during system suspend the ALE table context is lost. Save the ALE context before suspend and restore it after resume. Signed-off-by: Roger Quadros Signed-off-by: David S. Miller Signed-off-by: Jakub Kicinski commit 1581cd8b11748d9ff1d9deedd9dc5c0c1ce9029b Author: Roger Quadros Date: Tue Dec 6 11:44:18 2022 +0200 net: ethernet: ti: am65-cpsw: retain PORT_VLAN_REG after suspend/resume During suspend resume the context of PORT_VLAN_REG is lost so save it during suspend and restore it during resume for host port and slave ports. Signed-off-by: Roger Quadros Signed-off-by: David S. Miller Signed-off-by: Jakub Kicinski commit 24bc19b05f1fc29e55ec73df5345fe3571c48b15 Author: Roger Quadros Date: Tue Dec 6 11:44:17 2022 +0200 net: ethernet: ti: am65-cpsw: Add suspend/resume support Add PM handlers for System suspend/resume. As DMA driver doesn't yet support suspend/resume we free up the DMA channels at suspend and acquire and initialize them at resume. In this revised approach we do not free the TX/RX IRQs at am65_cpsw_nuss_common_stop() as it causes problems. We will now free them only on .suspend() as we need to release the DMA channels (as DMA looses context) and re-acquiring them on .resume() may not necessarily give us the same IRQs. To make this easier: - introduce am65_cpsw_nuss_remove_rx_chns() which is similar to am65_cpsw_nuss_remove_tx_chns(). These will be invoked in pm.suspend() to release the DMA channels and free up the IRQs. - move napi_add() and request_irq() calls to am65_cpsw_nuss_init_rx/tx_chns() so we can invoke them in pm.resume() to acquire the DMA channels and IRQs. As CPTS looses contect during suspend/resume, invoke the necessary CPTS suspend/resume helpers. ALE_CLEAR command is issued in cpsw_ale_start() so no need to issue it before the call to cpsw_ale_start(). Signed-off-by: Roger Quadros Signed-off-by: Jakub Kicinski commit 1a014663e7dddb711566a9c9746200b187742092 Author: Roger Quadros Date: Tue Dec 6 11:44:16 2022 +0200 Revert "net: ethernet: ti: am65-cpsw: Add suspend/resume support" This reverts commit fd23df72f2be317d38d9fde0a8996b8e7454fd2a. This commit broke set channel operation. Revert this and implement it with a different approach in a separate patch. Signed-off-by: Roger Quadros Signed-off-by: Jakub Kicinski commit 1bae8fa8c4f3e3fd447ea2acdad96bd0fd7ff5da Author: Roger Quadros Date: Tue Dec 6 11:44:15 2022 +0200 Revert "net: ethernet: ti: am65-cpsw: retain PORT_VLAN_REG after suspend/resume" This reverts commit 643cf0e3ab5ccee37b3c53c018bd476c45c4b70e. This is to make it easier to revert the offending commit fd23df72f2be ("net: ethernet: ti: am65-cpsw: Add suspend/resume support") Signed-off-by: Roger Quadros Signed-off-by: Jakub Kicinski commit 1a352596722a129cacc5f601f42ece083d400086 Author: Roger Quadros Date: Tue Dec 6 11:44:14 2022 +0200 Revert "net: ethernet: ti: am65-cpsw: Fix hardware switch mode on suspend/resume" This reverts commit 1af3cb3702d02167926a2bd18580cecb2d64fd94. This is to make it easier to revert the offending commit fd23df72f2be ("net: ethernet: ti: am65-cpsw: Add suspend/resume support") Signed-off-by: Roger Quadros Signed-off-by: Jakub Kicinski commit e1228581b38bd698d3502354c0807863c8b518f7 Merge: 5955a948ac3d4 e5b9642a33be6 Author: Jakub Kicinski Date: Wed Dec 7 20:09:21 2022 -0800 Merge branch 'devlink-add-port-function-attribute-to-enable-disable-roce-and-migratable' Shay Drory says: ==================== devlink: Add port function attribute to enable/disable Roce and migratable This series is a complete rewrite of the series "devlink: Add port function attribute to enable/disable roce" link: https://lore.kernel.org/netdev/20221102163954.279266-1-danielj@nvidia.com/ Currently mlx5 PCI VF and SF are enabled by default for RoCE functionality. And mlx5 PCI VF is disable by dafault for migratable functionality. Currently a user does not have the ability to disable RoCE for a PCI VF/SF device before such device is enumerated by the driver. User is also incapable to do such setting from smartnic scenario for a VF from the smartnic. Current 'enable_roce' device knob is limited to do setting only at driverinit time. By this time device is already created and firmware has already allocated necessary system memory for supporting RoCE. Also, Currently a user does not have the ability to enable migratable for a PCI VF. The above are a hyper visor level control, to set the functionality of devices passed through to guests. This is achieved by extending existing 'port function' object to control capabilities of a function. This enables users to control capability of the device before enumeration. Examples when user prefers to disable RoCE for a VF when using switchdev mode: $ devlink port show pci/0000:06:00.0/1 pci/0000:06:00.0/1: type eth netdev pf0vf0 flavour pcivf controller 0 pfnum 0 vfnum 0 external false splittable false function: hw_addr 00:00:00:00:00:00 roce enable $ devlink port function set pci/0000:06:00.0/1 roce disable $ devlink port show pci/0000:06:00.0/1 pci/0000:06:00.0/1: type eth netdev pf0vf0 flavour pcivf controller 0 pfnum 0 vfnum 0 external false splittable false function: hw_addr 00:00:00:00:00:00 roce disable FAQs: ----- 1. What does roce enable/disable do? Ans: It disables RoCE capability of the function before its enumerated, so when driver reads the capability from the device firmware, it is disabled. At this point RDMA stack will not be able to create UD, QP1, RC, XRC type of QPs. When RoCE is disabled, the GID table of all ports of the device is disabled in the device and software stack. 2. How is the roce 'port function' option different from existing devlink param? Ans: RoCE attribute at the port function level disables the RoCE capability at the specific function level; while enable_roce only does at the software level. 3. Why is this option for disabling only RoCE and not the whole RDMA device? Ans: Because user still wants to use the RDMA device for non RoCE commands in more memory efficient way. ==================== Link: https://lore.kernel.org/r/20221206185119.380138-1-shayd@nvidia.com Signed-off-by: Jakub Kicinski commit e5b9642a33be6f6a9ec2f035299f4a5c0980d7c0 Author: Shay Drory Date: Tue Dec 6 20:51:19 2022 +0200 net/mlx5: E-Switch, Implement devlink port function cmds to control migratable Implement devlink port function commands to enable / disable migratable. This is used to control the migratable capability of the device. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Acked-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit a8ce7b26a51efc4d7753b23d639ae092878a6193 Author: Shay Drory Date: Tue Dec 6 20:51:18 2022 +0200 devlink: Expose port function commands to control migratable Expose port function commands to enable / disable migratable capability, this is used to set the port function as migratable. Live migration is the process of transferring a live virtual machine from one physical host to another without disrupting its normal operation. In order for a VM to be able to perform LM, all the VM components must be able to perform migration. e.g.: to be migratable. In order for VF to be migratable, VF must be bound to VFIO driver with migration support. When migratable capability is enabled for a function of the port, the device is making the necessary preparations for the function to be migratable, which might include disabling features which cannot be migrated. Example of LM with migratable function configuration: Set migratable of the VF's port function. $ devlink port show pci/0000:06:00.0/2 pci/0000:06:00.0/2: type eth netdev enp6s0pf0vf1 flavour pcivf pfnum 0 vfnum 1 function: hw_addr 00:00:00:00:00:00 migratable disable $ devlink port function set pci/0000:06:00.0/2 migratable enable $ devlink port show pci/0000:06:00.0/2 pci/0000:06:00.0/2: type eth netdev enp6s0pf0vf1 flavour pcivf pfnum 0 vfnum 1 function: hw_addr 00:00:00:00:00:00 migratable enable Bind VF to VFIO driver with migration support: $ echo > /sys/bus/pci/devices/0000:08:00.0/driver/unbind $ echo mlx5_vfio_pci > /sys/bus/pci/devices/0000:08:00.0/driver_override $ echo > /sys/bus/pci/devices/0000:08:00.0/driver/bind Attach VF to the VM. Start the VM. Perform LM. Signed-off-by: Shay Drory Reviewed-by: Jiri Pirko Acked-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 7db98396ef4581e4ca2f7e7beb766f4d19fc856a Author: Yishai Hadas Date: Tue Dec 6 20:51:17 2022 +0200 net/mlx5: E-Switch, Implement devlink port function cmds to control RoCE Implement devlink port function commands to enable / disable RoCE. This is used to control the RoCE device capabilities. This patch implement infrastructure which will be used by downstream patches that will add additional capabilities. Signed-off-by: Yishai Hadas Signed-off-by: Daniel Jurgens Signed-off-by: Shay Drory Reviewed-by: Parav Pandit Reviewed-by: Mark Bloch Acked-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 47d0c500d76c7b1d220c47cd875763fef04eba2e Author: Shay Drory Date: Tue Dec 6 20:51:16 2022 +0200 net/mlx5: Add generic getters for other functions caps Downstream patch requires to get other function GENERAL2 caps while mlx5_vport_get_other_func_cap() gets only one type of caps (general). Rename it to represent this and introduce a generic implementation of mlx5_vport_get_other_func_cap(). Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Acked-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit da65e9ff3bf614d2836e38e1d405c7073e6ba3b7 Author: Shay Drory Date: Tue Dec 6 20:51:15 2022 +0200 devlink: Expose port function commands to control RoCE Expose port function commands to enable / disable RoCE, this is used to control the port RoCE device capabilities. When RoCE is disabled for a function of the port, function cannot create any RoCE specific resources (e.g GID table). It also saves system memory utilization. For example disabling RoCE enable a VF/SF saves 1 Mbytes of system memory per function. Example of a PCI VF port which supports function configuration: Set RoCE of the VF's port function. $ devlink port show pci/0000:06:00.0/2 pci/0000:06:00.0/2: type eth netdev enp6s0pf0vf1 flavour pcivf pfnum 0 vfnum 1 function: hw_addr 00:00:00:00:00:00 roce enable $ devlink port function set pci/0000:06:00.0/2 roce disable $ devlink port show pci/0000:06:00.0/2 pci/0000:06:00.0/2: type eth netdev enp6s0pf0vf1 flavour pcivf pfnum 0 vfnum 1 function: hw_addr 00:00:00:00:00:00 roce disable Signed-off-by: Shay Drory Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 875cd5eeba96091d97ce27e6e9b855fba9d2e0fc Author: Shay Drory Date: Tue Dec 6 20:51:14 2022 +0200 devlink: Move devlink port function hw_addr attr documentation devlink port function hw_addr attr documentation is in mlx5 specific file while there is nothing mlx5 specific about it. Move it to devlink-port.rst. Signed-off-by: Shay Drory Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit c0bea69d1ca7974a6a387dbc8d9ca15345e2779f Author: Shay Drory Date: Tue Dec 6 20:51:13 2022 +0200 devlink: Validate port function request In order to avoid partial request processing, validate the request before processing it. Signed-off-by: Shay Drory Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit df268f6ca7da1088d7ecff4250d1478d3fa2406b Author: Yishai Hadas Date: Tue Dec 6 20:51:12 2022 +0200 net/mlx5: Introduce IFC bits for migratable Introduce IFC related capabilities to enable setting VF to be able to perform live migration. e.g.: to be migratable. Signed-off-by: Yishai Hadas Reviewed-by: Mark Bloch Acked-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 5955a948ac3d4e78857726d5e8d4bffb3fc71d4f Merge: 16dc16d9f058d f86c3e2c1b5ea Author: Jakub Kicinski Date: Wed Dec 7 20:05:53 2022 -0800 Merge branch 'bridge-mcast-preparations-for-evpn-extensions' Ido Schimmel says: ==================== bridge: mcast: Preparations for EVPN extensions This patchset was split from [1] and includes non-functional changes aimed at making it easier to add additional netlink attributes later on. Future extensions are available here [2]. The idea behind these patches is to create an MDB configuration structure into which netlink messages are parsed into. The structure is then passed in the entry creation / deletion call chain instead of passing the netlink attributes themselves. The same pattern is used by other rtnetlink objects such as routes and nexthops. I initially tried to extend the current code, but it proved to be too difficult, which is why I decided to refactor it to the extensible and familiar pattern used by other rtnetlink objects. Tested using existing selftests and using a new selftest that will be submitted together with the planned extensions. [1] https://lore.kernel.org/netdev/20221018120420.561846-1-idosch@nvidia.com/ [2] https://github.com/idosch/linux/commits/submit/mdb_v1 ==================== Link: https://lore.kernel.org/r/20221206105809.363767-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit f86c3e2c1b5ea5c959ef176541c2f831231fa631 Author: Ido Schimmel Date: Tue Dec 6 12:58:09 2022 +0200 bridge: mcast: Constify 'group' argument in br_multicast_new_port_group() The 'group' argument is not modified, so mark it as 'const'. It will allow us to constify arguments of the callers of this function in future patches. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 090149eaf3911ce588775107b25c725d287752ef Author: Ido Schimmel Date: Tue Dec 6 12:58:08 2022 +0200 bridge: mcast: Remove redundant function arguments Drop the first three arguments and instead extract them from the MDB configuration structure. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 4c1ebc6c1f2196c11cff78832c2604bbcec7d088 Author: Ido Schimmel Date: Tue Dec 6 12:58:07 2022 +0200 bridge: mcast: Move checks out of critical section The checks only require information parsed from the RTM_NEWMDB netlink message and do not rely on any state stored in the bridge driver. Therefore, there is no need to perform the checks in the critical section under the multicast lock. Move the checks out of the critical section. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 3ee5662345f26c3d694e25f3e3b577deaaf31c0f Author: Ido Schimmel Date: Tue Dec 6 12:58:06 2022 +0200 bridge: mcast: Remove br_mdb_parse() The parsing of the netlink messages and the validity checks are now performed in br_mdb_config_init() so we can remove br_mdb_parse(). This finally allows us to stop passing netlink attributes deep in the MDB control path and only use the MDB configuration structure. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 9f52a51429791737eaf35c6fb5273d178ec005d9 Author: Ido Schimmel Date: Tue Dec 6 12:58:05 2022 +0200 bridge: mcast: Use MDB group key from configuration structure The MDB group key (i.e., {source, destination, protocol, VID}) is currently determined under the multicast lock from the netlink attributes. Instead, use the group key from the MDB configuration structure that was prepared before acquiring the lock. No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 8bd9c08e324175051d6d8ad5b2acfeaccaa1047b Author: Ido Schimmel Date: Tue Dec 6 12:58:04 2022 +0200 bridge: mcast: Propagate MDB configuration structure further As an intermediate step towards only using the new MDB configuration structure, pass it further in the control path instead of passing individual attributes. No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit f2b5aac68117909c3ac9e660c3182fd59524242f Author: Ido Schimmel Date: Tue Dec 6 12:58:03 2022 +0200 bridge: mcast: Use MDB configuration structure where possible The MDB configuration structure (i.e., struct br_mdb_config) now includes all the necessary information from the parsed RTM_{NEW,DEL}MDB netlink messages, so use it. This will later allow us to delete the calls to br_mdb_parse() from br_mdb_add() and br_mdb_del(). No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 3866116815249be8a5ebfa37ddea9f1032c976a9 Author: Ido Schimmel Date: Tue Dec 6 12:58:02 2022 +0200 bridge: mcast: Remove redundant checks These checks are now redundant as they are performed by br_mdb_config_init() while parsing the RTM_{NEW,DEL}MDB messages. Remove them. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit cb453926865ea0dddda898c8184eebb595f3c53d Author: Ido Schimmel Date: Tue Dec 6 12:58:01 2022 +0200 bridge: mcast: Centralize netlink attribute parsing Netlink attributes are currently passed deep in the MDB creation call chain, making it difficult to add new attributes. In addition, some validity checks are performed under the multicast lock although they can be performed before it is ever acquired. As a first step towards solving these issues, parse the RTM_{NEW,DEL}MDB messages into a configuration structure, relieving other functions from the need to handle raw netlink attributes. Subsequent patches will convert the MDB code to use this configuration structure. This is consistent with how other rtnetlink objects are handled, such as routes and nexthops. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 16dc16d9f058dce7031ee8b850f10622b8b5fb14 Author: ye xingchen Date: Mon Dec 5 19:18:56 2022 +0800 net: ethernet: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/202212051918564721658@zte.com.cn Signed-off-by: Jakub Kicinski commit e0bb331221f85d131f277c834bdf20e977badfd8 Merge: 9abf2313adc1c e2e6a217a84d0 Author: Stephen Boyd Date: Wed Dec 7 18:31:22 2022 -0800 Merge tag 'clk-microchip-fixes-6.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Claudiu Beznea: It contains a fix for Microchip Polarfire clocks; the fix consist in checking the return value of devm_kzalloc() in mpfs_ccc_register_outputs() to avoid possible null pointer dereference. * tag 'clk-microchip-fixes-6.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: microchip: check for null return of devm_kzalloc() ARM: at91: rm9200: fix usb device clock id commit cfd3ffb36f0d566846163118651d868e607300ba Author: Xiu Jianfeng Date: Tue Nov 22 21:36:14 2022 +0800 clk: st: Fix memory leak in st_of_quadfs_setup() If st_clk_register_quadfs_pll() fails, @lock should be freed before goto @err_exit, otherwise will cause meory leak issue, fix it. Signed-off-by: Xiu Jianfeng Link: https://lore.kernel.org/r/20221122133614.184910-1-xiujianfeng@huawei.com Reviewed-by: Patrice Chotard Signed-off-by: Stephen Boyd commit 5174e5b0d1b669a489524192b6adcbb3c54ebc72 Author: Xiu Jianfeng Date: Wed Nov 23 11:20:15 2022 +0800 clk: samsung: Fix memory leak in _samsung_clk_register_pll() If clk_register() fails, @pll->rate_table may have allocated memory by kmemdup(), so it needs to be freed, otherwise will cause memory leak issue, this patch fixes it. Fixes: 3ff6e0d8d64d ("clk: samsung: Add support to register rate_table for samsung plls") Signed-off-by: Xiu Jianfeng Link: https://lore.kernel.org/r/20221123032015.63980-1-xiujianfeng@huawei.com Reviewed-by: Alim Akhtar Signed-off-by: Stephen Boyd commit 9a8aadcf0b459c1257b9477fd6402e1d5952ae07 Author: Victor Ding Date: Wed Dec 7 09:39:40 2022 +0000 platform/chrome: cros_ec_typec: zero out stale pointers `cros_typec_get_switch_handles` allocates four pointers when obtaining type-c switch handles. These pointers are all freed if failing to obtain any of them; therefore, pointers in `port` become stale. The stale pointers eventually cause use-after-free or double free in later code paths. Zeroing out all pointer fields after freeing to eliminate these stale pointers. Fixes: f28adb41dab4 ("platform/chrome: cros_ec_typec: Register Type C switches") Fixes: 1a8912caba02 ("platform/chrome: cros_ec_typec: Get retimer handle") Signed-off-by: Victor Ding Acked-by: Prashant Malani Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20221207093924.v2.1.I1864b6a7ee98824118b93677868d22d3750f439b@changeid commit 26df05a8c1420ad3de314fdd407e7fc2058cc7aa Author: Steven Rostedt Date: Wed Nov 30 17:54:34 2022 -0500 kest.pl: Fix grub2 menu handling for rebooting grub2 has submenus where to use grub-reboot, it requires: grub-reboot X>Y where X is the main index and Y is the submenu. Thus if you have: menuentry 'Debian GNU/Linux' --class debian --class gnu-linux ... [...] } submenu 'Advanced options for Debian GNU/Linux' $menuentry_id_option ... menuentry 'Debian GNU/Linux, with Linux 6.0.0-4-amd64' --class debian --class gnu-linux ... [...] } menuentry 'Debian GNU/Linux, with Linux 6.0.0-4-amd64 (recovery mode)' --class debian --class gnu-linux ... [...] } menuentry 'Debian GNU/Linux, with Linux test' --class debian --class gnu-linux ... [...] } And wanted to boot to the "Linux test" kernel, you need to run: # grub-reboot 1>2 As 1 is the second top menu (the submenu) and 2 is the third of the sub menu entries. Have the grub.cfg parsing for grub2 handle such cases. Cc: stable@vger.kernel.org Fixes: a15ba91361d46 ("ktest: Add support for grub2") Reviewed-by: John 'Warthog9' Hawley (VMware) Signed-off-by: Steven Rostedt commit ef784eebb56425eed6e9b16e7d47e5c00dcf9c38 Author: Steven Rostedt Date: Fri Dec 2 11:59:36 2022 -0500 ktest.pl minconfig: Unset configs instead of just removing them After a full run of a make_min_config test, I noticed there were a lot of CONFIGs still enabled that really should not be. Looking at them, I noticed they were all defined as "default y". The issue is that the test simple removes the config and re-runs make oldconfig, which enables it again because it is set to default 'y'. Instead, explicitly disable the config with writing "# CONFIG_FOO is not set" to the file to keep it from being set again. With this change, one of my box's minconfigs went from 768 configs set, down to 521 configs set. Link: https://lkml.kernel.org/r/20221202115936.016fce23@gandalf.local.home Cc: stable@vger.kernel.org Fixes: 0a05c769a9de5 ("ktest: Added config_bisect test type") Reviewed-by: John 'Warthog9' Hawley (VMware) Signed-off-by: Steven Rostedt (Google) commit cfbf877a338c202ace114f309a6dc0ef5cfb4ad1 Merge: 5608e0a817ceb e29e3c7ce6d4b Author: Jakub Kicinski Date: Wed Dec 7 17:33:26 2022 -0800 Merge tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next Stefan Schmidt says: ==================== ieee802154-next 2022-12-05 Miquel continued his work towards full scanning support. For this, we now allow the creation of dedicated coordinator interfaces to allow a PAN coordinator to serve in the network and set the needed address filters with the hardware. On top of this we have the first part to allow scanning for available 15.4 networks. A new netlink scan group, within the existing nl802154 API, was added. In addition Miquel fixed two issues that have been introduced in the former patches to free an skb correctly and clarifying an expression in the stack. From David Girault we got tracing support when registering new PANs. * tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next: mac802154: Trace the registration of new PANs ieee802154: Advertize coordinators discovery mac802154: Allow the creation of coordinator interfaces mac802154: Clarify an expression mac802154: Move an skb free within the rx path ==================== Link: https://lore.kernel.org/r/20221205131909.1871790-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 5608e0a817ceb84afca8a8d738c29ffefbe4a398 Author: Oleksij Rempel Date: Mon Dec 5 14:21:02 2022 +0100 net: asix: add support for the Linux Automation GmbH USB 10Base-T1L Add ASIX based USB 10Base-T1L adapter support: https://linux-automation.com/en/products/usb-t1l.html Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20221205132102.2941732-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 2d14123617f9917126c78719e0eaae3badbd624f Merge: 26c386ecf0212 36aa10ffd6480 Author: Alexei Starovoitov Date: Wed Dec 7 17:09:13 2022 -0800 Merge branch 'Document some recent core kfunc additions' David Vernet says: ==================== A series of recent patch sets introduced kfuncs that allowed struct task_struct and struct cgroup objects to be used as kptrs. These were introduced in [0], [1], and [2]. [0]: https://lore.kernel.org/lkml/20221120051004.3605026-1-void@manifault.com/ [1]: https://lore.kernel.org/lkml/20221122145300.251210-2-void@manifault.com/T/ [2]: https://lore.kernel.org/lkml/20221122055458.173143-1-void@manifault.com/ These are "core" kfuncs, in that they may be used by a wide variety of possible BPF tracepoint or struct_ops programs, and are defined in kernel/bpf/helpers.c. Even though as kfuncs they have no ABI stability guarantees, they should still be properly documented. This patch set adds that documentation. Some other kfuncs were added recently as well, such as bpf_rcu_read_lock() and bpf_rcu_read_unlock(). Those could and should be added to this "Core kfuncs" section as well in subsequent patch sets. Note that this patch set does not contain documentation for bpf_task_acquire_not_zero(), or bpf_task_kptr_get(). As discussed in [3], those kfuncs currently always return NULL pending resolution on how to properly protect their arguments using RCU. [3]: https://lore.kernel.org/all/20221206210538.597606-1-void@manifault.com/ --- Changelog: v2 -> v3: - Don't document bpf_task_kptr_get(), and instead provide a more substantive example for bpf_cgroup_kptr_get(). - Further clarify expected behavior of bpf_task_from_pid() in comments (Alexei) v1 -> v2: - Expand comment to specify that a map holds a reference to a task kptr if we don't end up releasing it (Alexei) - Just read task->pid instead of using a probed read (Alexei) ==================== Signed-off-by: Alexei Starovoitov commit 36aa10ffd6480b93e32611411be4a8fc49804aba Author: David Vernet Date: Wed Dec 7 14:49:11 2022 -0600 bpf/docs: Document struct cgroup * kfuncs bpf_cgroup_acquire(), bpf_cgroup_release(), bpf_cgroup_kptr_get(), and bpf_cgroup_ancestor(), are kfuncs that were recently added to kernel/bpf/helpers.c. These are "core" kfuncs in that they're available for use in any tracepoint or struct_ops BPF program. Though they have no ABI stability guarantees, we should still document them. This patch adds a struct cgroup * subsection to the Core kfuncs section which describes each of these kfuncs. Signed-off-by: David Vernet Link: https://lore.kernel.org/r/20221207204911.873646-3-void@manifault.com Signed-off-by: Alexei Starovoitov commit 25c5e92d197bd721e706444c5910fd386c330456 Author: David Vernet Date: Wed Dec 7 14:49:10 2022 -0600 bpf/docs: Document struct task_struct * kfuncs bpf_task_acquire(), bpf_task_release(), and bpf_task_from_pid() are kfuncs that were recently added to kernel/bpf/helpers.c. These are "core" kfuncs in that they're available for use for any tracepoint or struct_ops BPF program. Though they have no ABI stability guarantees, we should still document them. This patch adds a new Core kfuncs section to the BPF kfuncs doc, and adds entries for all of these task kfuncs. Note that bpf_task_kptr_get() is not documented, as it still returns NULL while we're working to resolve how it can use RCU to ensure struct task_struct * lifetime. Signed-off-by: David Vernet Link: https://lore.kernel.org/r/20221207204911.873646-2-void@manifault.com Signed-off-by: Alexei Starovoitov commit 26c386ecf0212affb50f02dabcb0152995b99b07 Author: Andrii Nakryiko Date: Wed Dec 7 12:16:48 2022 -0800 selftests/bpf: convert dynptr_fail and map_kptr_fail subtests to generic tester Convert big chunks of dynptr and map_kptr subtests to use generic verification_tester. They are switched from using manually maintained tables of test cases, specifying program name and expected error verifier message, to btf_decl_tag-based annotations directly on corresponding BPF programs: __failure to specify that BPF program is expected to fail verification, and __msg() to specify expected log message. Acked-by: John Fastabend Signed-off-by: Andrii Nakryiko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20221207201648.2990661-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 537c3f66eac137a02ec50a40219d2da6597e5dc9 Author: Andrii Nakryiko Date: Wed Dec 7 12:16:47 2022 -0800 selftests/bpf: add generic BPF program tester-loader It's become a common pattern to have a collection of small BPF programs in one BPF object file, each representing one test case. On user-space side of such tests we maintain a table of program names and expected failure or success, along with optional expected verifier log message. This works, but each set of tests reimplement this mundane code over and over again, which is a waste of time for anyone trying to add a new set of tests. Furthermore, it's quite error prone as it's way too easy to miss some entries in these manually maintained test tables (as evidences by dynptr_fail tests, in which ringbuf_release_uninit_dynptr subtest was accidentally missed; this is fixed in next patch). So this patch implements generic test_loader, which accepts skeleton name and handles the rest of details: opens and loads BPF object file, making sure each program is tested in isolation. Optionally each test case can specify expected BPF verifier log message. In case of failure, tester makes sure to report verifier log, but it also reports verifier log in verbose mode unconditionally. Now, the interesting deviation from existing custom implementations is the use of btf_decl_tag attribute to specify expected-to-fail vs expected-to-succeed markers and, optionally, expected log message directly next to BPF program source code, eliminating the need to manually create and update table of tests. We define few macros wrapping btf_decl_tag with a convention that all values of btf_decl_tag start with "comment:" prefix, and then utilizing a very simple "just_some_text_tag" or "some_key_name=" pattern to define things like expected success/failure, expected verifier message, extra verifier log level (if necessary). This approach is demonstrated by next patch in which two existing sets of failure tests are converted. Tester supports both expected-to-fail and expected-to-succeed programs, though this patch set didn't convert any existing expected-to-succeed programs yet, as existing tests couple BPF program loading with their further execution through attach or test_prog_run. One way to allow testing scenarios like this would be ability to specify custom callback, executed for each successfully loaded BPF program. This is left for follow up patches, after some more analysis of existing test cases. This test_loader is, hopefully, a start of a test_verifier-like runner, but integrated into test_progs infrastructure. It will allow much better "user experience" of defining low-level verification tests that can take advantage of all the libbpf-provided nicety features on BPF side: global variables, declarative maps, etc. All while having a choice of defining it in C or as BPF assembly (through __attribute__((naked)) functions and using embedded asm), depending on what makes most sense in each particular case. This will be explored in follow up patches as well. Acked-by: John Fastabend Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20221207201648.2990661-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 682c0722addae4b4a1440c9db9d8c86cb8e09ce5 Author: Chengchang Tang Date: Sat Nov 26 18:29:11 2022 +0800 RDMA/hns: Fix XRC caps on HIP08 XRC caps has been set by default. But in fact, XRC is not supported in HIP08. Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") Link: https://lore.kernel.org/r/20221126102911.2921820-7-xuhaoyue1@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit 667d6164b84884c64de3fc18670cd5a98b0b10cf Author: Chengchang Tang Date: Sat Nov 26 18:29:10 2022 +0800 RDMA/hns: Fix error code of CMD The error code is fixed to EIO when CMD fails to excute. This patch converts the error status reported by firmware to linux errno. Fixes: a04ff739f2a9 ("RDMA/hns: Add command queue support for hip08 RoCE driver") Link: https://lore.kernel.org/r/20221126102911.2921820-6-xuhaoyue1@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit 99dc5a0712883d5d13b620d25b3759d429577bc8 Author: Chengchang Tang Date: Sat Nov 26 18:29:09 2022 +0800 RDMA/hns: Fix page size cap from firmware Add verification to make sure the roce page size cap is supported by the system page size. Fixes: ba6bb7e97421 ("RDMA/hns: Add interfaces to get pf capabilities from firmware") Link: https://lore.kernel.org/r/20221126102911.2921820-5-xuhaoyue1@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit 9fb39ef2ff3e18f1740625ba04093dfbef086d2b Author: Chengchang Tang Date: Sat Nov 26 18:29:08 2022 +0800 RDMA/hns: Fix PBL page MTR find Now, The address of the first two pages in the MR will be searched, which use to speed up the lookup of the pbl table for hardware. An exception will occur when there is only one page in this MR. This patch fix the number of page to search. Fixes: 9b2cf76c9f05 ("RDMA/hns: Optimize PBL buffer allocation process") Link: https://lore.kernel.org/r/20221126102911.2921820-4-xuhaoyue1@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit bc34c04f7b97c3794dec5a6d6d27ffd5f0e4f5c8 Author: Chengchang Tang Date: Sat Nov 26 18:29:07 2022 +0800 RDMA/hns: Fix AH attr queried by query_qp The queried AH attr is invalid. This patch fix it. This problem is found by rdma-core test test_mr_rereg_pd ERROR: test_mr_rereg_pd (tests.test_mr.MRTest) Test that cover rereg MR's PD with this flow: ---------------------------------------------------------------------- Traceback (most recent call last): File "./tests/test_mr.py", line 157, in test_mr_rereg_pd self.restate_qps() File "./tests/test_mr.py", line 113, in restate_qps self.server.qp.to_rts(self.server_qp_attr) File "qp.pyx", line 1137, in pyverbs.qp.QP.to_rts File "qp.pyx", line 1123, in pyverbs.qp.QP.to_rtr pyverbs.pyverbs_error.PyverbsRDMAError: Failed to modify QP state to RTR. Errno: 22, Invalid argument Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/20221126102911.2921820-3-xuhaoyue1@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit 487d65090a3dce1ae54946aded55d0f8ac87cbab Author: Yixing Liu Date: Sat Nov 26 18:29:06 2022 +0800 RDMA/hns: Fix the gid problem caused by free mr After the hns roce driver is loaded, if you modify the mac address of the network port, the following error will appear: __ib_cache_gid_add: unable to add gid fe80:0000:0000:0000:4600:4dff:fe22:abb5 error=-28 hns3 0000:7d:00.0 hns_0: attr path_mtu(1) invalid while modify qp The reason for the error is that the gid being occupied will cause the failure to modify the gid. The gid is occupied by the loopback QP used by free mr. When the mac address is modified, the gid will change. If there is a busy QP at this time, the gid will not be released and the modification will fail. The QP of free mr is created using the ib interface. The ib interface will add a reference count to the gid, resulting in this error scenario. Considering that free mr is solving a bug in HIP08, not an actual business, it is not necessary to use ib interfaces. Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT") Link: https://lore.kernel.org/r/20221126102911.2921820-2-xuhaoyue1@hisilicon.com Signed-off-by: Yixing Liu Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit fb4907f487254375830f135dcfe5dd7e6f8b705f Author: Chao Leng Date: Fri Nov 25 09:00:26 2022 +0800 RDMA/cma: Change RoCE packet life time from 18 to 16 The ack timeout retransmission time is affected by the following two factors: one is packet life time, another is the HCA processing time. Now the default packet lifetime(CMA_IBOE_PACKET_LIFETIME) is 18. That means the minimum ack timeout is 2 seconds (2^(18+1)*4us=2.097seconds). The packet lifetime means the maximum transmission time of packets on the network, 2 seconds is too long. Assume the network is a clos topology with three layers, every packet will pass through five hops of switches. Assume the buffer of every switch is 128MB and the port transmission rate is 25 Gbit/s, the maximum transmission time of the packet is 200ms(128MB*5/25Gbit/s). Add double redundancy, it is less than 500ms. So change the CMA_IBOE_PACKET_LIFETIME to 16, the maximum transmission time of the packet will be about 500+ms, it is long enough. Link: https://lore.kernel.org/r/20221125010026.755-1-lengchao@huawei.com Signed-off-by: Chao Leng Signed-off-by: Jason Gunthorpe commit 64fdcbcc064966bbf261bb455876dffa58858d32 Author: Michael Ellerman Date: Thu Dec 8 09:43:15 2022 +1100 powerpc/prom: Fix 32-bit build Add an IS_ENABLED() check to fix the build error: arch/powerpc/kernel/prom.o: in function `early_init_dt_scan_cpus': prom.c:(.init.text+0x2ea): undefined reference to `boot_cpu_node_count' Fixes: e13d23a404f2 ("powerpc: export the CPU node count") Signed-off-by: Michael Ellerman commit 76007ccc5727f86c105e96697e96dcf2df6b1634 Author: Dmitry Torokhov Date: Wed Dec 7 13:07:10 2022 -0800 PCI: mvebu: Switch to using gpiod API Switch the driver away from legacy gpio/of_gpio API to gpiod API, and remove use of of_get_named_gpio_flags() which I want to make private to gpiolib. Link: https://lore.kernel.org/r/Y5EAft42YiT66mVj@google.com Signed-off-by: Dmitry Torokhov Signed-off-by: Bjorn Helgaas commit dcb2288b1fd9a8cdf2f3b8c0c7b3763346ef515f Author: Andrii Nakryiko Date: Wed Dec 7 11:55:34 2022 -0800 bpf: Remove unused insn_cnt argument from visit_[func_call_]insn() Number of total instructions in BPF program (including subprogs) can and is accessed from env->prog->len. visit_func_call_insn() doesn't do any checks against insn_cnt anymore, relying on push_insn() to do this check internally. So remove unnecessary insn_cnt input argument from visit_func_call_insn() and visit_insn() functions. Suggested-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20221207195534.2866030-1-andrii@kernel.org commit 63cd992e5179db5600ce8975735a484c1caa96a5 Merge: 9abf2313adc1c 2931aa6758da9 Author: Stephen Boyd Date: Wed Dec 7 13:54:41 2022 -0800 Merge tag 'qcom-clk-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: This introduces Global clock controller for SM8550, Display clock controller for SC8280XP and RPMh clock controller for QDU1000 and QRU1000. The SM8150/SM8250 Display clock controller is cleaned up and some missing clocks for SM8350 are added. MSM8974 Global and Multimedia clock controllers are transitioned to parent_data and parent_hws. IPQ8074 parent_data and additional network resets and the Krait clock controller modernized. pm_runtime usage in SC7180 and SC7280 LPASS clock controllers are corrected. SM8250 USB GDSCs enable retention mode. RPM and RPMh clock drivers are cleaned up, to avoid duplicating clocks which definition could be shared between platforms. A variety of DT binding improvements. * tag 'qcom-clk-for-6.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (69 commits) clk: qcom: rpmh: add support for SM6350 rpmh IPA clock clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: mmcc-msm8974: move clock parent tables down clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-msm8974: use parent_hws/_data instead of parent_names clk: qcom: gcc-msm8974: move clock parent tables down clk: qcom: gcc-msm8974: use ARRAY_SIZE instead of specifying num_parents dt-bindings: clocks: qcom,mmcc: define clocks/clock-names for MSM8974 dt-bindings: clock: split qcom,gcc-msm8974,-msm8226 to the separate file clk: qcom: gcc-ipq4019: switch to devm_clk_notifier_register clk: qcom: rpmh: remove usage of platform name clk: qcom: rpmh: rename VRM clock data clk: qcom: rpmh: rename ARC clock data clk: qcom: rpmh: support separate symbol name for the RPMH clocks clk: qcom: rpmh: remove platform names from BCM clocks clk: qcom: rpmh: drop all _ao names clk: qcom: rpmh: reuse common duplicate clocks clk: qcom: rpmh: group clock definitions together clk: qcom: rpm: drop the platform from clock definitions clk: qcom: rpm: drop the _clk suffix completely ... commit 49e62e0d96baf7236615e4ec2878d8db229de9c2 Author: Maxime Ripard Date: Wed Oct 26 15:46:59 2022 +0200 clk: Add trace events for rate requests It is currently fairly difficult to follow what clk_rate_request are issued, and how they have been modified once done. Indeed, there's multiple paths that can be taken, some functions are recursive and will just forward the request to its parent, etc. Adding a lot of debug prints is just not very convenient, so let's add trace events for the clock requests, one before they are submitted and one after they are returned. That way we can simply toggle the tracing on without modifying the kernel code and without affecting performances or the kernel logs too much. Reviewed-by: Steven Rostedt (Google) Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20221018-clk-rate-request-tracing-v2-2-5170b363c413@cerno.tech Signed-off-by: Stephen Boyd commit ef13f8b64728c4b4d28639bbcf30fe1314b18482 Author: Maxime Ripard Date: Wed Oct 26 15:46:58 2022 +0200 clk: Store clk_core for clk_rate_request The struct clk_rate_request is meant to store the context around a rate request such as the parent, boundaries, and so on. However, it doesn't store the clock the rate request is submitted to, which makes debugging difficult. Let's add a pointer to the relevant clk_core instance in order to improve the debugging of rate requests in a subsequent patch. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20221018-clk-rate-request-tracing-v2-1-5170b363c413@cerno.tech Signed-off-by: Stephen Boyd commit 0a6ea1ce8260f08079b0940350a21e4ad95c2378 Merge: e9b4aeed56699 5b481acab4ce0 Author: Alexei Starovoitov Date: Wed Dec 7 13:49:11 2022 -0800 Merge "do not rely on ALLOW_ERROR_INJECTION for fmod_ret" into bpf-next Merge commit 5b481acab4ce ("bpf: do not rely on ALLOW_ERROR_INJECTION for fmod_ret") from hid tree into bpf-next. Signed-off-by: Alexei Starovoitov commit de4b8d201666b332034f8117b0995a43534b57d3 Author: Jonathan Cameron Date: Sun Dec 4 18:08:41 2022 +0000 Input: pxspad - fix unused data warning when force feedback not enabled The functions using this data were protected with #ifdef CONFIG_JOYSTICK_PSXPAD_SPI_FF. Do the same for the data used only in those functions. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-33-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 1c89ef672a161bfdb5c72f35b80940ea56c9f935 Author: Jonathan Cameron Date: Sun Dec 4 18:08:40 2022 +0000 Input: lpc32xx - allow building with COMPILE_TEST Used to test the PM changes. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-32-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 78c2b18b1e85b6e3ddff9d3cff3597f0d5e7b82d Author: Jonathan Cameron Date: Sun Dec 4 18:08:39 2022 +0000 Input: nomadik-ske-keypad - allow building with COMPILE_TEST Used to build test the PM changes. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-31-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit ececc2024e10c07605888517515c19990925161a Author: Jonathan Cameron Date: Sun Dec 4 18:08:38 2022 +0000 Input: pxa27xx-keypad - allow build with COMPILE_TEST Used to build test PM changes. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-30-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 0b07641ec0f94e166b9dd5b175d65769f025d6e3 Author: Jonathan Cameron Date: Sun Dec 4 18:08:37 2022 +0000 Input: spear-keyboard - improve build coverage using COMPILE_TEST Used to test the PM changes. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-29-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit d65adc2b16f89e244b746eb149af17f93b75bbdc Author: Jonathan Cameron Date: Sun Dec 4 18:08:36 2022 +0000 Input: tegra-kbc - allow build with COMPILE_TEST Used to build test PM changes. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-28-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 995765edc43b8898f5fa6742403ff6dfa2afb56e Author: Jonathan Cameron Date: Sun Dec 4 18:08:35 2022 +0000 Input: tegra-kbc - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-27-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit bf7aa12bb0a3693b1897368c0b6e2ae80998367a Author: Jonathan Cameron Date: Sun Dec 4 18:08:34 2022 +0000 Input: tca6416-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-26-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit eeeeb51b9c78c377cccdd34c654eeaaec7e46476 Author: Jonathan Cameron Date: Sun Dec 4 18:08:33 2022 +0000 Input: tc3589x - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-25-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit a473a763f4350a4cdc59bef0a3c1bc0d8dc94b9a Author: Jonathan Cameron Date: Sun Dec 4 18:08:32 2022 +0000 Input: st-keyscan - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-24-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit aebc2380c1f20df2faa39f3cc069825d2fdd9dd7 Author: Jonathan Cameron Date: Sun Dec 4 18:08:31 2022 +0000 Input: sh-keysc - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-23-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 9254ed3f13e45232266e9e074d5902234fde8ca8 Author: Jonathan Cameron Date: Sun Dec 4 18:08:30 2022 +0000 Input: qt1070 - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-22-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit a4b4fa510181526c496052c1be320c0fcb05826c Author: Jonathan Cameron Date: Sun Dec 4 18:08:29 2022 +0000 Input: pxa27x_keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-21-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit bb4678889e690a4ce0a61d5528e309026fce636f Author: Jonathan Cameron Date: Sun Dec 4 18:08:28 2022 +0000 Input: pmic8xxx-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-20-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit baa0e23fbedd20704f2d69a8ae703cd1b234aed6 Author: Jonathan Cameron Date: Sun Dec 4 18:08:27 2022 +0000 Input: nomadik-ske-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20221204180841.2211588-19-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 6b94d7b649443ab0f23a3984e1ddc9c8870e0029 Author: Jonathan Cameron Date: Sun Dec 4 18:08:26 2022 +0000 Input: mcs-touchkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-18-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit b94615650fe66e3e87cb14c5ec2e38b2884d9f37 Author: Jonathan Cameron Date: Sun Dec 4 18:08:25 2022 +0000 Input: max7359-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-17-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit b9425700d297b530f1e656bdbf8936dce55f0029 Author: Jonathan Cameron Date: Sun Dec 4 18:08:24 2022 +0000 Input: matrix-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-16-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit bad0193a069231dfdf9664a60b49f34c232ed58c Author: Jonathan Cameron Date: Sun Dec 4 18:08:23 2022 +0000 Input: lpc32xx-keys - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-15-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit d0774bc97543739a40544260184bbb6e1fed4af4 Author: Jonathan Cameron Date: Sun Dec 4 18:08:22 2022 +0000 Input: lm8323 - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the ifdef guards. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-14-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 03ea337338ceea34be27b7b131dbd75d61a4d217 Author: Jonathan Cameron Date: Sun Dec 4 18:08:21 2022 +0000 Input: tm2-touchkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-13-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 1844c79c4dc9a2a8297160e9beae9f2a9c7f775b Author: Jonathan Cameron Date: Sun Dec 4 18:08:20 2022 +0000 Input: spear-keyboard - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-12-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit ffa5d80fa99a65465feb47012a916e8b3f01c10a Author: Jonathan Cameron Date: Sun Dec 4 18:08:19 2022 +0000 Input: qt1050 - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Reviewed-by: Marco Felsch Link: https://lore.kernel.org/r/20221204180841.2211588-11-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit b346200943a27ddf94c3a92755b3748d25c2eb13 Author: Jonathan Cameron Date: Sun Dec 4 18:08:18 2022 +0000 Input: mtk-pmic-keys - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20221204180841.2211588-10-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 8362cb5ca9043f2734aa81d73444e16f9c5d09e1 Author: Jonathan Cameron Date: Sun Dec 4 18:08:17 2022 +0000 Input: mpr121-touchkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-9-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 8c1f3b2e248fa0e09d81b7cb110209252a1ec7e9 Author: Jonathan Cameron Date: Sun Dec 4 18:08:16 2022 +0000 Input: ipaq-micro-keys - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20221204180841.2211588-8-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit ba4de5d944357b8bfba0e987f539530bc75ac6e7 Author: Jonathan Cameron Date: Sun Dec 4 18:08:15 2022 +0000 Input: gpio-keys - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-7-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 64bc273208cf7320389d9f662d8c562233201ed7 Author: Jonathan Cameron Date: Sun Dec 4 18:08:14 2022 +0000 Input: ep39xx-keypad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-6-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit fbfb262e0aa56e3222e6670e2004646157c9d18b Author: Jonathan Cameron Date: Sun Dec 4 18:08:13 2022 +0000 Input: cypress-sf - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-5-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit ca219cf7fd1917940e32d72c6f939b4056355b14 Author: Jonathan Cameron Date: Sun Dec 4 18:08:12 2022 +0000 Input: cros-ec-keyb - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20221204180841.2211588-4-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 32a97d3155a29e1fcd4ea5836c41ca38369e6dc8 Author: Jonathan Cameron Date: Sun Dec 4 18:08:11 2022 +0000 Input: adp5589-keys - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-3-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit f3183157cf8996a604006a24b4166f6505981844 Author: Jonathan Cameron Date: Sun Dec 4 18:08:10 2022 +0000 Input: pxspad - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against used function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20221204180841.2211588-2-jic23@kernel.org Signed-off-by: Dmitry Torokhov commit 93b8c91e4cdb520b67ffc4513a7d6232f1037d9b Merge: 3880e0df2e149 5d4bf8607be16 Author: Arnd Bergmann Date: Wed Dec 7 22:10:05 2022 +0100 Merge tag 'qcom-arm64-defconfig-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/defconfig More Qualcomm ARM64 defconfig updates for 6.2 This enables Globalc Clock Controller (GCC) and TLMM pinctrl for SM6115 and SM4250. * tag 'qcom-arm64-defconfig-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable Qualcomm SM6115 / SM4250 GCC and Pinctrl Link: https://lore.kernel.org/r/20221207154339.3234068-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 9379885d07c466a9207e88c0fd0c8b3541536fe3 Merge: 66310b5a0fc1c f33ca7ec5e5e3 Author: Arnd Bergmann Date: Wed Dec 7 22:07:48 2022 +0100 Merge tag 'qcom-drivers-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for 6.2 Socinfo is extended with knowledge about MSM8956, MSM8976, SM6115, SM4250, SM8150, SA8155 and SM8550. Support for RSC v3, as found in SM8550 is added to the RPMH RSC driver. Support for SM8550 and SM4250 ARC regulators are added to the RPM(h) power-domain drivers. SM8550 support is added to the LLCC driver. The AOSS QMP binding is declared compatible for SM8550. BWMON and LLCC now selects REGMAP_MMIO to ensure dependencies are built properly. * tag 'qcom-drivers-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: socinfo: Add SM6115 / SM4250 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for SM6115 / SM4250 and variants soc: qcom: socinfo: Add SM8150 and SA8155 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for SM8150 and SA8155 dt-bindings: soc: qcom: apr: document generic qcom,apr compatible soc: qcom: Select REMAP_MMIO for ICC_BWMON driver soc: qcom: Select REMAP_MMIO for LLCC driver soc: qcom: rpmpd: Add SM4250 support dt-bindings: power: rpmpd: Add SM4250 support dt-bindings: soc: qcom: aoss: Add compatible for SM8550 soc: qcom: llcc: Add configuration data for SM8550 dt-bindings: arm: msm: Add LLCC compatible for SM8550 soc: qcom: llcc: Add v4.1 HW version support soc: qcom: socinfo: Add SM8550 ID soc: qcom: rpmh-rsc: Avoid unnecessary checks on irq-done response soc: qcom: rpmh-rsc: Add support for RSC v3 register offsets soc: qcom: rpmhpd: Add SM8550 power domains dt-bindings: power: rpmpd: Add SM8550 to rpmpd binding soc: qcom: socinfo: Add MSM8956/76 SoC IDs to the soc_id table dt-bindings: arm: qcom,ids: Add SoC IDs for MSM8956 and MSM8976 Link: https://lore.kernel.org/r/20221207154134.3233779-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit da060ab86eb0de7954dafa34aefa9cc58cc4e76c Merge: c24ba5964f040 812e13ddb56aa Author: Arnd Bergmann Date: Wed Dec 7 22:06:03 2022 +0100 Merge tag 'qcom-dts-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm DTS updates for 6.2 This introduces support for the OnePlus One, on MSM8974Pro, and properly marks other Pro devices as compatible thereof. Also on MSM8974, the description of USB devices and their PHYs are cleaned up. On the binding side compatibles for recently added ARM and ARM64 boards are added. * tag 'qcom-dts-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (102 commits) dt-bindings: arm: qcom: Add zombie ARM: dts: qcom: msm8974: Add OnePlus One dt-bindings: arm: qcom: Document oneplus,bacon device ARM: dts: qcom: msm8974: clean up USB nodes arm: dts: qcom: use qcom,msm8974pro for pro devices dt-bindings: arm: qcom: split MSM8974 Pro and MSM8974 ARM: dts: qcom: align LED node names with dtschema dt-bindings: arm: qcom: Document additional sa8540p device dt-bindings: arm: qcom: Add Xperia 5 IV (PDX224) dt-bindings: arm: qcom: Document msm8956 and msm8976 SoC and devices dt-bindings: arm: add xiaomi,sagit board based on msm8998 chip dt-bindings: arm: qcom: add sdm670 and pixel 3a compatible dt-bindings: arm: cpus: add qcom kryo 360 compatible ARM: dts: qcom-msm8960-cdp: align TLMM pin configuration with DT schema ARM: dts: qcom-msm8960: use define for interrupt constants dt-bindings: arm: qcom: Document SM6375 & Xperia 10 IV ARM: dts: qcom-apq8060: align TLMM pin configuration with DT schema ARM: dts: qcom: msm8226: Add MMCC node dt-bindings: arm: qcom: Separate LTE/WIFI SKU for sc7280-evoker dt-bindings: arm: qcom: Document QDU1000/QRU1000 SoCs and boards ... Link: https://lore.kernel.org/r/20221207153201.3233015-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit c24ba5964f040163bb1e9f248a7f7e2171f2c9e1 Merge: c05188c8062d3 51f7be212ae6c Author: Arnd Bergmann Date: Wed Dec 7 21:59:54 2022 +0100 Merge tag 'qcom-arm64-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm ARM64 DT updates for 6.2 This introduce description of MSM8956 and MSM8976 and based on this adds Sony Xperia X and X Compact. It adds the SA8540P QDrive 3 automotive development board and enables PCIe on the same. Add description of the Vision Mezzanine for the RB5 board and the Navigation Mezzanine for the SDM845 RB3. SC8280XP adds L3 and DDR scaling support, resulting in good performance improvement. PCIe and UFS is marked DMA coherent, resolving data corruption issues. Reference clocks for UFS phy and device are corrected, to resolve issues seen in combinations with some bootloaders where it's not sufficient to rely on the bootloader state. RTC description is added to the SA8295P ADP board. For SM6115 GPI, PRNG, tsens, WCN, cpufreq, I2C/SPI and display blocks are added. On SM6375 QUP blocks are described, allowing the addition of touchscreen and remoteprocs for ADSP and CDSP are introduced. Sony Xperia 10 IV adds description of regulators, allowing enabling SD-card support. SM8250 Coresight components are described It introduces support for the Xiaomi Mi 6 on MSM8998 and adds flash LED to the Xiaomi Redmi 2. The SDHCI block on SM8350 is described and enabled on Sony Xperia 5 III. SM8450 sound and Soundwire blocks are described, and enabled on HDK. CPU supply clock is described, to satisfy the DT binding and the opp-framework. Sony Xperia 5 IV support is added, with touchscreen added. Lastly a range of changes to align DT source with their bindings. * tag 'qcom-arm64-for-6.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (98 commits) dt-bindings: iio: adc: qcom,spmi-vadc: fix PM8350 define dt-bindings: iio: adc: qcom,spmi-vadc: extend example arm64: dts: qcom: sc8280xp: fix UFS DMA coherency arm64: dts: qcom: sc7280: Add DT for sc7280-herobrine-zombie arm64: dts: qcom: sm8250-sony-xperia-edo: fix no-mmc property for SDHCI arm64: dts: qcom: sdm845-sony-xperia-tama: fix no-mmc property for SDHCI arm64: dts: qcom: sda660-inforce-ifc6560: fix no-mmc property for SDHCI arm64: dts: qcom: sa8155p-adp: fix no-mmc property for SDHCI arm64: dts: qcom: qrb5165-rb: fix no-mmc property for SDHCI arm64: dts: qcom: sm8450: align MMC node names with dtschema arm64: dts: qcom: sc7180-trogdor: use generic node names arm64: dts: qcom: sm8450-hdk: add sound support arm64: dts: qcom: sm8450: add Soundwire and LPASS arm64: dts: qcom: sm8450: add GPR node arm64: dts: qcom: sa8540p-ride: enable PCIe support arm64: dts: qcom: sm6115: Add smmu fallback to qcom generic compatible arm64: dts: qcom: sm6115: Add WCN node arm64: dts: qcom: sm6115: Add i2c/spi nodes arm64: dts: qcom: sm6115: Add GPI DMA arm64: dts: qcom: sm6115: Add mdss/dpu node ... Link: https://lore.kernel.org/r/20221207152554.3232434-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit c05188c8062d378ca437812a518aa8a72005304b Merge: 7b3e7df92a061 88615cfb31840 Author: Arnd Bergmann Date: Wed Dec 7 21:48:25 2022 +0100 Merge tag 'socfpga_dts_updates_for_v6.2_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA dts updates for v6.2, part 2 - Fix dtschema for LED node - Fix dtschema for i2c-mux * tag 'socfpga_dts_updates_for_v6.2_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: dts: socfpga: Fix pca9548 i2c-mux node name ARM: dts: socfpga: align LED node names with dtschema arm64: dts: altera: align LED node names with dtschema Link: https://lore.kernel.org/r/20221206214006.590562-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 39244cc754829bf707dccd12e2ce37510f5b1f8d Author: Zheyu Ma Date: Fri Jul 29 19:02:16 2022 +0800 i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first. Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller") Signed-off-by: Zheyu Ma Signed-off-by: Wolfram Sang commit 2d47b79d2bd39cc6369eccf94a06568d84c906ae Author: Yang Yingliang Date: Sat Oct 29 17:38:25 2022 +0800 i2c: mux: reg: check return value after calling platform_get_resource() It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. Fixes: b3fdd32799d8 ("i2c: mux: Add register-based mux i2c-mux-reg") Signed-off-by: Yang Yingliang Signed-off-by: Wolfram Sang commit 31720a2b109b3080eb77e97b8f6f50a27b4ae599 Author: Zhang Xiaoxu Date: Tue Oct 18 12:40:07 2022 +0800 orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() When insert and remove the orangefs module, there are memory leaked as below: unreferenced object 0xffff88816b0cc000 (size 2048): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): 6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f [<00000000e5a0085b>] 0xffffffffa02780f9 [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Use the golbal variable as the buffer rather than dynamic allocate to slove the problem. Signed-off-by: Zhang Xiaoxu Signed-off-by: Mike Marshall commit 1f2c0e8a587bcafad85019a2d80f158d8d41a868 Author: Zhang Xiaoxu Date: Tue Oct 18 12:40:06 2022 +0800 orangefs: Fix kmemleak in orangefs_sysfs_init() When insert and remove the orangefs module, there are kobjects memory leaked as below: unreferenced object 0xffff88810f95af00 (size 64): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): a0 83 af 01 81 88 ff ff 08 af 95 0f 81 88 ff ff ................ 08 af 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005a6e4dfe>] orangefs_sysfs_init+0x42/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ae80 (size 64): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff ................ 88 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000001a4841fa>] orangefs_sysfs_init+0xc7/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ae00 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.511s) hex dump (first 32 bytes): 60 87 a1 00 81 88 ff ff 08 ae 95 0f 81 88 ff ff `............... 08 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005915e797>] orangefs_sysfs_init+0x12b/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ad80 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.511s) hex dump (first 32 bytes): 78 90 0f 02 81 88 ff ff 88 ad 95 0f 81 88 ff ff x............... 88 ad 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000007a14eb35>] orangefs_sysfs_init+0x1ac/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ac00 (size 64): comm "insmod", pid 783, jiffies 4294813440 (age 65.531s) hex dump (first 32 bytes): e0 ff 67 02 81 88 ff ff 08 ac 95 0f 81 88 ff ff ..g............. 08 ac 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000001f38adcb>] orangefs_sysfs_init+0x291/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810f95ab80 (size 64): comm "insmod", pid 783, jiffies 4294813441 (age 65.530s) hex dump (first 32 bytes): 50 bf 2f 02 81 88 ff ff 88 ab 95 0f 81 88 ff ff P./............. 88 ab 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000009cc7d95b>] orangefs_sysfs_init+0x2f5/0x3a0 [<00000000722645ca>] 0xffffffffa02780fe [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Should add release function for each kobject_type to free the memory. Signed-off-by: Zhang Xiaoxu Signed-off-by: Mike Marshall commit d23417a5bf3a3afc55de5442eb46e1e60458b0a1 Author: Zhang Xiaoxu Date: Tue Oct 18 12:40:05 2022 +0800 orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() When insert and remove the orangefs module, then debug_help_string will be leaked: unreferenced object 0xffff8881652ba000 (size 4096): comm "insmod", pid 1701, jiffies 4294893639 (age 13218.530s) hex dump (first 32 bytes): 43 6c 69 65 6e 74 20 44 65 62 75 67 20 4b 65 79 Client Debug Key 77 6f 72 64 73 20 61 72 65 20 75 6e 6b 6e 6f 77 words are unknow backtrace: [<0000000004e6f8e3>] kmalloc_trace+0x27/0xa0 [<0000000006f75d85>] orangefs_prepare_debugfs_help_string+0x5e/0x480 [orangefs] [<0000000091270a2a>] _sub_I_65535_1+0x57/0xf70 [crc_itu_t] [<000000004b1ee1a3>] do_one_initcall+0x87/0x2a0 [<000000001d0614ae>] do_init_module+0xdf/0x320 [<00000000efef068c>] load_module+0x2f98/0x3330 [<000000006533b44d>] __do_sys_finit_module+0x113/0x1b0 [<00000000a0da6f99>] do_syscall_64+0x35/0x80 [<000000007790b19b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 When remove the module, should always free debug_help_string. Should always free the allocated buffer when change the free_debug_help_string. Signed-off-by: Zhang Xiaoxu Signed-off-by: Mike Marshall commit ea60a4ad0cf88b411cde6888b8c890935686ecd7 Author: Zhang Xiaoxu Date: Tue Oct 18 12:40:04 2022 +0800 orangefs: Fix sysfs not cleanup when dev init failed When the dev init failed, should cleanup the sysfs, otherwise, the module will never be loaded since can not create duplicate sysfs directory: sysfs: cannot create duplicate filename '/fs/orangefs' CPU: 1 PID: 6549 Comm: insmod Tainted: G W 6.0.0+ #44 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: dump_stack_lvl+0x34/0x44 sysfs_warn_dup.cold+0x17/0x24 sysfs_create_dir_ns+0x16d/0x180 kobject_add_internal+0x156/0x3a0 kobject_init_and_add+0xcf/0x120 orangefs_sysfs_init+0x7e/0x3a0 [orangefs] orangefs_init+0xfe/0x1000 [orangefs] do_one_initcall+0x87/0x2a0 do_init_module+0xdf/0x320 load_module+0x2f98/0x3330 __do_sys_finit_module+0x113/0x1b0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 kobject_add_internal failed for orangefs with -EEXIST, don't try to register things with the same name in the same directory. Fixes: 2f83ace37181 ("orangefs: put register_chrdev immediately before register_filesystem") Signed-off-by: Zhang Xiaoxu Signed-off-by: Mike Marshall commit 610defdccff7b955fe899a825990c2202153a22e Author: Colin Ian King Date: Mon Oct 17 22:49:37 2022 +0100 orangefs: remove redundant assignment to variable buffer_index The variable buffer_index is assigned a value that is never read, it is assigned just before the function returns. The assignment is redundant and can be removed. Cleans up clang scan build warning: fs/orangefs/file.c:276:3: warning: Value stored to 'buffer_index' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Signed-off-by: Mike Marshall commit b3525072835b523b397d459fadd0785d9c24bbd1 Author: Colin Ian King Date: Mon Oct 24 14:29:39 2022 +0100 orangefs: remove variable i Variable i is just being incremented and it's never used anywhere else. The variable and the increment are redundant so remove it. Signed-off-by: Colin Ian King Signed-off-by: Mike Marshall commit 7cb092a0336c5770656c6742e7a7ce3042c8c44e Author: Krzysztof Kozlowski Date: Tue Aug 30 11:36:25 2022 +0300 leds: MAINTAINERS: include dt-bindings headers Include the Devicetree binding headers in LED SUBSYSTEM entry. Signed-off-by: Krzysztof Kozlowski Acked-by: Alexander Dahl Signed-off-by: Pavel Machek commit 6afd8bd5db7c5f734f24a2df8c1093df9f2ec38f Author: Krzysztof Kozlowski Date: Thu Dec 1 14:15:05 2022 +0100 leds: qcom,pm8058-led: Convert to DT schema Convert the Qualcomm PM8058 PMIC LED bindings to DT schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Pavel Machek commit 3f6fb1cfaf30d0d701d877ffacfd88dd6bcc5841 Author: ye xingchen Date: Thu Dec 1 16:11:24 2022 +0800 leds: use sysfs_emit() to instead of scnprintf() Replace the open-code with sysfs_emit() to simplify the code. Signed-off-by: ye xingchen Signed-off-by: Pavel Machek commit 1da681e52853f0abfbfff8c69833d31e538ff9c0 Author: Chancel Liu Date: Mon Nov 28 14:09:50 2022 +0800 ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated DAIs parameters should be cleared if there's no active stream. Before, we implemented it in soc_pcm_hw_free() by detecting stream_active. If the running stream is the last active stream, we're going to clear parameters. However it will cause DAIs parameters never be cleared if there're more than one stream. For example, we have stream1 and stream2 about to stop. stream2 executes soc_pcm_hw_free() before stream1 executes soc_pcm_close(). At the moment, stream2 should clear DAIs parameters. Since stream_active is not yet updated by stream1 in soc_pcm_close(), stream2 will not clear DAIs parameters. In result both stream1 and stream2 don't clear the parameters. This patch moves DAIs parameters cleanup after stream_active is updated. Signed-off-by: Chancel Liu Link: https://lore.kernel.org/r/20221128060950.3540845-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 169a58ad824d896b9e291a27193342616e651b82 Author: Stephen Boyd Date: Tue Dec 6 13:53:18 2022 -0800 module/decompress: Support zstd in-kernel decompression Add support for zstd compressed modules to the in-kernel decompression code. This allows zstd compressed modules to be decompressed by the kernel, similar to the existing support for gzip and xz compressed modules. Cc: Dmitry Torokhov Cc: Piotr Gorski Cc: Nick Terrell Signed-off-by: Stephen Boyd Reviewed-by: Dmitry Torokhov Reviewed-by: Piotr Gorski Signed-off-by: Luis Chamberlain commit 810199f7315604bd969409109f1c96b4ebe772ad Author: Uwe Kleine-König Date: Wed Oct 19 22:28:08 2022 +0200 i2c: xiic: Make sure to disable clock on .remove() If for whatever reasons pm_runtime_resume_and_get() failed, .remove() is exited early, the clock isn't freed and runtime PM state isn't reset. The right thing to do however is to free all resources that don't need HW access after a problem with runtime PM. Also issue a warning in that case and return 0 to suppress a less helpful warning by the driver core. Signed-off-by: Uwe Kleine-König Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit 3256412fc57b6cabbc1cf1317d020e42f6d7aeab Author: Weilong Chen Date: Tue Nov 8 09:58:11 2022 +0800 i2c: hisi: Add support to get clock frequency from clock The clk_rate attribute is not generic device tree bindings for I2C busses described in Documentation/devicetree/bindings/i2c/i2c.txt. It can be managed by clock binding. Support the driver to obtain clock information by clk_rate or clock property. Find clock first, if not, fall back to clk_rate. Signed-off-by: Weilong Chen Acked-by: Yicong Yang Signed-off-by: Wolfram Sang commit 135780f1048b3f956f5b10bb23dec9c2d2c4ef6d Author: Luca Weiss Date: Tue Nov 29 22:29:01 2022 +0100 leds: is31fl319x: Fix setting current limit for is31fl319{0,1,3} The current setting lives in bits 4:2 (as also defined by the mask) but the current limit defines in the driver use bits 2:0 which should be shifted over so they don't get masked out completely (except for 17.5mA which became 10mA). Now checking /sys/kernel/debug/regmap/1-0068/registers shows that the current limit is applied correctly and doesn't take the default b000 = 42mA. Fixes: fa877cf1abb9 ("leds: is31fl319x: Add support for is31fl319{0,1,3} chips") Signed-off-by: Luca Weiss Reviewed-by: Vincent Knecht Signed-off-by: Pavel Machek commit 447242e1292e8aa22e1371110867b9c543bf0373 Author: Lee Jones Date: Tue Dec 6 10:45:10 2022 +0000 MAINTAINERS: Add additional co-maintainer to LEDs Add myself as co-maintainer for the LED subsystem, in support of Pavel during busy times. Suggested-by: Pavel Machek Signed-off-by: Lee Jones Acked-by: Krzysztof Kozlowski Acked-by: Andy Shevchenko Signed-off-by: Pavel Machek commit 8f415307c3ca14081b510ec4ab827df9d920c5ee Merge: c34b7ac650875 19b00e0069a38 Author: Jens Axboe Date: Wed Dec 7 12:39:37 2022 -0700 Merge tag 'nvme-6.2-2022-12-07' of git://git.infradead.org/nvme into for-6.2/block Pull NVMe updates from Christoph: "nvme updates for Linux 6.2 - fix and cleanup nvme-fc req allocation (Chaitanya Kulkarni) - use the common tagset helpers in nvme-pci driver (Christoph Hellwig) - cleanup the nvme-pci removal path (Christoph Hellwig) - use kstrtobool() instead of strtobool (Christophe JAILLET) - allow unprivileged passthrough of Identify Controller (Joel Granados) - support io stats on the mpath device (Sagi Grimberg) - minor nvmet cleanup (Sagi Grimberg)" * tag 'nvme-6.2-2022-12-07' of git://git.infradead.org/nvme: (22 commits) nvmet: don't open-code NVME_NS_ATTR_RO enumeration nvme-pci: use the tagset alloc/free helpers nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers nvme: consolidate setting the tagset flags nvme: pass nr_maps explicitly to nvme_alloc_io_tag_set nvme-pci: split out a nvme_pci_ctrl_is_dead helper nvme-pci: return early on ctrl state mismatch in nvme_reset_work nvme-pci: rename nvme_disable_io_queues nvme-pci: cleanup nvme_suspend_queue nvme-pci: remove nvme_pci_disable nvme-pci: remove nvme_disable_admin_queue nvme: merge nvme_shutdown_ctrl into nvme_disable_ctrl nvme: use nvme_wait_ready in nvme_shutdown_ctrl nvme-apple: fix controller shutdown in apple_nvme_disable nvme-fc: move common code into helper nvme-fc: avoid null pointer dereference nvme: allow unprivileged passthrough of Identify Controller nvme-multipath: support io stats on the mpath device nvme: introduce nvme_start_request ... commit a37dac5c5dcfe0f1fd58513c16cdbc280a47f628 Author: Ard Biesheuvel Date: Mon Dec 5 09:10:17 2022 +0100 arm64: efi: Limit allocations to 48-bit addressable physical region The UEFI spec does not mention or reason about the configured size of the virtual address space at all, but it does mention that all memory should be identity mapped using a page size of 4 KiB. This means that a LPA2 capable system that has any system memory outside of the 48-bit addressable physical range and follows the spec to the letter may serve page allocation requests from regions of memory that the kernel cannot access unless it was built with LPA2 support and enables it at runtime. So let's ensure that all page allocations are limited to the 48-bit range. Signed-off-by: Ard Biesheuvel commit 11c7f9e3131ad14b27a957496088fa488b153a48 Author: Maria Yu Date: Tue Dec 6 09:59:57 2022 +0800 remoteproc: core: Do pm_relax when in RPROC_OFFLINE state Make sure that pm_relax() happens even when the remoteproc is stopped before the crash handler work is scheduled. Signed-off-by: Maria Yu Cc: stable Fixes: a781e5aa5911 ("remoteproc: core: Prevent system suspend during remoteproc recovery") Link: https://lore.kernel.org/r/20221206015957.2616-2-quic_aiquny@quicinc.com Signed-off-by: Mathieu Poirier commit d9f26ae731259c8fb2d62a742c64e454996944a8 Merge: 29636a5ce87be 76dcd734eca23 Author: Ard Biesheuvel Date: Mon Dec 5 09:32:11 2022 +0100 Merge tag 'v6.1-rc8' into efi/next Linux 6.1-rc8 commit 81ed7d9de18768fe0cb3d74a7a163a8c082e1346 Author: Jiapeng Chong Date: Mon Dec 5 15:35:07 2022 +0800 ASoC: codecs: wcd-clsh: Remove the unused function The function wcd_clsh_set_buck_mode() is defined in the wcd-clsh-v2.c file, but not called elsewhere, so remove this unused function. sound/soc/codecs/wcd-clsh-v2.c:133:20: warning: unused function 'wcd_clsh_enable_status'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3348 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20221205073507.36071-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Mark Brown commit 122d851b07116b30fbee99281d907c33a43f57c9 Merge: 4f143eca51553 47d2b66fec133 Author: Mark Brown Date: Wed Dec 7 17:24:53 2022 +0000 ASoC: Intel: boards: updates for SOF boards Merge series from Pierre-Louis Bossart : One new JasperLake configuration, core refactoring between RT1316 and RT1318 and a minor uninitialized variable corner case. commit 4f143eca515534f08915caba40517b665a622f90 Merge: 38eef3be38ab8 451d85c46cf71 Author: Mark Brown Date: Wed Dec 7 17:24:46 2022 +0000 ASoC: Intel: Skylake: Topology and shutdown fixes Merge series from Cezary Rojewski : Even though skylake-driver is going to be replaced by the avs-driver, the goal is to keep it functional on all the configurations it supports until its EOL. When comparing chrome trees against upstream skylake-driver, couple fixes pop up that are not part of upstream repository. These fixes are backed up by real bugs (issue trackers), address real problems. There is no reason for them to stay in the internal tree. Patches 1-4 combined together address issue where the driver updates the presumably static audio format descriptions coming from the topology files through its "fixup" functions. As long as given audio format is used by a single path, nothing collides and any updates are harmless. However, when multiple paths e.g.: DMIC and HDMI1 utilize the same audio format descriptor, any updates caused by the opening of the first path, may cause the second to fail. The 5th change from the set fixes driver hang sporadically occurring during shutdown procedure. Once HDAudio links are powered down along with the AudioDSP, the hang stops reproducing. The last change helps survive in environments with limited/fragmented memory. While the BDL is small already, other buffers can be allocated using scatter-gather. This basically aligns the code with what the avs-driver does. commit dbfa44782787dc90460bae8b500708ec83e0f611 Author: Rafael J. Wysocki Date: Mon Dec 5 19:54:59 2022 +0100 PM: runtime: Adjust white space in the core code Some inconsistent usage of white space in the PM-runtime core code causes that code to be somewhat harder to read that it would have been otherwise, so adjust the white space in there to be more consistent with the rest of the code. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit 87386ee83dc2b241eab69239f9cc82fa7fb4171c Author: Jay Lu Date: Tue Dec 6 14:52:33 2022 -0600 ACPI: APEI: EINJ: Refactor available_error_type_show() Move error type descriptions into an array and loop over error types to improve readability and maintainability. Replace seq_printf() with seq_puts() as recommended by checkpatch.pl. Signed-off-by: Jay Lu Co-developed-by: Ben Cheatham Signed-off-by: Ben Cheatham Reviewed-by: Tony Luck Signed-off-by: Rafael J. Wysocki commit 37ea9693869627df5b15cbd4d67237e17f806be4 Author: Jay Lu Date: Tue Dec 6 14:52:32 2022 -0600 ACPI: APEI: EINJ: Fix formatting errors Checkpatch reveals warnings and an error due to missing lines and incorrect indentations. Add the missing lines after declarations and fix the suspect indentations. Signed-off-by: Jay Lu Signed-off-by: Ben Cheatham Reviewed-by: Tony Luck Signed-off-by: Rafael J. Wysocki commit f1a70bac90cafd1b20a747b6dcc49d3a79050626 Author: Rafael J. Wysocki Date: Mon Dec 5 20:08:00 2022 +0100 ACPI: processor: perflib: Adjust acpi_processor_notify_smm() return value Avoid returning a confusing error code from acpi_processor_notify_smm() if it is called for the second time in the case when SMM notification regarding P-state control is not supported. Signed-off-by: Rafael J. Wysocki commit be5c8a046caaa295b6151b7a6653070ff8119ac2 Author: Rafael J. Wysocki Date: Mon Dec 5 20:07:08 2022 +0100 ACPI: processor: perflib: Rearrange acpi_processor_notify_smm() Rearrange the code in acpi_processor_notify_smm() to consolidate error handling in it and improve the comments in there while at it. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit 5be583c695ed4d94211cc28282a42092b137f988 Author: Rafael J. Wysocki Date: Mon Dec 5 20:05:55 2022 +0100 ACPI: processor: perflib: Rearrange unregistration routine Rearrange acpi_processor_unregister_performance() to follow a more common error handling pattern and drop a redundant "return" statement from the end of it. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit d8f4ed072817cce79aef90926a4187954e1548fd Author: Rafael J. Wysocki Date: Mon Dec 5 20:04:59 2022 +0100 ACPI: processor: perflib: Drop redundant parentheses Drop some redundant parentheses and rearrange some checks using them in the ACPI processor performance library code for better code clarity. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit 3d9e9a96ca18ec1c9e15b908c1b42d80fd0676ca Author: Rafael J. Wysocki Date: Mon Dec 5 20:03:30 2022 +0100 ACPI: processor: perflib: Adjust white space Some inconsistent usage of white space in the ACPI processor performance library code causes that code to be somewhat harder to read that it would have been otherwise, so adjust the white space in there to address that. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit b697b812d455b7917a0a31db91ae8a0863b35934 Author: Rafael J. Wysocki Date: Mon Dec 5 19:58:25 2022 +0100 ACPI: processor: idle: Drop unnecessary statements and parens Drop a redundant "else", a "return" statement at the end of a void function and redundant parentheses around an unsigent int variable name from the ACPI processor idle driver. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit 57336224da8340fd503e1cc325cc9e0875ccc9a6 Author: Rafael J. Wysocki Date: Mon Dec 5 19:56:14 2022 +0100 ACPI: thermal: Adjust critical.flags.valid check It is not necessary to compare critical.flags.valid to 1 in acpi_thermal_trips_update() and doing so is also inconsistent with other similar checks in that code, so simply check if the flag is not 0 instead. No expected functional impact. Signed-off-by: Rafael J. Wysocki commit 3178804c64ef7c8c87a53cd5bba0b2942dd64fec Merge: b2ea130c2541a a14e84dbce2ee Author: Mauro Carvalho Chehab Date: Tue Dec 6 07:28:26 2022 +0000 Merge tag 'br-v6.2i' of git://linuxtv.org/hverkuil/media_tree into media_stage Tag branch Signed-off-by: Mauro Carvalho Chehab * tag 'br-v6.2i' of git://linuxtv.org/hverkuil/media_tree: (31 commits) media: s5c73m3: Switch to GPIO descriptors media: i2c: s5k5baf: switch to using gpiod API media: i2c: s5k6a3: switch to using gpiod API media: imx: remove code for non-existing config IMX_GPT_ICAP media: si470x: Fix use-after-free in si470x_int_in_callback() media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies media: coda: Add check for kmalloc media: coda: Add check for dcoda_iram_alloc dt-bindings: media: s5c73m3: Fix reset-gpio descriptor media: dt-bindings: allwinner: h6-vpu-g2: Add IOMMU reference property media: s5k4ecgx: Delete driver media: s5k4ecgx: Switch to GPIO descriptors media: Switch to use dev_err_probe() helper headers: Remove some left-over license text in include/uapi/linux/v4l2-* headers: Remove some left-over license text in include/uapi/linux/dvb/ media: usb: pwc-uncompress: Use flex array destination for memcpy() media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 media: imx: Use get_mbus_config instead of parsing upstream DT endpoints ... commit a14e84dbce2eeebde5e9aacd8bb49e85c1e1a067 Author: Linus Walleij Date: Tue Nov 8 11:06:04 2022 +0100 media: s5c73m3: Switch to GPIO descriptors The driver has an option to pass in GPIO numbers from platform data but this is not used in the kernel so delete this. Get GPIO descriptors using the standard API and simplify the code, gpiolib will handle any inversions. Cc: Sylwester Nawrocki Cc: Andrzej Hajda Cc: Alim Akhtar Reviewed-by: Andrzej Hajda Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij Signed-off-by: Hans Verkuil commit 4220dd61e7e9b979fd96695ab7c98ea7a5f64c3f Author: Dmitry Torokhov Date: Tue Nov 15 14:11:43 2022 -0800 media: i2c: s5k5baf: switch to using gpiod API This patch switches the driver away from legacy gpio/of_gpio API to gpiod API, and removes use of of_get_named_gpio_flags() which I want to make private to gpiolib. Reviewed-by: Linus Walleij Signed-off-by: Dmitry Torokhov Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil commit 87b5aeeb49980fb0c10a4d1b6590066e96f4801b Author: Dmitry Torokhov Date: Tue Nov 15 14:11:42 2022 -0800 media: i2c: s5k6a3: switch to using gpiod API This patch switches the driver away from legacy gpio/of_gpio API to gpiod API, and removes one of the last uses of of_get_gpio_flags(). Signed-off-by: Dmitry Torokhov Reviewed-by: Linus Walleij Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil commit 932d87c6eaa18469fbb51dd67a8ff0f09ea2c0d8 Author: Lukas Bulwahn Date: Wed Nov 23 08:52:16 2022 +0100 media: imx: remove code for non-existing config IMX_GPT_ICAP There never was a config IMX_GPT_ICAP in the repository. So remove the code conditional on this config and simplify the callers that just called empty functions. Signed-off-by: Lukas Bulwahn Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil commit 7d21e0b1b41b21d628bf2afce777727bd4479aa5 Author: Shigeru Yoshida Date: Wed Nov 23 03:51:59 2022 +0900 media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object. Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1] Signed-off-by: Shigeru Yoshida Signed-off-by: Hans Verkuil commit faaf901727eddcfbe889fe172ec9cdb5e63c8236 Author: Geert Uytterhoeven Date: Mon Nov 21 16:58:33 2022 +0100 media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies By moving support for the USB Syntek DC1125 Camera to staging, the dependencies on MEDIA_USB_SUPPORT and MEDIA_CAMERA_SUPPORT were lost. Fixes: 56280c64ecac ("media: stkwebcam: deprecate driver, move to staging") Signed-off-by: Geert Uytterhoeven Reviewed-by: Ricardo Ribalda Signed-off-by: Hans Verkuil commit 6e5e5defdb8b0186312c2f855ace175aee6daf9b Author: Jiasheng Jiang Date: Thu Nov 17 15:02:36 2022 +0800 media: coda: Add check for kmalloc As the kmalloc may return NULL pointer, it should be better to check the return value in order to avoid NULL poineter dereference, same as the others. Fixes: cb1d3a336371 ("[media] coda: add CODA7541 JPEG support") Signed-off-by: Jiasheng Jiang Signed-off-by: Hans Verkuil commit 6b8082238fb8bb20f67e46388123e67a5bbc558d Author: Jiasheng Jiang Date: Thu Nov 17 14:56:52 2022 +0800 media: coda: Add check for dcoda_iram_alloc As the coda_iram_alloc may return NULL pointer, it should be better to check the return value in order to avoid NULL poineter dereference, same as the others. Fixes: b313bcc9a467 ("[media] coda: simplify IRAM setup") Signed-off-by: Jiasheng Jiang Signed-off-by: Hans Verkuil commit a8a0bc8106a10681069b887e6f15304ce77b7ea3 Author: Maíra Canal Date: Wed Nov 16 16:43:07 2022 -0300 dt-bindings: media: s5c73m3: Fix reset-gpio descriptor The reset-gpios is described as xshutdown-gpios on the required properties, as it is on the driver. Despite that, the device tree example set the property 'reset-gpios' instead of the property 'xshutdown-gpios'. Therefore, this patch updates the example to match the property specified on the driver. Acked-by: Krzysztof Kozlowski Signed-off-by: Maíra Canal Signed-off-by: Hans Verkuil commit e895d62188d2cc916e342c603fba87e892b881b0 Author: Chen-Yu Tsai Date: Tue Nov 15 17:06:43 2022 +0800 media: dt-bindings: allwinner: h6-vpu-g2: Add IOMMU reference property The Hantro G2 video decoder block sits behind an IOMMU. The device tree binding needs a property to reference it. Without a reference for the implementation to properly configure the IOMMU, it will fault and cause the video decoder to fail. Add an "iommus" property for referring to the IOMMU port. The master ID in the example is taken from the IOMMU fault error message on Linux, and the number seems to match the order in the user manual's IOMMU diagram. Fixes: fd6be12716c4 ("media: dt-bindings: allwinner: document H6 Hantro G2 binding") Signed-off-by: Chen-Yu Tsai Acked-by: Krzysztof Kozlowski Acked-by: Jernej Skrabec Signed-off-by: Hans Verkuil commit 5e2ac9aac774f9d7ec405c7bbb48656204a6b8a7 Author: Linus Walleij Date: Tue Nov 8 20:53:28 2022 +0100 media: s5k4ecgx: Delete driver This driver was until the previous patch unused in the kernel and depended on platform data that no board was defining. As no users can be proven to exist, delete the driver. Cc: Sylwester Nawrocki Cc: Andrzej Hajda Cc: Krzysztof Kozlowski Cc: Alim Akhtar Cc: Dmitry Torokhov Suggested-by: Dmitry Torokhov Signed-off-by: Linus Walleij Reviewed-by: Dmitry Torokhov Signed-off-by: Hans Verkuil commit c3093bdc6bc37f979b6966cb48225657405d84ec Author: Linus Walleij Date: Tue Nov 8 20:53:27 2022 +0100 media: s5k4ecgx: Switch to GPIO descriptors The driver has an option to pass in GPIO numbers from platform data but this is not used in the kernel so delete this and the whole platform data mechanism. Get GPIO descriptors using the standard API and simplify the code, gpiolib will handle any inversions. Cc: Sylwester Nawrocki Cc: Andrzej Hajda Cc: Krzysztof Kozlowski Cc: Alim Akhtar Cc: Dmitry Torokhov Reviewed-by: Andrzej Hajda Reviewed-by: Tommaso Merciai Signed-off-by: Linus Walleij Reviewed-by: Dmitry Torokhov Signed-off-by: Hans Verkuil commit 6cb7d1b3ff83e98e852db9739892c4643a31804b Author: Yang Yingliang Date: Mon Sep 19 23:58:43 2022 +0800 media: Switch to use dev_err_probe() helper In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER. Reviewed-by: Sean Young Reviewed-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: Yang Yingliang Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 96c1212a61e089fcd10abe88f6a8f069f2ac1354 Author: Christophe JAILLET Date: Sun Sep 11 17:13:14 2022 +0200 headers: Remove some left-over license text in include/uapi/linux/v4l2-* Remove some left-over from commit e2be04c7f995 ("License cleanup: add SPDX license identifier to uapi header files with a license") When the SPDX-License-Identifier tag has been added, the corresponding license text has not been removed. Remove it now. Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil commit 8478afa837c48f10dddb2e06714ffc667843781d Author: Christophe JAILLET Date: Sun Sep 11 14:10:59 2022 +0200 headers: Remove some left-over license text in include/uapi/linux/dvb/ Remove some left-over from commit e2be04c7f995 ("License cleanup: add SPDX license identifier to uapi header files with a license") When the SPDX-License-Identifier tag has been added, the corresponding license text has not been removed. Remove it now. Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil commit 389b6a226188c13ec3d5d8b3522aabd68aab2694 Author: Gustavo A. R. Silva Date: Wed Sep 7 19:55:44 2022 +0100 media: usb: pwc-uncompress: Use flex array destination for memcpy() In preparation for FORTIFY_SOURCE performing run-time destination buffer bounds checking for memcpy(), specify the destination output buffer explicitly, instead of asking memcpy() to write past the end of what looked like a fixed-size object. Notice that raw_frame is a pointer to a structure that contains flexible-array member rawframe[]: drivers/media/usb/pwc/pwc.h: 190 struct pwc_raw_frame { 191 __le16 type; /* type of the webcam */ 192 __le16 vbandlength; /* Size of 4 lines compressed (used by the 193 decompressor) */ 194 __u8 cmd[4]; /* the four byte of the command (in case of 195 nala, only the first 3 bytes is filled) */ 196 __u8 rawframe[]; /* frame_size = H / 4 * vbandlength */ 197 } __packed; Link: https://github.com/KSPP/linux/issues/200 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Hans Verkuil commit d8a46bc4e1e0446459daa77c4ce14218d32dacf9 Author: Smitha T Murthy Date: Wed Sep 7 16:02:27 2022 +0530 media: s5p-mfc: Fix to handle reference queue during finishing On receiving last buffer driver puts MFC to MFCINST_FINISHING state which in turn skips transferring of frame from SRC to REF queue. This causes driver to stop MFC encoding and last frame is lost. This patch guarantees safe handling of frames during MFCINST_FINISHING and correct clearing of workbit to avoid early stopping of encoding. Fixes: af9357467810 ("[media] MFC: Add MFC 5.1 V4L2 driver") Cc: stable@vger.kernel.org Cc: linux-fsd@tesla.com Signed-off-by: Smitha T Murthy Signed-off-by: Hans Verkuil commit d3f3c2fe54e30b0636496d842ffbb5ad3a547f9b Author: Smitha T Murthy Date: Wed Sep 7 16:02:26 2022 +0530 media: s5p-mfc: Clear workbit to handle error condition During error on CLOSE_INSTANCE command, ctx_work_bits was not getting cleared. During consequent mfc execution NULL pointer dereferencing of this context led to kernel panic. This patch fixes this issue by making sure to clear ctx_work_bits always. Fixes: 818cd91ab8c6 ("[media] s5p-mfc: Extract open/close MFC instance commands") Cc: stable@vger.kernel.org Cc: linux-fsd@tesla.com Signed-off-by: Smitha T Murthy Signed-off-by: Hans Verkuil commit 06710cd5d2436135046898d7e4b9408c8bb99446 Author: Smitha T Murthy Date: Wed Sep 7 16:02:25 2022 +0530 media: s5p-mfc: Fix in register read and write for H264 Few of the H264 encoder registers written were not getting reflected since the read values were not stored and getting overwritten. Fixes: 6a9c6f681257 ("[media] s5p-mfc: Add variants to access mfc registers") Cc: stable@vger.kernel.org Cc: linux-fsd@tesla.com Signed-off-by: Smitha T Murthy Signed-off-by: Hans Verkuil commit 7318abface486d6a6389731810f5b60650daedb5 Author: Philipp Zabel Date: Wed Aug 24 12:32:10 2022 +0200 media: imx: Use get_mbus_config instead of parsing upstream DT endpoints Stop parsing upstream neighbors' device-tree endpoints to retrieve the media bus configuration. Instead use the get_mbus_config op and throw an error if the upstream subdevice does not implement it. Also drop the corresponding TODO entry and the now unused imx_media_get_pad_fwnode() function. Signed-off-by: Philipp Zabel Reviewed-by: Jacopo Mondi Tested-by: Marco Felsch Signed-off-by: Hans Verkuil commit e65faec54192984e157eb8e49ea29d4eccacf185 Author: Christophe JAILLET Date: Sat Aug 6 17:54:59 2022 +0200 media: ths7303: Fix the include guard Everything is about THS7303, so let the include guard reflect it as well to avoid potential future conflict. Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil commit 63ff05a1ad242a5a0f897921c87b70d601bda59c Author: Liang He Date: Tue Jul 19 22:10:23 2022 +0800 media: c8sectpfe: Add of_node_put() when breaking out of loop In configure_channels(), we should call of_node_put() when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount. Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support") Signed-off-by: Liang He Signed-off-by: Hans Verkuil commit 7655c342dbc47a0781a793d91600ededff3b3a51 Author: Lecopzer Chen Date: Tue May 17 01:15:15 2022 +0800 media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y A case that CONFIG_MEDIA_SUPPORT is y but we need DVB_CORE=m, and this doesn't work since DVB_CORE is default MEDIA_DIGITAL_TV_SUPPORT and then follows MEDIA_SUPPORT. Signed-off-by: Hans Verkuil Signed-off-by: Lecopzer Chen commit d59014e76a4168547379bc5e167f2cd8a44d3679 Author: Colin Ian King Date: Mon May 16 10:20:53 2022 +0100 media: i2c: isl7998x: make const array isl7998x_video_in_chan_map static Don't populate the read-only array isl7998x_video_in_chan_map on the stack but instead make it static. Also makes the object code a little smaller. Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil commit 408a2a050f315e9ea146f1619fc5494cae4949b5 Author: Moses Christopher Bollavarapu Date: Fri Jan 21 11:51:11 2022 +0100 drivers: staging: media: omap4iss: Use BIT macro instead of left shifting There is a BIT(nr) macro available in Linux Kernel, which does the same thing. Example: 1 << 7 is same as BIT(7) Signed-off-by: Moses Christopher Bollavarapu Reviewed-by: Dan Carpenter Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 1069470070808cafa65d400c10e5c4791d0dc0df Author: Michael Riesch Date: Fri Jan 14 11:57:55 2022 +0100 media: v4l2-mediabus: add support for dual edge sampling Some devices support sampling of the parallel data at both edges of the interface pixel clock in order to reduce the pixel clock by two. Add a mediabus flag that represents this feature. Signed-off-by: Michael Riesch Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 55f6f743e9da6cfa68d5c59f4ef40e6e7603d08a Author: Michael Riesch Date: Fri Jan 14 11:57:54 2022 +0100 dt-bindings: media: video-interfaces: add support for dual edge sampling Some devices support sampling of the parallel data at both edges of the interface pixel clock in order to reduce the pixel clock by two. Use the pclk-sample property to reflect this feature in the device tree. Signed-off-by: Michael Riesch Reviewed-by: Jacopo Mondi Acked-by: Rob Herring Signed-off-by: Hans Verkuil commit f0ed939b6ab63f6ed9f9ff454f33997de10d8ae7 Author: Christophe JAILLET Date: Sat Jan 1 22:28:51 2022 +0100 media: pt3: Use dma_set_mask_and_coherent() and simplify code Use dma_set_mask_and_coherent() instead of unrolling it with some dma_set_mask()+dma_set_coherent_mask(). Moreover, as stated in [1], dma_set_mask() with a 64-bit mask will never fail if dev->dma_mask is non-NULL. So, if it fails, the 32 bits case will also fail for the same reason. Simplify code and remove some dead code accordingly. [1]: https://lkml.org/lkml/2021/6/7/398 Signed-off-by: Christophe JAILLET Acked-by: Akihiro Tsukada Signed-off-by: Hans Verkuil commit 6e616668a1958886fb80d1282150c2be6cc51c4f Author: Adam Borowski Date: Fri Sep 16 00:33:18 2022 +0100 media: ipu3-cio2: make the bridge depend on i2c drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’: drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration] 258 | i2c_unregister_device(sensor->vcm_i2c_client); | ^~~~~~~~~~~~~~~~~~~~~ | spi_unregister_device Link: https://lore.kernel.org/linux-media/S230142AbiJTWql/20221020224641Z+958@vger.kernel.org Signed-off-by: Adam Borowski Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 7e837a5c50044fd544c30751ebf575a77470c362 Author: Hans de Goede Date: Wed Nov 23 16:14:47 2022 +0000 media: MAINTAINERS: Add Hans de Goede as staging/atomisp maintainer Add myself as maintainer for the drivers/staging/media/atomisp code. Link: https://lore.kernel.org/linux-media/20221123161447.15834-1-hdegoede@redhat.com Signed-off-by: Hans de Goede Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 6132a490f9c81d621fdb4e8c12f617dc062130a2 Merge: e6d22108621c8 6ed54e1789a29 Author: Thomas Gleixner Date: Wed Dec 7 17:50:44 2022 +0100 Merge tag 'irqchip-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates frim Marc Zyngier: - More APCI fixes and improvements for the LoongArch architecture, adding support for the HTVEC irqchip, suspend-resume, and some PCI INTx workarounds - Initial DT support for LoongArch. I'm not even kidding. - Support for the MTK CIRQv2, a minor deviation from the original version - Error handling fixes for wpcm450, GIC... - BE detection for a FSL controller - Declare the Sifive PLIC as wake-up agnostic - Simplify fishing out the device data for the ST irqchip - Mark some data structures as __initconst in the apple-aic driver - Switch over from strtobool to kstrtobool - COMPILE_TEST fixes commit c34b7ac65087554627f4840f4ecd6f2107a68fd1 Author: Christoph Hellwig Date: Tue Dec 6 15:40:57 2022 +0100 block: remove bio_set_op_attrs This macro is obsolete, so replace the last few uses with open coded bi_opf assignments. Signed-off-by: Christoph Hellwig Acked-by: Coly Li > Reviewed-by: Johannes Thumshirn Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20221206144057.720846-1-hch@lst.de Signed-off-by: Jens Axboe commit f18caf261398a7f2de4fa3f600deb87072fe7b8d Author: Miaoqian Lin Date: Wed Dec 7 15:22:18 2022 +0400 device property: Fix documentation for fwnode_get_next_parent() Use fwnode_handle_put() on the node pointer to release the refcount. Change fwnode_handle_node() to fwnode_handle_put(). Fixes: 233872585de1 ("device property: Add fwnode_get_next_parent()") Reviewed-by: Andy Shevchenko Reviewed-by: Daniel Scally Acked-by: Sakari Ailus Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20221207112219.2652411-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit f66f73421f0a929734bb41dde575e6d7859e548f Author: Pavel Begunkov Date: Wed Dec 7 08:50:01 2022 -0700 io_uring: skip spinlocking for ->task_complete ->task_complete was added to serialised CQE posting by doing it from the task context only (or fallback wq when the task is dead), and now we can use that to avoid taking ->completion_lock while filling CQ entries. The patch skips spinlocking only in two spots, __io_submit_flush_completions() and flushing in io_aux_cqe, it's safer and covers all cases we care about. Extra care is taken to force taking the lock while queueing overflow entries. It fundamentally relies on SINGLE_ISSUER to have only one task posting events. It also need to take into account overflowed CQEs, flushing of which happens in the cq wait path, and so this implementation also needs DEFER_TASKRUN to limit waiters. For the same reason we disable it for SQPOLL, and for IOPOLL as it won't benefit from it in any case. DEFER_TASKRUN, SQPOLL and IOPOLL requirement may be relaxed in the future. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2a8c91fd82cfcdcc1d2e5bac7051fe2c183bda73.1670384893.git.asml.silence@gmail.com [axboe: modify to apply] Signed-off-by: Jens Axboe commit 6d043ee1164ca3305738131f170e560587070fa9 Author: Pavel Begunkov Date: Wed Dec 7 03:53:36 2022 +0000 io_uring: do msg_ring in target task via tw While executing in a context of one io_uring instance msg_ring manipulates another ring. We're trying to keep CQEs posting contained in the context of the ring-owner task, use task_work to send the request to the target ring's task when we're modifying its CQ or trying to install a file. Note, we can't safely use io_uring task_work infra and have to use task_work directly. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4d76c7b28ed5d71b520de4482fbb7f660f21cd80.1670384893.git.asml.silence@gmail.com [axboe: use TWA_SIGNAL_NO_IPI] Signed-off-by: Jens Axboe commit a6365c2da9faf7c7bcb81fbc4b422e9f319c9f0c Author: Johannes Berg Date: Mon Dec 5 10:35:48 2022 +0200 wifi: iwlwifi: fw: use correct IML/ROM status register Different registers should be used, but they code wasn't adjusted for the 'error' register, only for the 'data1'. Fix that. Coverity CID: 1487176 Coverity CID: 1487230 Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.28de1a5b2493.I356c9404623fd5ef793d47481fe37a95be355c6b@changeid commit b2f20cf2899fdce94e01101dee08ddbd2e32ea2f Author: Mukesh Sisodiya Date: Mon Dec 5 10:35:47 2022 +0200 wifi: iwlwifi: dump: Update check for UMAC valid FW address The error dump base address check for UMAC need an update based on current hardware. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.e4b7fc650144.I46103baf400bb4ae69d82738e402a3903b17c030@changeid commit 5933b8620a454894c4fdb7c123ddc6048c67e473 Author: Naftali Goldstein Date: Mon Dec 5 10:35:46 2022 +0200 wifi: iwlwifi: mvm: d3: add TKIP to the GTK iterator This was missed when this function was refactored out of iwl_mvm_wowlan_program_keys. Signed-off-by: Naftali Goldstein Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.746f40250502.Ieef45ffc617726cb47b3a4ec625d513d16082f4b@changeid commit 9ad28ba1c6f054ef801bcd63c5b73792b4b1d9a4 Author: Tom Rix Date: Mon Dec 5 10:35:45 2022 +0200 wifi: iwlwifi: mei: clean up comments SPDX *.h use /* */ style comments Spelling replacements commnunication to communication adsress to address procotol to protocol addtional to additional kown to know negotiaion to negotiation mssage to message Signed-off-by: Tom Rix Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.f1ff5aff270b.Ie4ba3f980a35455ed95e7c0cae854231fccc89e2@changeid commit b201944af11f7b2c860bef5cb562eb7163427724 Author: Miri Korenblit Date: Mon Dec 5 10:35:44 2022 +0200 wifi: iwlwifi: mvm: Don't use deprecated register The CSR_HW_IF_CONFIG_REG register is no longer in use from IWL_DEVICE_FAMILY_AX210 and on. This register uses now for CSR_CTXT_INFO_BOOT_CTRL which has a different meaning and a different format. Currently we're writing to the register according to CSR_HW_IF_CONFIG_REGs format, regardless to the device family. This causes to miss-interpretation of the register value, as it is parsed according to CSR_CTXT_INFO_BOOT_CTRLs format for devices families >= IWL_DEVICE_FAMILY_AX210. Fix this by writing to the register according to the old format only for the relevant hardware. Signed-off-by: Miri Korenblit Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.8e91eb10dc7d.I3882a2452785ef8b455d99af235e4477917bf46d@changeid commit 3a27a1a158bd1811db7f9b82a72303414fa270e1 Author: Mukesh Sisodiya Date: Mon Dec 5 10:35:43 2022 +0200 wifi: iwlwifi: pcie: Add reading and storing of crf and cdb id. Read and store crf and cdb id details to make it available during driver's lifetime Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.888b30780128.Ic8c4c088a75a0d7092d6301ef3760a118a06d819@changeid commit 6d7cb4a63db8716d23036323ff1a639cbade52ac Author: Jakob Koschel Date: Mon Dec 5 10:35:42 2022 +0200 wifi: iwlwifi: mvm: replace usage of found with dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. While at it, stop using the unnecessary _safe() variant. [1] https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel [change to not use _safe variant] Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.e4882dc35543.I32b2b945ba234de72ee119fc20f5b8be02b6a3f2@changeid commit 838a0c7d144111df7f1fd426d099ab68e81bb24c Author: Mukesh Sisodiya Date: Mon Dec 5 10:35:41 2022 +0200 wifi: iwlwifi: dump: Update check for valid FW address The error dump base address need an update based on current hardware. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.a521691632e9.Ic15fa65107c0d4d0b555a1fb3a2a20ab2725b683@changeid commit 1174e8fcbba89593f67240c3395554b3812a4981 Author: Mordechay Goodstein Date: Mon Dec 5 10:35:40 2022 +0200 wifi: iwlwifi: mvm: don't access packet before checking len Currently in sniffer mode we access pkt fields before checking that the frame has the length to access it. Fix this by moving the check to before the access. Signed-off-by: Mordechay Goodstein Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.934da230c698.Ib56f11bbc8978e15d38394336a929cb4996ba39e@changeid commit c5a976cf6a756efeee190f05c875b732bd10b4df Author: Johannes Berg Date: Mon Dec 5 10:35:39 2022 +0200 wifi: iwlwifi: modify new queue allocation command Follow a new firmware API changes and update the queue allocation command in the remove/modify cases to take the station mask and TID instead of the queue ID. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.2925b38d3929.Ib8467711590c1969817c3321509eb131f4230e15@changeid commit 8ca67e3d8bfe8d1cf9e68328c585562ab5e63309 Author: Johannes Berg Date: Mon Dec 5 10:35:38 2022 +0200 wifi: iwlwifi: nvm-parse: enable WiFi7 for Fm radio for now We're still working out how the hardware/firmware (will) advertise support for this - for now, assume that Fm radio supports it. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20221205102808.f73face1a674.Ic62ee5c61c0ef2a5b5e9f89782b7bc82b0caa408@changeid commit 5b481acab4ce017fda8166fa9428511da41109e5 Author: Benjamin Tissoires Date: Tue Dec 6 15:59:32 2022 +0100 bpf: do not rely on ALLOW_ERROR_INJECTION for fmod_ret The current way of expressing that a non-bpf kernel component is willing to accept that bpf programs can be attached to it and that they can change the return value is to abuse ALLOW_ERROR_INJECTION. This is debated in the link below, and the result is that it is not a reasonable thing to do. Reuse the kfunc declaration structure to also tag the kernel functions we want to be fmodret. This way we can control from any subsystem which functions are being modified by bpf without touching the verifier. Link: https://lore.kernel.org/all/20221121104403.1545f9b5@gandalf.local.home/ Suggested-by: Alexei Starovoitov Signed-off-by: Benjamin Tissoires Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20221206145936.922196-2-benjamin.tissoires@redhat.com commit 6d4671b534f6c084e92ef167a52dc47e55f636c4 Author: Pali Rohár Date: Tue Sep 27 16:19:17 2022 +0200 PCI: pciehp: Enable Command Completed Interrupt only if supported The No Command Completed Support bit in the Slot Capabilities register indicates whether Command Completed Interrupt Enable is unsupported. We already check whether No Command Completed Support bit is set in pcie_wait_cmd(), and do not wait in this case. Don't enable this Command Completed Interrupt at all if NCCS is set, so that when users dump configuration space from userspace, the dump does not confuse them by saying that Command Completed Interrupt is not supported, but it is enabled. Link: https://lore.kernel.org/r/20220927141926.8895-2-kabel@kernel.org Signed-off-by: Pali Rohár Signed-off-by: Marek Behún Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner commit 7ccb966779645636679a723588b7bae4f0a8d7d5 Author: Dmitry Torokhov Date: Mon Nov 14 10:42:25 2022 -0800 PCI: aardvark: Switch to using devm_gpiod_get_optional() Switch the driver to the generic version of gpiod API (and away from OF-specific variant), so that we can stop exporting devm_gpiod_get_from_of_node(). Link: https://lore.kernel.org/r/Y3KMEZFv6dpxA+Gv@google.com Signed-off-by: Dmitry Torokhov Signed-off-by: Bjorn Helgaas Reviewed-by: Linus Walleij Acked-by: Pali Rohár commit 8330e9e8269bb76dd502e84efb5f351016512cf8 Author: bayi cheng Date: Wed Dec 7 13:54:35 2022 +0800 spi: spi-mtk-nor: Add recovery mechanism for dma read timeout The state machine of MTK spi nor controller may be disturbed by some glitch signals from the relevant BUS during dma read, Although the possibility of causing the dma read to fail is next to nothing, However, if error-handling is not implemented, which makes the feature somewhat risky. Add an error-handling mechanism here, reset the state machine and re-read the data when an error occurs. Signed-off-by: bayi cheng Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221207055435.30557-1-bayi.cheng@mediatek.com Signed-off-by: Mark Brown commit bc9ab1b7a6c687370b5d4edf34064bf04af8d369 Author: Han Xu Date: Tue Dec 6 16:54:10 2022 -0600 spi: spi-fsl-lpspi: add num-cs binding for lpspi Add num-cs property to support multiple cs for lpspi. This property is optional. Signed-off-by: Han Xu Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221206225410.604482-2-han.xu@nxp.com Signed-off-by: Mark Brown commit 5f947746f0089529c85654704643f158b420ff92 Author: Han Xu Date: Tue Dec 6 16:54:09 2022 -0600 spi: spi-fsl-lpspi: support multiple cs for lpspi support to get chip select number from DT file. Signed-off-by: Han Xu Link: https://lore.kernel.org/r/20221206225410.604482-1-han.xu@nxp.com Signed-off-by: Mark Brown commit cf34ac6aa2b12fb0c3aacfdcae8acd7904b949ec Author: Yuan Can Date: Sat Dec 3 06:21:09 2022 +0000 regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() The reg_node needs to be released through of_node_put() in the error handling path when of_irq_get_byname() failed. Fixes: 390af53e0411 ("regulator: qcom-labibb: Implement short-circuit and over-current IRQs") Signed-off-by: Yuan Can Link: https://lore.kernel.org/r/20221203062109.115043-1-yuancan@huawei.com Signed-off-by: Mark Brown commit 38eef3be38ab895959c442702864212cc3beb96c Author: Wang Yufen Date: Mon Dec 5 17:56:28 2022 +0800 ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the error path in mt8183_mt6358_ts3a227_max98357_dev_probe(). Fixes: 11c0269017b2 ("ASoC: Mediatek: MT8183: Add machine driver with TS3A227") Signed-off-by: Wang Yufen Link: https://lore.kernel.org/r/1670234188-23596-1-git-send-email-wangyufen@huawei.com Signed-off-by: Mark Brown commit a39bc7cf8e284653fb6fd9d897f269f4ac80cf52 Author: ye xingchen Date: Mon Dec 5 19:43:47 2022 +0800 ASoC: imx-audmux: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212051943476482106@zte.com.cn Signed-off-by: Mark Brown commit ef0a098efb36660326c133af9b5a04a96a00e3ca Author: Wang Jingjin Date: Mon Dec 5 11:28:02 2022 +0800 ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() The clk_disable_unprepare() should be called in the error handling of rockchip_pdm_runtime_resume(). Fixes: fc05a5b22253 ("ASoC: rockchip: add support for pdm controller") Signed-off-by: Wang Jingjin Link: https://lore.kernel.org/r/20221205032802.2422983-1-wangjingjin1@huawei.com Signed-off-by: Mark Brown commit 8ab2d12c726f0fde0692fa5d81d8019b3dcd62d0 Author: Wang Yufen Date: Mon Dec 5 16:15:27 2022 +0800 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() The of_get_next_child() returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, of_node_put() needs be called for cpu_ep. Fixes: fce9b90c1ab7 ("ASoC: audio-graph-card: cleanup DAI link loop method - step2") Signed-off-by: Wang Yufen Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/1670228127-13835-1-git-send-email-wangyufen@huawei.com Signed-off-by: Mark Brown commit 3327d721114c109ba0575f86f8fda3b525404054 Author: Wang Yufen Date: Mon Dec 5 18:04:24 2022 +0800 ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the error path in mt8173_rt5650_rt5514_dev_probe(). Fixes: 0d1d7a664288 ("ASoC: mediatek: Refine mt8173 driver and change config option") Signed-off-by: Wang Yufen Link: https://lore.kernel.org/r/1670234664-24246-1-git-send-email-wangyufen@huawei.com Signed-off-by: Mark Brown commit 47d2b66fec133cb27da3a551334686e465d19469 Author: Bard Liao Date: Tue Dec 6 15:25:07 2022 -0600 ASoC: Intel: sof_realtek_common: set ret = 0 as initial value 'ret' will not be initialized if dai_fmt is not DSP_A or DSP_B. Reviewed-by: Ranjani Sridharan Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221206212507.359993-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 5c10da436ebd93f9bfa244ea933773d14b566499 Author: Gongjun Song Date: Tue Dec 6 15:25:06 2022 -0600 ASoC: Intel: sof_sdw: use common helpers for all Realtek amps sof_sdw_rt1308.c/sof_sdw_rt1316.c/sof_sdw_rt1318.c handle amp in basically the same way, optimized and merged into one file. Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Signed-off-by: Gongjun Song Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221206212507.359993-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit c0660fce5e0672b9fcffaae02184d58c8ed2aec1 Author: Brent Lu Date: Tue Dec 6 15:25:05 2022 -0600 ASoC: Intel: sof_rt5682: add jsl_rt5682 board config This configuration supports JSL boards which implement ALC5682I-VD/VS on SSP0 port. Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Signed-off-by: Brent Lu Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20221206212507.359993-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 451d85c46cf719a09a052510d4d4cd920103163a Author: Cezary Rojewski Date: Mon Dec 5 09:53:30 2022 +0100 ASoC: Intel: Skylake: Use SG allocation for SKL-based firmware load Resign from ->alloc_dma_buf() and use snd_dma_alloc_pages() directly. For data i.e.: base firmware binary transfer, make use of SG allocation to better adapt to memory-limited environment. For BDL descriptor, given its small size this is not required. Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-7-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 171107237246d66bce04f3769d33648f896b4ce3 Author: Cezary Rojewski Date: Mon Dec 5 09:53:29 2022 +0100 ASoC: Intel: Skylake: Fix driver hang during shutdown AudioDSP cores and HDAudio links need to be turned off on shutdown to ensure no communication or data transfer occurs during the procedure. Fixes: c5a76a246989 ("ASoC: Intel: Skylake: Add shutdown callback") Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-6-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 4ac587f3578c5ca490e4df55af6403f5474eb2f0 Author: Cezary Rojewski Date: Mon Dec 5 09:53:28 2022 +0100 ASoC: Intel: Skylake: Introduce single place for pipe-config selection Provide a single location for pipe config selection where all fields that have to be updated whenever ->pipe_config_idx changes can be updated accordingly. Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-5-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 75ab3c00769009e32e5cf51c8b503de4f73114e4 Author: Cezary Rojewski Date: Mon Dec 5 09:53:27 2022 +0100 ASoC: Intel: Skylake: Drop pipe_config_idx Field ->pipe_config_idx duplicates the job of ->cur_config_idx so remove it. Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit b0d16e54e7559f2055123ea7b1d9ff1bb808ebad Author: Cezary Rojewski Date: Mon Dec 5 09:53:26 2022 +0100 ASoC: Intel: Skylake: Remove skl_tplg_is_multi_fmt() Rather than forcing userspace to select proper format with enumerable kcontrols, select it ourselves based on provided hw_params. Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 72d9a541d7f186f0ec97c71ba7e477dd9bf4155f Author: Cezary Rojewski Date: Mon Dec 5 09:53:25 2022 +0100 ASoC: Intel: Skylake: Update pipe_config_idx before filling BE params Without updating the index before BE copier config is filled with hardware parameters, outdated parameters are used instead. Signed-off-by: Cezary Rojewski Tested-by: Lukasz Majczak Link: https://lore.kernel.org/r/20221205085330.857665-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit aaa4dd1b47f5ff5ef477fec5dcc6c397b457f1c2 Author: Wang Kefeng Date: Sun Dec 4 04:46:40 2022 +0100 ARM: 9279/1: support function error injection This enables HAVE_FUNCTION_ERROR_INJECTION by adding necessary regs_set_return_value() and override_function_with_return(). Simply tested according to Documentation/fault-injection/fault-injection.rst. Signed-off-by: Kefeng Wang Signed-off-by: Russell King (Oracle) commit 4bf5bf54476dffe60e6b6d8d539f67309ff599e2 Author: Edward Pacman Date: Wed Dec 7 21:32:18 2022 +0800 ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB Lenovo TianYi510Pro-14IOB (17aa:3742) require quirk for enabling headset-mic Signed-off-by: Edward Pacman Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=216756 Link: https://lore.kernel.org/r/20221207133218.18989-1-edward@edward-p.xyz Signed-off-by: Takashi Iwai commit 19b00e0069a3819eac0e0ea685899aba29e545d6 Author: Sagi Grimberg Date: Wed Dec 7 13:28:23 2022 +0200 nvmet: don't open-code NVME_NS_ATTR_RO enumeration It is already there, just go ahead and use it. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 0da7feaa5913090a2b97177ed3d7fa07b2d1d99c Author: Christoph Hellwig Date: Wed Nov 30 17:26:25 2022 +0100 nvme-pci: use the tagset alloc/free helpers Use the common helpers to allocate and free the tagsets. To make this work the generic nvme_ctrl now needs to be stored in the hctx private data instead of the nvme_dev. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni commit 93b24f579c392bac2e491fee79ad5ce5a131992e Author: Christoph Hellwig Date: Wed Nov 30 17:28:48 2022 +0100 nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set Add the apple shared tag workaround to nvme_alloc_io_tag_set to prepare for using that helper in the PCIe driver. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni commit b794d1c2ad6d7921f2867ce393815ad31b5b5a83 Author: Christoph Hellwig Date: Wed Nov 30 17:27:07 2022 +0100 nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers The reserved_tags are only needed for fabrics controllers. Right now only fabrics drivers call this helper, so this is harmless, but we'll use it in the PCIe driver soon. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni commit db45e1a5ddccc034eb60d62fc5352022d7963ae2 Author: Christoph Hellwig Date: Wed Nov 30 17:19:50 2022 +0100 nvme: consolidate setting the tagset flags All nvme transports should be using the same flags for their tagsets, with the exception for the blocking flag that should only be set for transports that can block in ->queue_rq. Add a NVME_F_BLOCKING flag to nvme_ctrl_ops to control the blocking behavior and lift setting the flags into nvme_alloc_{admin,io}_tag_set. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni commit dcef77274ae52136925287b6b59d5c6e6a4adfb9 Author: Christoph Hellwig Date: Wed Nov 30 17:16:52 2022 +0100 nvme: pass nr_maps explicitly to nvme_alloc_io_tag_set Don't look at ctrl->ops as only RDMA and TCP actually support multiple maps. Fixes: 6dfba1c09c10 ("nvme-fc: use the tagset alloc/free helpers") Fixes: ceee1953f923 ("nvme-loop: use the tagset alloc/free helpers") Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni commit 172113101641cf1f9628c528ec790cb809f2b704 Author: Pavel Begunkov Date: Wed Dec 7 03:53:35 2022 +0000 io_uring: extract a io_msg_install_complete helper Extract a helper called io_msg_install_complete() from io_msg_send_fd(), will be used later. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1500ca1054cc4286a3ee1c60aacead57fcdfa02a.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 11373026f2960390d5e330df4e92735c4265c440 Author: Pavel Begunkov Date: Wed Dec 7 03:53:34 2022 +0000 io_uring: get rid of double locking We don't need to take both uring_locks at once, msg_ring can be split in two parts, first getting a file from the filetable of the first ring and then installing it into the second one. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/a80ecc2bc99c3b3f2cf20015d618b7c51419a797.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 77e443ab294ca5b88896e8ddab41884948d5519a Author: Pavel Begunkov Date: Wed Dec 7 03:53:33 2022 +0000 io_uring: never run tw and fallback in parallel Once we fallback a tw we want all requests to that task to be given to the fallback wq so we dont run it in parallel with the last, i.e. post PF_EXITING, tw run of the task. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/96f4987265c4312f376f206511c6af3e77aaf5ac.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d34b1b0b6779d4f5ee877b53cad90eef0f1cbe34 Author: Pavel Begunkov Date: Wed Dec 7 03:53:32 2022 +0000 io_uring: use tw for putting rsrc Use task_work for completing rsrc removals, it'll be needed later for spinlock optimisations. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/cbba5d53a11ee6fc2194dacea262c1d733c8b529.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 17add5cea2bbafea0d481f1a3ea9dea019a98ee9 Author: Pavel Begunkov Date: Wed Dec 7 03:53:31 2022 +0000 io_uring: force multishot CQEs into task context Multishot are posting CQEs outside of the normal request completion path, which is usually done from within a task work handler. However, it might be not the case when it's yet to be polled but has been punted to io-wq. Make it abide ->task_complete and push it to the polling path when executed by io-wq. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d7714aaff583096769a0f26e8e747759e556feb1.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit e6aeb2721d3bad8379c43644d0380908e93b0187 Author: Pavel Begunkov Date: Wed Dec 7 03:53:30 2022 +0000 io_uring: complete all requests in task context This patch adds ctx->task_complete flag. If set, we'll complete all requests in the context of the original task. Note, this extends to completion CQE posting only but not io_kiocb cleanup / free, e.g. io-wq may free the requests in the free calllback. This flag will be used later for optimisations purposes. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/21ece72953f76bb2e77659a72a14326227ab6460.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 1b346e4aa8e79227391ffd6b7c6ee5acf0fa8bfc Author: Pavel Begunkov Date: Wed Dec 7 03:53:29 2022 +0000 io_uring: don't check overflow flush failures The only way to fail overflowed CQEs flush is for CQ to be fully packed. There is one place checking for flush failures, i.e. io_cqring_wait(), but we limit the number to be waited for by the CQ size, so getting a failure automatically means that we're done with waiting. Don't check for failures, rarely but they might spuriously fail CQ waiting with -EBUSY. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/6b720a45c03345655517f8202cbd0bece2848fb2.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a85381d8326d75417ae177bddf44be533d1d21be Author: Pavel Begunkov Date: Wed Dec 7 03:53:28 2022 +0000 io_uring: skip overflow CQE posting for dying ring After io_ring_ctx_wait_and_kill() is called there should be no users poking into rings and so there is no need to post CQEs. So, instead of trying to post overflowed CQEs into the CQ, drop them. Also, do it in io_ring_exit_work() in a loop to reduce the number of contexts it can be executed from and even when it struggles to quiesce the ring we won't be leaving memory allocated for longer than needed. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/26d13751155a735a3029e24f8d9ca992f810419d.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 4c979eaefa4356d385b7c7d2877dc04d7fe88969 Author: Pavel Begunkov Date: Wed Dec 7 03:53:27 2022 +0000 io_uring: improve io_double_lock_ctx fail handling msg_ring will fail the request if it can't lock rings, instead punt it to io-wq as was originally intended. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4697f05afcc37df5c8f89e2fe6d9c7c19f0241f9.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ef0ec1ad03119b8b46b035dad42bca7d6da7c2e5 Author: Pavel Begunkov Date: Wed Dec 7 03:53:26 2022 +0000 io_uring: dont remove file from msg_ring reqs We should not be messing with req->file outside of core paths. Clearing it makes msg_ring non reentrant, i.e. luckily io_msg_send_fd() fails the request on failed io_double_lock_ctx() but clearly was originally intended to do retries instead. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e5ac9edadb574fe33f6d727cb8f14ce68262a684.1670384893.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0de796b6047d1ccc29d03fcd0a93dca52691ec21 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:27 2022 +0100 backlight: tosa: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-594-uwe@kleine-koenig.org commit 5867af29c84507a1101115fc3dd6b28060ef2c03 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:26 2022 +0100 backlight: lv5207lp: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-593-uwe@kleine-koenig.org commit 60aa101b2f59538a1922107bdfd4428761ccf898 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:25 2022 +0100 backlight: lp855x: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-592-uwe@kleine-koenig.org commit 3065efe8af914407b206543c83c4b4c642b0ea62 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:24 2022 +0100 backlight: lm3639: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-591-uwe@kleine-koenig.org commit b2d4f93f891d2d7281f0e907675f6b84836022a4 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:23 2022 +0100 backlight: lm3630a: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-590-uwe@kleine-koenig.org commit 58d2b900c7b1fcc85fb6d285c86976dda9c70cc2 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:22 2022 +0100 backlight: bd6107: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-589-uwe@kleine-koenig.org commit 64ec2769813f07201c78db274af0b4d4bf84800c Author: Uwe Kleine-König Date: Fri Nov 18 23:45:21 2022 +0100 backlight: arcxcnn: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-588-uwe@kleine-koenig.org commit e78b28b8abab618284ef5de1f3aa4dc2b5151fe6 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:20 2022 +0100 backlight: adp8870: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-587-uwe@kleine-koenig.org commit f57c2eaaede3ada5db8c47b3ecdf24c58786f5f2 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:19 2022 +0100 backlight: adp8860: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Acked-by: Michael Hennerich Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-586-uwe@kleine-koenig.org commit 1ca8a011ddca3e44340d9db611b019054dfc37d6 Author: Matti Vaittinen Date: Thu Dec 1 08:57:52 2022 +0200 dt-bindings: Fix maintainer email for a few ROHM ICs The email backend used by ROHM keeps labeling patches as spam. This can result to missing the patches. Switch my mail address from a company mail to a personal one. Signed-off-by: Matti Vaittinen Acked-by: Sebastian Reichel Acked-by: Mark Brown Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/7986d30480df6179a3989fba4cd13817738635c5.1669877740.git.mazziesaccount@gmail.com commit d0871b5a22b46fc81887e35e4559710cd53fcfae Author: ye xingchen Date: Thu Nov 17 19:52:24 2022 +0800 mfd: palmas: Use device_get_match_data() to simplify the code Directly get the match data with device_get_match_data(). Signed-off-by: ye xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202211171952240424511@zte.com.cn commit c8cf6e2328ce42ba016f6c321ba663d07e6f70ff Author: Markus Schneider-Pargmann Date: Fri Nov 4 16:23:10 2022 +0100 Input: Add tps65219 interrupt driven powerbutton TPS65219 has different interrupts compared to other TPS6521* chips. TPS65219 defines two interrupts for the powerbutton one for push and one for release. This driver is very simple in that it maps the push interrupt to a key input and the release interrupt to a key release. Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Jerome Neanne Acked-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221104152311.1098603-6-jneanne@baylibre.com commit 74c17a0a49a6ad3b32cb130f25196d1f8d5d560e Author: Jerome Neanne Date: Fri Nov 4 16:23:09 2022 +0100 mfd: tps65219: Add driver for TI TPS65219 PMIC The TPS65219 is a power management IC PMIC designed to supply a wide range of SoCs in both portable and stationary applications. Any SoC can control TPS65219 over a standard I2C interface. It contains the following components: - Regulators. - Over Temperature warning and Shut down. - GPIOs - Multi Function Pins (MFP) - power-button This patch adds support for tps65219 PMIC. At this time only the functionalities listed below are made available: - Regulators probe and functionalities - warm and cold reset support - SW shutdown support - Regulator warnings via IRQs - Power-button via IRQ Signed-off-by: Jerome Neanne Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221104152311.1098603-5-jneanne@baylibre.com commit 85842c46fd47fa6bd78681c154223bed27d5fd19 Author: Matti Vaittinen Date: Wed Nov 16 10:19:21 2022 +0200 mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ The BD957x driver uses REGMAP_IRQ but does not 'select' to depend on it. This can cause build failures. Select REGMAP_IRQ for BD957X. Fixes: 0e9692607f94 ("mfd: bd9576: Add IRQ support") Signed-off-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/Y3SdCWkRr1L64SWK@dc75zzyyyyyyyyyyyyydt-3.rev.dnainternet.fi commit 0cd1860e445f668038621aabf6c67616e6d3bb8b Author: Aidan MacDonald Date: Sat Nov 12 15:18:35 2022 +0000 mfd: wcd934x: Convert irq chip to config regs Type registers are deprecated and will eventually be removed from regmap-irq. The same functionality can be replicated with config registers. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-19-aidanmacdonald.0x0@gmail.com commit 50ff095ba366cca51084a4a5eebd600b432e31f0 Author: Aidan MacDonald Date: Sat Nov 12 15:18:34 2022 +0000 mfd: tps65090: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-18-aidanmacdonald.0x0@gmail.com commit 8d9ad03265a4f24bcf904dacdd05a451d6e51cd9 Author: Aidan MacDonald Date: Sat Nov 12 15:18:33 2022 +0000 mfd: sun4i-gpadc: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Reviewed-by: Samuel Holland Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-17-aidanmacdonald.0x0@gmail.com commit c79e387389d5add7cb967d2f7622c3bf5550927b Author: Aidan MacDonald Date: Sat Nov 12 15:18:32 2022 +0000 mfd: stpmic1: Fix swapped mask/unmask in irq chip The usual behavior of mask registers is writing a '1' bit to disable (mask) an interrupt; similarly, writing a '1' bit to an unmask register enables (unmasks) an interrupt. Due to a longstanding issue in regmap-irq, mask and unmask registers were inverted when both kinds of registers were present on the same chip, ie. regmap-irq actually wrote '1's to the mask register to enable an IRQ and '1's to the unmask register to disable an IRQ. This was fixed by commit e8ffb12e7f06 ("regmap-irq: Fix inverted handling of unmask registers") but the fix is opt-in via mask_unmask_non_inverted = true because it requires manual changes for each affected driver. The new behavior will become the default once all drivers have been updated. The STPMIC1 has a normal mask register with separate set and clear registers. The driver intends to use the set & clear registers with regmap-irq and has compensated for regmap-irq's inverted behavior, and should currently be working properly. Thus, swap mask_base and unmask_base, and opt in to the new non-inverted behavior. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-16-aidanmacdonald.0x0@gmail.com commit 963cd957694b28e227709608467595d58fcf1605 Author: Aidan MacDonald Date: Sat Nov 12 15:18:31 2022 +0000 mfd: sprd-sc27xx-spi: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Reviewed-by: Baolin Wang Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-15-aidanmacdonald.0x0@gmail.com commit cdd13e7260b288fed9ef612f766ba02431947033 Author: Aidan MacDonald Date: Sat Nov 12 15:18:30 2022 +0000 mfd: rt5120: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-14-aidanmacdonald.0x0@gmail.com commit 4627ecec79dfa85b02856e89fab152b4a749c091 Author: Aidan MacDonald Date: Sat Nov 12 15:18:29 2022 +0000 mfd: rt5033: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-13-aidanmacdonald.0x0@gmail.com commit 3210c7faff513809250567024402934401d91155 Author: Aidan MacDonald Date: Sat Nov 12 15:18:28 2022 +0000 mfd: rohm-bd718x7: Drop useless mask_invert flag on irqchip Setting mask_invert to false is pointless because that's the default. The flag is also deprecated, so drop it. Signed-off-by: Aidan MacDonald Reviewed-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-12-aidanmacdonald.0x0@gmail.com commit cdbecc4c44e9a139651cec531f77a98c0b62d5c6 Author: Aidan MacDonald Date: Sat Nov 12 15:18:27 2022 +0000 mfd: rohm-bd71828: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Reviewed-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-11-aidanmacdonald.0x0@gmail.com commit 80ff2d30c0d1a2c7e51e750a8381342a038890fe Author: Aidan MacDonald Date: Sat Nov 12 15:18:26 2022 +0000 mfd: rn5t618: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-10-aidanmacdonald.0x0@gmail.com commit ea5718ff3970ba9ff12ae32cbd1ca6c2aa2a895b Author: Aidan MacDonald Date: Sat Nov 12 15:18:25 2022 +0000 mfd: max77843: Drop useless mask_invert flag on irqchip Setting mask_invert to false is pointless because that's the default. The flag is also deprecated, so drop it. Signed-off-by: Aidan MacDonald Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-9-aidanmacdonald.0x0@gmail.com commit a5ae0a0ccdbc18228de8281dcb185dd647fbedbe Author: Aidan MacDonald Date: Sat Nov 12 15:18:24 2022 +0000 mfd: max77693: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-8-aidanmacdonald.0x0@gmail.com commit b171b0b46b2b6441f04c9a800251ebf82ad67f09 Author: Aidan MacDonald Date: Sat Nov 12 15:18:23 2022 +0000 mfd: max77650: Remove useless type_invert flag The type_invert flag does nothing when type_in_mask is set, and it's part of deprecated functionality in regmap-irq. Remove it. Signed-off-by: Aidan MacDonald Acked-by: Bartosz Golaszewski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-7-aidanmacdonald.0x0@gmail.com commit 911b8b42242256f53ca210a45580e2c35323e6b9 Author: Aidan MacDonald Date: Sat Nov 12 15:18:22 2022 +0000 mfd: max14577: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-6-aidanmacdonald.0x0@gmail.com commit 3576fc04594989426c61c8b46dfcc986b6f76a22 Author: Aidan MacDonald Date: Sat Nov 12 15:18:21 2022 +0000 mfd: gateworks-gsc: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-5-aidanmacdonald.0x0@gmail.com commit acc247b2870cb5bccf6dadd5c2686a1d8d1275e0 Author: Aidan MacDonald Date: Sat Nov 12 15:18:20 2022 +0000 mfd: axp20x: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-4-aidanmacdonald.0x0@gmail.com commit 3db3b9a5cbcc9e96a489bca9f2f07e0193ba8e93 Author: Aidan MacDonald Date: Sat Nov 12 15:18:19 2022 +0000 mfd: atc260x: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-3-aidanmacdonald.0x0@gmail.com commit 0eeb2ddcb41502b6a4330646a9b3f0f80e4827b4 Author: Aidan MacDonald Date: Sat Nov 12 15:18:18 2022 +0000 mfd: 88pm800: Replace irqchip mask_invert with unmask_base Remove use of the deprecated mask_invert flag. Inverted mask registers (where a '1' bit enables an IRQ) can be described more directly as an unmask register. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221112151835.39059-2-aidanmacdonald.0x0@gmail.com commit 0867c49146c2145ecfb07d6d03071cdbeae9b6e1 Author: Luca Weiss Date: Mon Oct 31 18:57:14 2022 +0100 dt-bindings: mfd: qcom,spmi-pmic: Rename extcon node name extcon is a Linux-specific name and shouldn't be a part of the dts. Make it be called usb-detect@ instead. Signed-off-by: Luca Weiss Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221031175717.942237-1-luca@z3ntu.xyz commit ba215dd650c50fee321bb47af94fb689cb3cf776 Author: Luca Weiss Date: Mon Oct 31 18:39:31 2022 +0100 dt-bindings: mfd: qcom,spmi-pmic: Support more types * 'adc@' is either spmi-iadc or spmi-vadc * 'charger@' is either pm8941-charger or pm8941-coincell * 'usb-vbus-regulator@' is usb-vbus-regulator * 'vibrator@' is now in yaml format, so add it Signed-off-by: Luca Weiss Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221031173933.936147-1-luca@z3ntu.xyz commit 2d51f03536c6fc19ed8489f65fabefeae1546a09 Author: Thomas Gleixner Date: Sun Nov 13 21:33:56 2022 +0100 mfd: timberdale: Remove linux/msi.h include Nothing in this file needs anything from linux/msi.h Signed-off-by: Thomas Gleixner Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221113202428.312137892@linutronix.de commit 6fed0c1e6efad3494dad90fb7c5e167b7b5317b1 Author: Paul Cercueil Date: Sun Oct 23 10:48:51 2022 +0100 mfd: tc6393xb: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .suspend/.resume callbacks. This macro allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 02313a90095fb919d9e5e166458f73a5f7bf915c Author: Paul Cercueil Date: Sun Oct 23 10:48:50 2022 +0100 mfd: tc3589x: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit f7f292fe819b6c754836923e126ec27c29be2d07 Author: Paul Cercueil Date: Sun Oct 23 10:48:49 2022 +0100 mfd: stmpe: Remove #ifdef guards for PM related functions Use the new EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 4d8a6ae23af64a37803c0d15922819d27b4b8b08 Author: Paul Cercueil Date: Sun Oct 23 10:48:48 2022 +0100 mfd: stmfx: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 69bbab91835acb4d1f64b2f488b379116c1c49b5 Author: Paul Cercueil Date: Sun Oct 23 10:48:47 2022 +0100 mfd: sprd-sc27xx: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 4060c6e50a77a70bf7b7ff3a3aaaa8b1828ec7b6 Author: Paul Cercueil Date: Sun Oct 23 10:48:46 2022 +0100 mfd: motorola-cpcap: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit ef72ed420ea16fa21680a262bc40a5592994a46e Author: Paul Cercueil Date: Sun Oct 23 10:48:45 2022 +0100 mfd: max77686: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 8a8d0485f579120f464193efd8a1ebc96b32fc8b Author: Paul Cercueil Date: Sun Oct 23 10:48:44 2022 +0100 mfd: max14577: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 50d3ac7d3ce472801c4c0b3f8705b943657a6552 Author: Paul Cercueil Date: Sun Oct 23 10:48:43 2022 +0100 mfd: arizona: Remove #ifdef guards for PM related functions Only export the arizona_pm_ops if CONFIG_PM is set, but leave the suspend/resume functions (and related code) outside #ifdef guards. If CONFIG_PM is not set, the arizona_pm_ops will be defined as "static __maybe_unused", and the structure plus all the callbacks will be automatically dropped by the compiler. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Acked-by: Charles Keepax Signed-off-by: Lee Jones commit daf7ea817fda9e5094082a1dd99227001f7ef861 Author: Paul Cercueil Date: Sun Oct 23 10:48:42 2022 +0100 mfd: t7l66xb: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .suspend/.resume callbacks. This macro allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 9b990dc9f09fcdde272abc54ae0c158596149944 Author: Paul Cercueil Date: Sun Oct 23 10:48:41 2022 +0100 mfd: max77620: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 9dd3baecebc3d7b722486a73219afe4eaaa16257 Author: Paul Cercueil Date: Sun Oct 23 10:48:40 2022 +0100 mfd: wm8994: Remove #ifdef guards for PM related functions Use the new RUNTIME_PM_OPS() and pm_ptr() macros to handle the .runtime_suspend/.runtime_resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Note that this driver should probably use the new DEFINE_RUNTIME_DEV_PM_OPS() macro instead, which will provide .suspend/.resume callbacks, pointing to pm_runtime_force_suspend() and pm_runtime_force_resume() respectively; unless those callbacks really aren't needed. Signed-off-by: Paul Cercueil Acked-by: Charles Keepax Signed-off-by: Lee Jones commit d115e88c297546192354f65be6c0343a68910afb Author: Paul Cercueil Date: Sun Oct 23 10:48:39 2022 +0100 mfd: tps6586x: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .irq_set_wake() callback. This macro allows the mt6397_irq_set_wake() function to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 2d81212cb0c811db0e74b959fd48b2ba19b77e0f Author: Paul Cercueil Date: Sun Oct 23 10:48:38 2022 +0100 mfd: tc6387xb: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .suspend/.resume callbacks. This macro allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 3833239b5ba22256389c2fd83ca70b6a9028435b Author: Paul Cercueil Date: Sun Oct 23 10:48:37 2022 +0100 mfd: sm501: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .suspend/.resume callbacks. This macro allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 270a7c3eba574364c43a6ec8583ec995122c255b Author: Paul Cercueil Date: Sun Oct 23 10:48:36 2022 +0100 mfd: sec: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit ff84723e5291c51ac23429d267ab9107e14ee486 Author: Paul Cercueil Date: Sun Oct 23 10:48:35 2022 +0100 mfd: mcp-sa11x0: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .suspend/.resume callbacks. This macro allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit fdefee3073bc60b57f664e1463d7e4c07910e3bd Author: Paul Cercueil Date: Sun Oct 23 10:48:34 2022 +0100 mfd: 88pm860x: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 03bf96cf8ecbd543a25c3c71b09ea67ffffeb36b Author: Paul Cercueil Date: Sun Oct 23 10:48:33 2022 +0100 mfd: ucb1x00: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit e4b9a17c99d0b45cb4104fd32d170536701214e8 Author: Paul Cercueil Date: Sun Oct 23 10:48:32 2022 +0100 mfd: stpmic1: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 2662b90fd58b8833894948be07c2f44bfa782ed8 Author: Paul Cercueil Date: Sun Oct 23 10:48:31 2022 +0100 mfd: rc5t583-irq: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .irq_set_wake() callback. This macro allows the mt6397_irq_set_wake() function to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 245cb473e5388fcbc01c7284b6a4e1446cdbf054 Author: Paul Cercueil Date: Sun Oct 23 10:48:30 2022 +0100 mfd: pcf50633: Remove #ifdef guards for PM related functions Use the new EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit e1243e0d72185c257ac2cdde1bbba130e24acf9a Author: Paul Cercueil Date: Sun Oct 23 10:48:29 2022 +0100 mfd: mt6397-irq: Remove #ifdef guards for PM related functions Use the new pm_sleep_ptr() macro to handle the .irq_set_wake() callback. This macro allows the mt6397_irq_set_wake() function to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 52c9d7193ba4342239a47a5524884f7a0a667e4d Author: Paul Cercueil Date: Sun Oct 23 10:48:28 2022 +0100 mfd: max8925-i2c: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 5745a90a930c81b55dfcb67b5e904b3cb1df0c7a Author: Paul Cercueil Date: Sun Oct 23 10:48:27 2022 +0100 mfd: adp5520: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Acked-by: Michael Hennerich Signed-off-by: Lee Jones commit dce97f81fea6fa6230e6b7f0e2d0f17a74158dc9 Author: Paul Cercueil Date: Sun Oct 23 10:48:26 2022 +0100 mfd: aat2870: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 19755a0acb8831a02ba7833f908c55febaaa2607 Author: Paul Cercueil Date: Sun Oct 23 10:48:25 2022 +0100 mfd: 88pm80x: Remove #ifdef guards for PM related functions Use the new EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 3f37d4f695cff180033254b9ed5adc8ab927cba9 Author: Samuel Holland Date: Sat Nov 5 16:29:09 2022 -0500 mfd: axp20x: Do not sleep in the power off handler Since commit 856c288b0039 ("ARM: Use do_kernel_power_off()"), the function axp20x_power_off() now runs inside a RCU read-side critical section, so it is not allowed to call msleep(). Use mdelay() instead. Fixes: 856c288b0039 ("ARM: Use do_kernel_power_off()") Signed-off-by: Samuel Holland Reviewed-by: Dmitry Osipenko Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221105212909.6526-1-samuel@sholland.org commit ef1709238aa50094d918e4f1dd5231dac5db13c3 Author: Jonathan Neuschäfer Date: Sat Nov 5 19:59:07 2022 +0100 dt-bindings: mfd: syscon: Add nuvoton,wpcm450-shm The Shared Memory interface (SHM) is a piece of hardware in Nuvoton BMCs that allows a host processor (connected via LPC) to access flash and RAM that belong to the BMC. The SHM includes a register block accessible from the BMC side. Signed-off-by: Jonathan Neuschäfer Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221105185911.1547847-5-j.neuschaefer@gmx.net commit 0a5219f34fea85a0e583de2aa4528548acaa85f4 Author: Jonathan Neuschäfer Date: Tue Nov 1 17:50:45 2022 +0100 mfd: mc13xxx-spi: Fix typo ("transfert") That spelling is only correct in French :-) Signed-off-by: Jonathan Neuschäfer Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221101165045.1017822-1-j.neuschaefer@gmx.net commit b5a8668dab74ee37886aec5a1748f681a2d6cc6c Author: Randy Dunlap Date: Mon Oct 31 22:54:33 2022 -0700 mfd: intel_soc_pmic: Allow COMPILE_TEST or I2C_DESIGNWARE_PLATFORM Linus expressed a desire to have intel_soc_pmic_crc.o (INTEL_SOC_PMIC, for Crystal Cove) be built on an "allmodconfig" build, when I2C_DESIGNWARE_PLATFORM=m, to enhance build test coverage. The PMIC driver won't work in this case since it requires I2C_DESIGNWARE_PLATFORM=y to operate properly, but adding "|| COMPILE_TEST" does improve the build test coverage. Link: https://lore.kernel.org/all/CAHk-=wg=hh8xkPjiySnjAyR66AG64eyZ1Y9gHw+MCs8uuSZReA@mail.gmail.com/ Suggested-by: Linus Torvalds Signed-off-by: Randy Dunlap Reviewed-by: Hans de Goede Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221101055433.16891-1-rdunlap@infradead.org commit 411ffc82f93cf69f70712467ac85fdf2dc3be04a Author: AngeloGioacchino Del Regno Date: Fri Nov 4 18:21:19 2022 +0100 dt-bindings: mfd: qcom,tcsr: Add compatible for MSM8976 Document the qcom,msm8976-tcsr compatible. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221104172122.252761-7-angelogioacchino.delregno@collabora.com commit 3633daacea2e54bf991d2f6b871efe9f83a0cac8 Author: Neil Armstrong Date: Mon Oct 31 17:05:07 2022 +0100 mfd: rk808: Permit having multiple PMIC instances This set each cells id to PLATFORM_DEVID_NONE to allow multiple instances of each cell in case multiple PMICs handled by the rk808 driver are probed. This fixes probing a RK818 and a RK817 on the Odroid Go Ultra devices. Signed-off-by: Neil Armstrong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221025-rk808-multi-v2-0-d292d51ada81@linaro.org commit b092874ace67d5e33a9dc3aba7cb2e666dda8fd3 Author: Colin Foster Date: Mon Oct 24 22:03:50 2022 -0700 dt-bindings: mfd: ocelot: Remove unnecessary driver wording Initially there was unnecessary verbage around "this driver" in the documentation. It was unnecessary. Remove self references about it being a "driver" documentation and replace it with a more detailed description about external interfaces that are supported. Signed-off-by: Colin Foster Suggested-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221025050355.3979380-3-colin.foster@in-advantage.com commit 4c7ee9a38dcc347887511deb773624550f7629ca Author: Colin Foster Date: Mon Oct 24 22:03:49 2022 -0700 dt-bindings: mfd: ocelot: Remove spi-max-frequency from required properties The property spi-max-frequency was initially documented as a required property. It is not actually required, and will break bindings validation if other control mediums (e.g. PCIe) are used. Remove this property from the required arguments. Signed-off-by: Colin Foster Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221025050355.3979380-2-colin.foster@in-advantage.com commit 9f0345e335b2eccf56faf45fb9706b40052acbdf Author: Quan Nguyen Date: Mon Oct 31 09:44:40 2022 +0700 dt-bindings: mfd: Add bindings for Ampere Altra SMPro MFD driver Adds device tree bindings for SMPro MFD driver found on the Mt.Jade hardware reference platform with Ampere's Altra Processor family. The SMpro co-processor on Ampere Altra processor family is to monitor and report various data included hwmon-related info, RAS errors, and other miscellaneous information. Signed-off-by: Quan Nguyen Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221031024442.2490881-2-quan@os.amperecomputing.com commit e112f2de151badd38a9c8a098a1f92f2369349cb Author: Rafał Miłecki Date: Fri Oct 28 13:53:53 2022 +0200 dt-bindings: timer: Add Broadcom's BCMBCA timers BCA is a big set / family of Broadcom devices sharing multiple hardware blocks. One of them is timer that actually exists in two versions. It's a part of TWD MFD block. Add binding for it so SoCs can be properly described. Linux (and probably any other OS) doesn't really seem to need a driver for it. it may be needed for bootloaders (e.g. U-Boot) though. Especially for SoCs with CPUs other than Cortex-A9 (which contains arch timers). Signed-off-by: Rafał Miłecki Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221028115353.13881-1-zajec5@gmail.com commit 727b67e34969ab7ad254a379664bbb492ae0bc5a Author: Neil Armstrong Date: Fri Oct 21 11:06:44 2022 +0200 mfd: qcom-pm8xxx: Drop unused PM8018 compatible The PM8018 compatible is always used with PM8921 fallback, so PM8018 compatible can be safely removed from device ID table Reviewed-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220928-mdm9615-dt-schema-fixes-v4-8-dac2dfaac703@linaro.org commit 6af338b0011727da68c32ba79f8dfab8524fc4ae Author: Neil Armstrong Date: Fri Oct 21 11:06:41 2022 +0200 dt-bindings: mfd: qcom-pm8xxx: Document qcom,pm8921 as fallback of qcom,pm8018 The PM8018 is used as compatible with PM8921 on the MDM9615, document this situation, and an example section to validate this change. Reviewed-by: Rob Herring Signed-off-by: Neil Armstrong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220928-mdm9615-dt-schema-fixes-v4-5-dac2dfaac703@linaro.org commit 9f8fa5e9b2fc90855fe4df770c4cf0fa653e5672 Author: Matt Ranostay Date: Sun Oct 23 20:54:04 2022 -0700 dt-bindings: mfd: ti,j721e-system-controller: Add compatible strings for other platforms There are multiple J7 based platforms, and the j721e-system-controller shouldn't be define in non-j721e devices device trees. This is mainly for clarity; but also useful in case there are future erratas that need to be fixed for a specific platform. Signed-off-by: Matt Ranostay Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221024035405.366208-2-mranostay@ti.com commit d4b15e447c352ae74b18261bdaf0023fa9a7d1bd Author: Guillaume La Roque Date: Wed Oct 26 16:09:11 2022 +0200 mfd: palmas: Add support of module build for Ti palmas chip Modified Kconfig to enable module build support Signed-off-by: Guillaume La Roque Signed-off-by: Nicolas Frayer Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221026140911.204776-1-nfrayer@baylibre.com commit 5ed6cf8c0d55497f010c80fcf4c011e6febf9673 Author: Matt Ranostay Date: Tue Oct 25 01:00:14 2022 -0700 dt-bindings: mfd: ti,am3359-tscadc: Add missing power-domains property Add optional power-domains property to avoid the following dt-schema failures: tscadc@40200000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Matt Ranostay Reviewed-by: Miquel Raynal Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221025080014.403457-1-mranostay@ti.com commit 707857d997ae39743eba939a5b3aaafbab04fa78 Author: Arnd Bergmann Date: Wed Oct 19 17:03:39 2022 +0200 mfd: Remove htc-i2cpld driver The HTC Herald machine was removed, so this driver is no longer used anywhere. Cc: Cory Maccarrone Signed-off-by: Arnd Bergmann Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221019150410.3851944-17-arnd@kernel.org commit 67470bb7b30b87bebcfb798aedc77dc6519cc0a7 Author: Arnd Bergmann Date: Wed Oct 19 17:29:36 2022 +0200 mfd: Remove davinci voicecodec driver The ASoC davinci voicecodec support is no longer used after the removal of the dm3xx SoC platform, so the MFD driver is never selected. Signed-off-by: Arnd Bergmann Acked-by: Bartosz Golaszewski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221019152947.3857217-11-arnd@kernel.org commit fc45720334ebc9f97335a9ce67896811354f0a1c Author: Arnd Bergmann Date: Wed Oct 19 17:29:32 2022 +0200 mfd: Remove dm355evm_msp driver The DaVinci DM355EVM platform is gone after the removal of all unused board files, so the MTD device along with its sub-devices can be removed as well. Signed-off-by: Arnd Bergmann Acked-by: Bartosz Golaszewski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221019152947.3857217-7-arnd@kernel.org commit 118ee241c423636c03527eada8f672301514751e Author: Fabien Parent Date: Thu Oct 20 18:20:45 2022 +0200 dt-bindings: mfd: mt6397: Add binding for MT6357 Add binding documentation for the MT6357 PMIC. Signed-off-by: Fabien Parent Signed-off-by: Alexandre Mergnat Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221005-mt6357-support-v3-1-7e0bd7c315b2@baylibre.com commit 5f4f94e9f26cca6514474b307b59348b8485e711 Author: ChiYuan Huang Date: Thu Sep 29 10:00:17 2022 +0800 mfd: mt6360: Add bounds checking in Regmap read/write call-backs Fix the potential risk of OOB read if bank index is over the maximum. Refer to the discussion list for the experiment result on mt6370. https://lore.kernel.org/all/20220914013345.GA5802@cyhuang-hp-elitebook-840-g3.rt/ If not to check the bound, there is the same issue on mt6360. Cc: stable@vger.kernel.org Fixes: 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write) Signed-off-by: ChiYuan Huang Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/1664416817-31590-1-git-send-email-u0084500@gmail.com commit 4bef4d519b01cf15818b81a3fbf62d9f51612ad3 Author: Krzysztof Kozlowski Date: Thu Sep 8 10:09:38 2022 +0200 dt-bindings: mfd: qcom,spmi-pmic: Use generic node name "gpio" GPIO controller nodes are named by convention just "gpio", not "gpios". Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220908080938.29199-3-krzysztof.kozlowski@linaro.org commit 03317a86df980f255b80a9f7122ffa16b3451f3b Author: Johan Hovold Date: Fri Oct 7 14:11:10 2022 +0200 dt-bindings: mfd: qcom,tcsr: Add sc8280xp binding Add a binding for the SC8280XP TCSR. Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221007121110.5432-1-johan+linaro@kernel.org commit f19fd81ba1ea34a4ddb771cc3b64059f6e666b12 Author: Quan Nguyen Date: Thu Sep 29 16:43:20 2022 +0700 mfd: Add Ampere's Altra SMpro MFD driver Adds Multi-function devices driver for SMpro co-processor found on the Mt.Jade hardware reference platform with Ampere's Altra processor family. Signed-off-by: Quan Nguyen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220929094321.770125-9-quan@os.amperecomputing.com commit 763ab98687404d924b6612f7c9c8430333d31229 Author: Bryan O'Donoghue Date: Wed Sep 28 01:05:17 2022 +0100 dt-bindings: mfd: qcom,spmi-pmic: Drop PWM reg dependency The PWM node is not a separate device and is expected to be part of parent SPMI PMIC node, thus it obtains the address space from the parent. One IO address in "reg" is also not correct description because LPG block maps to several regions. Fixes: 3f5117be9584 ("dt-bindings: mfd: convert to yaml Qualcomm SPMI PMIC") Suggested-by: Krzysztof Kozlowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220928000517.228382-2-bryan.odonoghue@linaro.org commit 1f7caaa1743edbc40f3cd7e2bc0dff89698fd91d Author: Dmitry Torokhov Date: Sun Sep 25 22:44:21 2022 -0700 mfd: twl6040: Drop twl6040_platform_data and associated definitions As of df04b6242a58 ("mfd: twl6040: Remove support for legacy (pdata) mode") the driver no longer references the platform data, so we can drop its definition, as well as definitions of related structures. Signed-off-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926054421.1546436-5-dmitry.torokhov@gmail.com commit 3c92699a167a543b2bc7d603e4a09aa78a99f809 Author: Dmitry Torokhov Date: Sun Sep 25 22:44:20 2022 -0700 mfd: twl6040: Switch to using gpiod API This patch switches the dirver from legacy gpio API to a newer gpiod API so that we can eventually drop the former. Signed-off-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926054421.1546436-4-dmitry.torokhov@gmail.com commit 7ca91a33775c4a33cb451f508f84a7820179c73b Author: Dmitry Torokhov Date: Sun Sep 25 22:44:19 2022 -0700 mfd: palmas: Stop including of_gpio.h It does not appear that any of palmas sub-drivers are using OF-based gpio APIs, so let's stop including this header. Signed-off-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926054421.1546436-3-dmitry.torokhov@gmail.com commit de5567ca320aee5c99dd7bbebefffb05cc9df9f4 Author: Dmitry Torokhov Date: Sun Sep 25 22:44:18 2022 -0700 mfd: madera: Include correct gpio API The driver is using gpiod API and therefore should include linux/gpio/consumer.h, not linux/gpio.h. Also, the driver does not use any of the APIs from of_gpio.h, so we should not be including it. Signed-off-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926054421.1546436-2-dmitry.torokhov@gmail.com commit 2e992b22ccd1a620165a077355163798c3951d4b Author: Dmitry Torokhov Date: Sun Sep 25 22:44:17 2022 -0700 mfd: mc13xxx: Stop including of_gpio.h Neither SPI nor I2C variant uses any APIs from of_gpio.h so let's stop including it. Signed-off-by: Dmitry Torokhov Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926054421.1546436-1-dmitry.torokhov@gmail.com commit 54f872baf6b17a74492f4d601be3c36626907178 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:35 2022 +0100 mfd: wm8994-core: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-482-uwe@kleine-koenig.org commit 521fcf401f97f76948c64fb0bd039fdf3795486f Author: Uwe Kleine-König Date: Fri Nov 18 23:43:34 2022 +0100 mfd: wm8400-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-481-uwe@kleine-koenig.org commit 8b20feff0985599c20e7824807fcfb3a40589dd8 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:33 2022 +0100 mfd: wm8350-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-480-uwe@kleine-koenig.org commit 5fb66be1bf4984ab0c49e3296efd66fdb65cace9 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:32 2022 +0100 mfd: wm831x-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-479-uwe@kleine-koenig.org commit 490e11b7c33c094e5263e03df59deffd71eac5cf Author: Uwe Kleine-König Date: Fri Nov 18 23:43:31 2022 +0100 mfd: wl1273-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-478-uwe@kleine-koenig.org commit d85213be3397e16d15a29420a32f75450a096355 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:30 2022 +0100 mfd: twl6040: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-477-uwe@kleine-koenig.org commit c291d0e347261c329fe7280e4bacfb23294db5b0 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:29 2022 +0100 mfd: twl-core: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-476-uwe@kleine-koenig.org commit 328fc6f86f509f8b98147d5397caa1851e63ca49 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:28 2022 +0100 mfd: tps65912-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-475-uwe@kleine-koenig.org commit 74e52d31cf1d26485c1df3f7caca53b6cc6410d3 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:27 2022 +0100 mfd: tps65910: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-474-uwe@kleine-koenig.org commit ba801bd52f883bd934238ad7b47c35048f42ddc1 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:26 2022 +0100 mfd: tps6586x: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-473-uwe@kleine-koenig.org commit 3d984091e15a11e7f1520ea6c30e82d39e91c2f6 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:25 2022 +0100 mfd: tps65218: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-472-uwe@kleine-koenig.org commit b63250984c88faf0df7c75b16587dbb20611c8d0 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:24 2022 +0100 mfd: tps65090: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-471-uwe@kleine-koenig.org commit 1f662faa5e8ef07a4cd68fe3ebe2b4dac419c503 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:23 2022 +0100 mfd: tps65086: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-470-uwe@kleine-koenig.org commit 0e1a8964f270226218e8055ecd2fac4d96788c7b Author: Uwe Kleine-König Date: Fri Nov 18 23:43:22 2022 +0100 mfd: tps6507x: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-469-uwe@kleine-koenig.org commit 71b954d8ac2b0c8c0c6bfe7be9d09e8bfba4a711 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:21 2022 +0100 mfd: tps65010: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-468-uwe@kleine-koenig.org commit bb5b1c649a638411805545072f2a284f0ea0dd13 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:20 2022 +0100 mfd: tps6105x: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-467-uwe@kleine-koenig.org commit e6a6b1d6bb06e8fda4d9f5a6a9c61291eb504a86 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:19 2022 +0100 mfd: ti-lmu: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-466-uwe@kleine-koenig.org commit d28fa288ea506812ef73980b8c3dc9c39ec8c18b Author: Uwe Kleine-König Date: Fri Nov 18 23:43:18 2022 +0100 mfd: tc3589x: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-465-uwe@kleine-koenig.org commit 40ee15f763906ce1d8a47261a3343507f5c7bc9a Author: Uwe Kleine-König Date: Fri Nov 18 23:43:17 2022 +0100 mfd: stw481x: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-464-uwe@kleine-koenig.org commit 39cabdc8fbc2b12b1a3cfd29af553ffe1ce06d1d Author: Uwe Kleine-König Date: Fri Nov 18 23:43:16 2022 +0100 mfd: stpmic1: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-463-uwe@kleine-koenig.org commit 50b1d5bab4424169d8cc16853a5aa1140fe2bb78 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:15 2022 +0100 mfd: stmpe-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-462-uwe@kleine-koenig.org commit 05b62f4ca66d8c20da59ddc3fdc72bd973acb1b6 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:14 2022 +0100 mfd: stmfx: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-461-uwe@kleine-koenig.org commit 81943ca2a616e1c35003f15bcac22c2a322610ae Author: Uwe Kleine-König Date: Fri Nov 18 23:43:13 2022 +0100 mfd: sky81452: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-460-uwe@kleine-koenig.org commit ca08a4f30be612a2fa725f84c2f9b2dd8f54efee Author: Uwe Kleine-König Date: Fri Nov 18 23:43:12 2022 +0100 mfd: si476x-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-459-uwe@kleine-koenig.org commit a403e589705fa4b93732581450c5c05833105ae3 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:11 2022 +0100 mfd: sec-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-458-uwe@kleine-koenig.org commit e46b578cabb0365e8a91fba766d39d20153b82ce Author: Uwe Kleine-König Date: Fri Nov 18 23:43:10 2022 +0100 mfd: rt5033: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-457-uwe@kleine-koenig.org commit 601e6d48ee3519648679177a0647dd3b3cbaefbb Author: Uwe Kleine-König Date: Fri Nov 18 23:43:09 2022 +0100 mfd: rsmu_i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-456-uwe@kleine-koenig.org commit 6816c54bdd95e8c35103b88bef3c75e699ff587b Author: Uwe Kleine-König Date: Fri Nov 18 23:43:08 2022 +0100 mfd: rohm-bd718x7: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Matti Vaittinen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-455-uwe@kleine-koenig.org commit 8416360935b9b632a517503eac6e320cbd5f310a Author: Uwe Kleine-König Date: Fri Nov 18 23:43:07 2022 +0100 mfd: rk808: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-454-uwe@kleine-koenig.org commit faa424fc01455557702d2d29602625a88996ce1d Author: Uwe Kleine-König Date: Fri Nov 18 23:43:06 2022 +0100 mfd: retu-mfd: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-453-uwe@kleine-koenig.org commit 913c4a3e1988f042e9f817288092c0a0bc4214bd Author: Uwe Kleine-König Date: Fri Nov 18 23:43:05 2022 +0100 mfd: rc5t583: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-452-uwe@kleine-koenig.org commit 659ea732119d556de500ace6de69a29c021c2ff1 Author: Uwe Kleine-König Date: Fri Nov 18 23:43:04 2022 +0100 mfd: pcf50633-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-451-uwe@kleine-koenig.org commit a5d6cbcfc7aec61df571972b5e7b93ec117de01c Author: Uwe Kleine-König Date: Fri Nov 18 23:43:03 2022 +0100 mfd: palmas: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-450-uwe@kleine-koenig.org commit a5a689fa14558e1e7d7a57303539ed8c2bc37c3f Author: Uwe Kleine-König Date: Fri Nov 18 23:43:02 2022 +0100 mfd: menf21bmc: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-449-uwe@kleine-koenig.org commit 19301f114ba83b248f37f27131c9511b767d737b Author: Uwe Kleine-König Date: Fri Nov 18 23:43:01 2022 +0100 mfd: menelaus: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-448-uwe@kleine-koenig.org commit 1060552913f13b58db02078bdfef657c1badfc6e Author: Uwe Kleine-König Date: Fri Nov 18 23:43:00 2022 +0100 mfd: mc13xxx-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-447-uwe@kleine-koenig.org commit 833eaaf700ae94a15ced1a67392564eca03e5fcf Author: Uwe Kleine-König Date: Fri Nov 18 23:42:59 2022 +0100 mfd: max8998: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-446-uwe@kleine-koenig.org commit c9f105ec976a7f038d99e2745508cdceec44353c Author: Uwe Kleine-König Date: Fri Nov 18 23:42:58 2022 +0100 mfd: max8997: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-445-uwe@kleine-koenig.org commit 18d9f1217e42d50372ef40be07a37e7748f940f0 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:57 2022 +0100 mfd: max8925-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-444-uwe@kleine-koenig.org commit bab90bb26256c31633897867d124164d22ce5de9 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:56 2022 +0100 mfd: max8907: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-443-uwe@kleine-koenig.org commit 13c6de605f1ec5617ca085a9044a244bb8f4b9b7 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:55 2022 +0100 mfd: max77843: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-442-uwe@kleine-koenig.org commit 317018e57b4eae64a304877f3aad32163ed58ea3 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:54 2022 +0100 mfd: max77693: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-441-uwe@kleine-koenig.org commit 773fb98fec5f7ae42254836391dd149e49427d9a Author: Uwe Kleine-König Date: Fri Nov 18 23:42:53 2022 +0100 mfd: max77620: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-440-uwe@kleine-koenig.org commit 8df214715d056e88ae428f0312c49ecf46d93331 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:52 2022 +0100 mfd: max14577: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-439-uwe@kleine-koenig.org commit 806b9167d4175787651b497892213fe7974e9ee0 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:51 2022 +0100 mfd: madera-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-438-uwe@kleine-koenig.org commit 2034ef7458083eb92ce3f563cca883772118d8e2 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:50 2022 +0100 mfd: lp8788: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-437-uwe@kleine-koenig.org commit 7ec69cc2aa0c6210f4617ec67ce438e3e429cf9c Author: Uwe Kleine-König Date: Fri Nov 18 23:42:49 2022 +0100 mfd: lp87565: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-436-uwe@kleine-koenig.org commit 4acb5992aa3dcf22ed16923d92e0053a73e1a9f4 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:48 2022 +0100 mfd: lp873x: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-435-uwe@kleine-koenig.org commit f7b497cb3e14b7d61caf47e8ba7cdc0eb8fde0a4 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:47 2022 +0100 mfd: lp3943: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-434-uwe@kleine-koenig.org commit daf811fc4873af4a1facbe919526880b72c42a54 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:46 2022 +0100 mfd: lm3533-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-433-uwe@kleine-koenig.org commit c88e02da2970804992462983fdde30289123bb3e Author: Uwe Kleine-König Date: Fri Nov 18 23:42:45 2022 +0100 mfd: khadas-mcu: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Neil Armstrong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-432-uwe@kleine-koenig.org commit 3dc6eb9fa1c69b5218be571832f76ee7472c355e Author: Uwe Kleine-König Date: Fri Nov 18 23:42:44 2022 +0100 mfd: da9150-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-431-uwe@kleine-koenig.org commit b309636b660639e8d1c758c042ca49726bef5aa7 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:43 2022 +0100 mfd: da9063-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-430-uwe@kleine-koenig.org commit 7df5c3d803f7aea56dce550a1151236d13d82d79 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:42 2022 +0100 mfd: da9062-core: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-429-uwe@kleine-koenig.org commit d429772913a9804e7440c13a135cc22957fee4f5 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:41 2022 +0100 mfd: da9055-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-428-uwe@kleine-koenig.org commit 1ebf79726a9a911247a0b8566c5be84d44a18fa0 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:40 2022 +0100 mfd: da9052-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-427-uwe@kleine-koenig.org commit 6887bb934cf3864e2ae0894fe58d299e03609752 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:39 2022 +0100 mfd: da903x: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-426-uwe@kleine-koenig.org commit 4c023a6ec3a8911f2935da55ca0512d94bb289ab Author: Uwe Kleine-König Date: Fri Nov 18 23:42:38 2022 +0100 mfd: bd9571mwv: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-425-uwe@kleine-koenig.org commit ace24876abf16f086bf19349d99baf0a8ef2e986 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:37 2022 +0100 mfd: bcm590xx: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-424-uwe@kleine-koenig.org commit 2f2455db6f5f1db82ffffd6d8bdb3beac8a0fe63 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:36 2022 +0100 mfd: axp20x-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-423-uwe@kleine-koenig.org commit 10206ff20678debb540a09ccacd86afd4956515d Author: Uwe Kleine-König Date: Fri Nov 18 23:42:35 2022 +0100 mfd: atc260x-i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-422-uwe@kleine-koenig.org commit 9b6e839353819841c0689997b0fb3a90cf44c59e Author: Uwe Kleine-König Date: Fri Nov 18 23:42:34 2022 +0100 mfd: as3722: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-421-uwe@kleine-koenig.org commit 4a36fb26728dd4dced21a2806bb58618433e6415 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:33 2022 +0100 mfd: as3711: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-420-uwe@kleine-koenig.org commit 6cb7ac1c0402e61d84652b0fb79a471aca0fb7b2 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:32 2022 +0100 mfd: arizona-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-419-uwe@kleine-koenig.org commit 48c2c36686125ff4a7ac6c6448dff31880ddd0df Author: Uwe Kleine-König Date: Fri Nov 18 23:42:31 2022 +0100 mfd: adp5520: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Michael Hennerich Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-418-uwe@kleine-koenig.org commit 75a4504e49b0085229e056ffe99c8542055d2657 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:30 2022 +0100 mfd: act8945a: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-417-uwe@kleine-koenig.org commit fb53f6668273da9bd604348763a857ac83ed1406 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:29 2022 +0100 mfd: aat2870-core: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-416-uwe@kleine-koenig.org commit 61d1be25a226b64d341aa3eb1e852f4815af18b8 Author: Uwe Kleine-König Date: Fri Nov 18 23:42:28 2022 +0100 mfd: 88pm805: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-415-uwe@kleine-koenig.org commit b9420da8847874976d25489186f57ec3215ff77c Author: Uwe Kleine-König Date: Fri Nov 18 23:42:27 2022 +0100 mfd: 88pm800: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221118224540.619276-414-uwe@kleine-koenig.org commit acc13958c2b2623c17e2450b8cd6881b698756d3 Author: Prathamesh Shete Date: Tue Dec 6 17:59:45 2022 +0100 mmc: sdhci-tegra: Issue CMD and DAT resets together In case of error condition to avoid system crash Tegra SDMMC controller requires CMD and DAT resets issued together. SDHCI controller FSM goes into bad state due to rapid SD card hot-plug event. Issuing reset on the CMD FSM before DATA FSM results in kernel panic, hence add support to issue CMD and DAT resets together. This is applicable to Tegra186 and later chips. Signed-off-by: Aniruddha TVS Rao Signed-off-by: Prathamesh Shete Acked-by: Adrian Hunter Acked-by: Thierry Reding Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-7-thierry.reding@gmail.com Signed-off-by: Ulf Hansson commit 03813c81e62559489afa1b461ab159b5641d66f8 Author: Prathamesh Shete Date: Tue Dec 6 17:59:44 2022 +0100 mmc: sdhci-tegra: Add support to program MC stream ID SMMU clients are supposed to program stream ID from their respective address spaces instead of MC override. Define NVQUIRK_PROGRAM_STREAMID and use it to program SMMU stream ID from the SDMMC client address space. Signed-off-by: Aniruddha TVS Rao Signed-off-by: Prathamesh Shete Acked-by: Adrian Hunter Acked-by: Thierry Reding Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-6-thierry.reding@gmail.com [Ulf: Fixed a checkpatch error] Signed-off-by: Ulf Hansson commit 8f00ad01fcd457d5e8c09c97f7a963be09e59b99 Author: Prathamesh Shete Date: Tue Dec 6 17:59:43 2022 +0100 mmc: sdhci-tegra: Separate Tegra194 and Tegra234 SoC data Create new SoC data structure for Tegra234 platforms. Additional features, tap value configurations are added/updated for Tegra234 platform hence separate Tegra194 and Tegra234 SoC data. Signed-off-by: Aniruddha Tvs Rao Signed-off-by: Prathamesh Shete Acked-by: Adrian Hunter Acked-by: Thierry Reding Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-5-thierry.reding@gmail.com Signed-off-by: Ulf Hansson commit 07548a391df07637a057caa5bd07cafb6157fe79 Author: Thierry Reding Date: Tue Dec 6 17:59:42 2022 +0100 mmc: sdhci-tegra: Sort includes alphabetically Sort includes alphabetically to make it easier to add new ones subsequently. Acked-by: Adrian Hunter Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-4-thierry.reding@gmail.com Signed-off-by: Ulf Hansson commit 493c9b68d1d8765b2f8740a06c169e90a947159f Author: Thierry Reding Date: Tue Dec 6 17:59:41 2022 +0100 iommu/tegra: Add tegra_dev_iommu_get_stream_id() helper Access to the internals of struct iommu_fwspec by non-IOMMU drivers is discouraged. Many drivers for Tegra SoCs, however, need access to their IOMMU stream IDs so that they can be programmed into various hardware registers. Formalize this access into a common helper to make it easier to audit and maintain. Acked-by: Robin Murphy Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-3-thierry.reding@gmail.com Signed-off-by: Ulf Hansson commit 495b637f640b7f87ab42f3cc829e35ea76a1f3eb Author: Thierry Reding Date: Tue Dec 6 17:59:40 2022 +0100 iommu: Add note about struct iommu_fwspec usage This structure is to be considered private to the IOMMU API. Except for very few exceptions, IOMMU consumer drivers should treat this as opaque data. Acked-by: Joerg Roedel Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20221206165945.3551774-2-thierry.reding@gmail.com Signed-off-by: Ulf Hansson commit a234442c0b51163841762748e7e22c3718337923 Author: Brian Norris Date: Mon Dec 5 16:04:06 2022 -0800 mmc: sdhci-brcmstb: Resolve "unused" warnings with CONFIG_OF=n With W=1, we can see this gcc warning: drivers/mmc/host/sdhci-brcmstb.c:182:34: warning: ‘sdhci_brcm_of_match’ defined but not used [-Wunused-const-variable=] 182 | static const struct of_device_id sdhci_brcm_of_match[] = { | ^~~~~~~~~~~~~~~~~~~ Rather than play around more with #ifdef's, the simplest solution is to just mark this __maybe_unused. Fixes: 50bfe185c42a ("mmc: sdhci-brcmstb: Allow building with COMPILE_TEST") Reported-by: kernel test robot Link: https://lore.kernel.org/all/202212060700.NjMecjxS-lkp@intel.com/ Signed-off-by: Brian Norris Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20221205160353.1.I5fa28f1045f17fb9285d507accf139f8b2a8f4b5@changeid Signed-off-by: Ulf Hansson commit 491ad767de23c3a477405e02436e5e0071830b4c Author: Krzysztof Kozlowski Date: Sun Dec 4 10:47:17 2022 +0100 dt-bindings: mmc: sdhci-msm: allow dma-coherent SM8350, SM8450 and SM8550 SDHCI controllers for SD card are marked with dma-coherent, so allow it. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221204094717.74016-5-krzysztof.kozlowski@linaro.org Signed-off-by: Ulf Hansson commit b64c4d8589297eaf2e94d56b7e07547209714c48 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:47:16 2022 +0100 dt-bindings: mmc: sdhci-msm: drop properties mentioned in common MMC There is no need to explicitly list properties already brought by mmc-controller.yaml schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221204094717.74016-4-krzysztof.kozlowski@linaro.org Signed-off-by: Ulf Hansson commit 2ba206a2ff4a5cd60068f52453cfa2bbfa45bed6 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:47:15 2022 +0100 dt-bindings: mmc: sdhci-msm: cleanup style Drop unnecessary quotes from $ref. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221204094717.74016-3-krzysztof.kozlowski@linaro.org Signed-off-by: Ulf Hansson commit e589522d7aea0d8b738243935074a5916cd3b568 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:47:14 2022 +0100 dt-bindings: mmc: sdhci-am654: cleanup style Cleanup coding style without functional changes: 1. Drop unnecessary quotes from $ref. 2. Use simple enum for compatible enumeration and sort entries. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221204094717.74016-2-krzysztof.kozlowski@linaro.org Signed-off-by: Ulf Hansson commit 07f8f060edd759f6f1bbaea3c078fe526f4dcbf9 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:47:13 2022 +0100 dt-bindings: mmc: sdhci: document sdhci-caps and sdhci-caps-mask The Linux SDHCI driver core reads 'sdhci-caps' and 'sdhci-caps-mask' properties and few devices already use it (e.g. Qualcomm SM8450), so add them to a shared SDHCI bindings. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221204094717.74016-1-krzysztof.kozlowski@linaro.org Signed-off-by: Ulf Hansson commit 4a44cd249604e29e7b90ae796d7692f5773dd348 Author: Deren Wu Date: Sun Dec 4 16:24:16 2022 +0800 mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here. Ensure that we mark current as TASK_RUNNING for sleepable context. [ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [] sdio_irq_thread+0x17d/0x5b0 [ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160 [ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1 [ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 77.554912] RIP: 0010:__might_sleep+0x116/0x160 [ 77.554920] RSP: 0018:ffff888107b7fdb8 EFLAGS: 00010282 [ 77.554923] RAX: 0000000000000000 RBX: ffff888118c1b740 RCX: 0000000000000000 [ 77.554926] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffed1020f6ffa9 [ 77.554928] RBP: ffff888107b7fde0 R08: 0000000000000001 R09: ffffed1043ea60ba [ 77.554930] R10: ffff88821f5305cb R11: ffffed1043ea60b9 R12: ffffffff93aa3a60 [ 77.554932] R13: 000000000000011b R14: 7fffffffffffffff R15: ffffffffc0558660 [ 77.554934] FS: 0000000000000000(0000) GS:ffff88821f500000(0000) knlGS:0000000000000000 [ 77.554937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.554939] CR2: 00007f8a44010d68 CR3: 000000024421a003 CR4: 00000000003706e0 [ 77.554942] Call Trace: [ 77.554944] [ 77.554952] mutex_lock+0x78/0xf0 [ 77.554973] vub300_enable_sdio_irq+0x103/0x3c0 [vub300] [ 77.554981] sdio_irq_thread+0x25c/0x5b0 [ 77.555006] kthread+0x2b8/0x370 [ 77.555017] ret_from_fork+0x1f/0x30 [ 77.555023] [ 77.555025] ---[ end trace 0000000000000000 ]--- Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Deren Wu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87dc45b122d26d63c80532976813c9365d7160b3.1670140888.git.deren.wu@mediatek.com Signed-off-by: Ulf Hansson commit 292d0426d70db2d4fd47b4ecd42188f7443bf583 Author: Kamal Dasu Date: Fri Dec 2 16:21:19 2022 -0500 MAINTAINERS: Update maintainer for SDHCI Broadcom BRCMSTB driver Taking over as upstream maintainer for Broadcom SDHCI driver from Al Cooper. Signed-off-by: Kamal Dasu Acked-by: Florian Fainelli Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221202212119.43214-1-kdasu.kdev@gmail.com Signed-off-by: Ulf Hansson commit c8d2d76d7646dc9b2d377699f68dce5403ad9b80 Author: Andy Tang Date: Fri Dec 2 15:59:05 2022 +0800 mmc: sdhci-of-esdhc: limit the SDHC clock frequency The highest clock frequency for eMMC HS200 mode on ls1043a is 116.7Mhz according to its specification. So add the limit to gate the frequency. Signed-off-by: Andy Tang Link: https://lore.kernel.org/r/20221202075905.25363-1-andy.tang@nxp.com Signed-off-by: Ulf Hansson commit 496182a389627a60d1b12be32d1640b14c678b8b Author: zhang songyi Date: Fri Dec 2 10:31:57 2022 +0800 mmc: sdhci: Remove unneeded semicolon The semicolon after the "}" is unneeded. Signed-off-by: zhang songyi Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/202212021031575255977@zte.com.cn Signed-off-by: Ulf Hansson commit fc02e2b52389c8fde02852b2f959c0b45f042bbd Author: Zhen Lei Date: Wed Nov 30 21:49:20 2022 +0800 mmc: core: Normalize the error handling branch in sd_read_ext_regs() Let's use pr_err() to output the error messages and let's extend a comment to clarify why returning 0 (success) in one case make sense. Fixes: c784f92769ae ("mmc: core: Read the SD function extension registers for power management") Signed-off-by: Zhen Lei [Ulf: Clarified the comment and the commit-msg] Link: https://lore.kernel.org/r/20221130134920.2109-1-thunder.leizhen@huawei.com Signed-off-by: Ulf Hansson commit 04280473b5da4199b1abbac2aa08fd9109e20f82 Author: Christoph Niedermaier Date: Wed Nov 30 13:10:33 2022 +0100 dt-bindings: mmc: Remove comment on wakeup-source property The current comment on wakeup-source is a little confusing because the word deprecated can be interpreted at first glance to mean that wakeup-source is deprecated. Also mentioning the obsolete property confuses more than it helps. Therefore, the comment should be removed completely because the enable-sdio-wakeup property is not used in any current DTs. Also remove enable-sdio-wakeup reference in wakeup-source.txt Signed-off-by: Christoph Niedermaier Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221130121033.7270-1-cniedermaier@dh-electronics.com Signed-off-by: Ulf Hansson commit beaba9e46cffca7fcf00bec7cf52fe52a9dcf918 Author: Adrian Hunter Date: Mon Nov 28 15:32:58 2022 +0200 mmc: sdhci: Avoid unnecessary ->set_clock() To avoid glitches on the clock line, the card clock is disabled when making timing changes. Do not do that separately for HISPD and UHS settings. Tested-by: Haibo Chen Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221128133259.38305-4-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit e026a3f9172f5c9aacff270b929a166c3ea1b6f7 Author: Michael Wu Date: Mon Nov 28 17:38:47 2022 +0800 mmc: mmc-hsq: Use fifo to dispatch mmc_request Current next_tag selection will cause a large delay in some requests and destroy the scheduling results of the block scheduling layer. Because the issued mrq tags cannot ensure that each time is sequential, especially when the IO load is heavy. In the fio performance test, we found that 4k random read data was sent to mmc_hsq to start calling request_atomic It takes nearly 200ms to process the request, while mmc_hsq has processed thousands of other requests. So we use fifo here to ensure the first in, first out feature of the request and avoid adding additional delay to the request. Reviewed-by: Wenchao Chen Signed-off-by: Michael Wu Link: https://lore.kernel.org/r/20221128093847.22768-1-michael@allwinnertech.com Signed-off-by: Ulf Hansson commit 4f431a047a5c8698ed4b67e2760cfbeb5fffb69d Author: Jiasheng Jiang Date: Sat Nov 26 09:25:58 2022 +0800 memstick/ms_block: Add check for alloc_ordered_workqueue As the alloc_ordered_workqueue may return NULL pointer, it should be better to add check for the return value. Moreover, the msb->io_queue should be freed if error occurs later. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20221126012558.34374-1-jiasheng@iscas.ac.cn Signed-off-by: Ulf Hansson commit 5c5301a147df77eb4479be9af74f65a334206602 Author: Ye Bin Date: Sat Nov 26 18:25:20 2022 +0800 mmc: core: refactor debugfs code Now, CONFIG_DEBUG_FS is scattered in various functions, to make code clean centralized processing CONFIG_DEBUG_FS in mmc debugfs module. Signed-off-by: Ye Bin Link: https://lore.kernel.org/r/20221126102520.2824574-1-yebin@huaweicloud.com Signed-off-by: Ulf Hansson commit b98e7e8daf0ebab9dcc36812378a71e1be0b5089 Author: ChanWoo Lee Date: Thu Nov 24 17:00:31 2022 +0900 mmc: Avoid open coding by using mmc_op_tuning() Replace code with the already defined function. No functional changes. Signed-off-by: ChanWoo Lee Reviewed-by: Adrian Hunter Link: https://lore.kernel.org/r/20221124080031.14690-1-cw9316.lee@samsung.com Signed-off-by: Ulf Hansson commit 1e8cb505f3d4a3e9c31238a45509a17e688525a0 Author: Yang Li Date: Wed Nov 23 10:12:21 2022 +0800 mmc: Remove unneeded semicolon ./drivers/mmc/host/sunplus-mmc.c:321:2-3: Unneeded semicolon Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3238 Reported-by: Abaci Robot Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20221123021221.9646-1-yang.lee@linux.alibaba.com Signed-off-by: Ulf Hansson commit e81bdae440fa7cc7dcbfb4f0fcfafb1f4350bc31 Author: Christian Löhle Date: Sun Nov 27 17:46:31 2022 +0000 mmc: core: Remove non-data R1B ioctl workaround The workaround of pretending R1B non-data transfers are data transfers in order for the busy timeout to be respected by the host controller driver is removed. It wasn't useful in a long time. Initially the workaround ensured that R1B commands did not time out by setting the data timeout to be the command timeout in commit cb87ea28ed9e ("mmc: core: Add mmc CMD+ACMD passthrough ioctl"). This was moved inside an if-clause with idata->buf_bytes being set in commit 4d6144de8ba2 ("mmc: core: check for zero length ioctl data"). Since the workaround is now inside the idata->buf_bytes clause and intended to fix R1B non-data transfers, that do not have buf_bytes set, we can remove the workaround altogether. This was dead code, since data transfers doesn't use R1B commands. Signed-off-by: Christian Loehle Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/57d4aceb25254e448bd3e575bd99b0c2@hyperstone.com Signed-off-by: Ulf Hansson commit ffbace4378dc1aedb02248bbbe5d231754e4df3a Author: Wolfram Sang Date: Tue Nov 22 09:05:54 2022 +0100 mmc: renesas_sdhi: use plain numbers for end_flags Linux *_bit accessors take plain bit numbers, no need for BIT(). Fixes: c330601c9c93 ("mmc: renesas_sdhi: take DMA end interrupts into account") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20221122080554.4468-1-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 696b66ac26ef953aed5783ef26a252ec8f207013 Author: wangdicheng Date: Wed Dec 7 16:20:36 2022 +0800 ALSA: usb-audio: add the quirk for KT0206 device Add relevant information to the quirks-table.h file. The test passes and the sound source file plays normally. Signed-off-by: wangdicheng Cc: Link: https://lore.kernel.org/r/SG2PR02MB587849631CB96809CF90DBED8A1A9@SG2PR02MB5878.apcprd02.prod.outlook.com Signed-off-by: Takashi Iwai commit 31b573946ea55e1ea0e08ae8e83bcf879b30f83a Author: Jiao Zhou Date: Tue Dec 6 13:53:11 2022 -0500 ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list HDMI audio is not working on the HP EliteDesk 800 G6 because the pin is unconnected. This issue can be resolved by using the 'hdajackretask' tool to override the unconnected pin to force it to connect. Signed-off-by: Jiao Zhou Cc: Link: https://lore.kernel.org/r/20221206185311.3669950-1-jiaozhou@google.com Signed-off-by: Takashi Iwai commit 4e268fed8b1861616af28f9cfb4eed8ca5d7af6c Author: Tony Huang Date: Mon Nov 21 18:06:49 2022 +0800 mmc: Add mmc driver for Sunplus SP7021 This is a patch for mmc driver for Sunplus SP7021 SOC. Supports eMMC 4.41 DDR 104MB/s speed mode. Acked-by: Arnd Bergmann Signed-off-by: Tony Huang Link: https://lore.kernel.org/r/c92d67596f3cc10d41585b9ab82be7da2cc4c9d8.1669023361.git.tonyhuang.sunplus@gmail.com Signed-off-by: Ulf Hansson commit 0f55b162729feee076e1bbb3a4c588a09aa73641 Author: Tony Huang Date: Mon Nov 21 18:06:48 2022 +0800 dt-binding: mmc: Add mmc yaml file for Sunplus SP7021 Add MMC YAML file for Sunplus SP7021. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Tony Huang Link: https://lore.kernel.org/r/8c8fbc29524819d8ab45a4fe75311b3b7b567650.1669023361.git.tonyhuang.sunplus@gmail.com Signed-off-by: Ulf Hansson commit afc9b96b505ca04f3d8ce7bd2a2ca16b39855198 Author: Wolfram Sang Date: Sun Nov 20 12:34:57 2022 +0100 mmc: renesas_sdhi: use new convenience macro from MMC core Makes the code more readable. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221120113457.42010-5-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 48c917fa998c00980167ba732c8ccbf603c9fb70 Author: Wolfram Sang Date: Sun Nov 20 12:34:56 2022 +0100 mmc: renesas_sdhi: add helper to access quirks Add a macro to check for a quirk because it a) ensures that the check for non-empty 'quirks' struct is not forgotten and b) is easier to read. Convert existing quirk access as well. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221120113457.42010-4-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 0da69dd2155019ed4c444ede0e79ce7a4a6af627 Author: Wolfram Sang Date: Sun Nov 20 12:34:55 2022 +0100 mmc: renesas_sdhi: better reset from HS400 mode Up to now, HS400 adjustment mode was only disabled on soft reset when a calibration table was in use. It is safer, though, to disable it as soon as the instance has an adjustment related quirk set, i.e. bad taps or a calibration table. Signed-off-by: Wolfram Sang Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221120113457.42010-3-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 3d4f9898c1c74323dd61d6a8a0efca9401232ad4 Author: Wolfram Sang Date: Sun Nov 20 12:34:54 2022 +0100 mmc: renesas_sdhi: alway populate SCC pointer We need the SCC pointer to reset the device, so populate it even when we don't need it for tuning. Fixes: 45bffc371fef ("mmc: renesas_sdhi: only reset SCC when its pointer is populated") Signed-off-by: Takeshi Saito Signed-off-by: Takeshi Kihara Signed-off-by: Wolfram Sang Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221120113457.42010-2-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit fa30beccca969ad2fb9431faf1f12ecb6fdb14ce Author: ye xingchen Date: Thu Nov 17 15:24:11 2022 +0800 mmc: pwrseq: Use device_match_of_node() Replace the open-code with device_match_of_node(). Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202211171524116446204@zte.com.cn Signed-off-by: Ulf Hansson commit d0ce6aca9ddf1177d9f2757c9fed502682934343 Author: Dinh Nguyen Date: Mon Nov 14 17:02:16 2022 -0600 clk: socfpga: remove the setting of clk-phase for sdmmc_clk Now that the SDMMC driver supports setting the clk-phase, we can remove the need to do it in the clock driver. Acked-by: Stephen Boyd Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20221114230217.202634-5-dinguyen@kernel.org Signed-off-by: Ulf Hansson commit ef87bd81cb881377c1eaf512167b0522c825b012 Author: Dinh Nguyen Date: Mon Nov 14 17:02:15 2022 -0600 mmc: dw_mmc-pltfm: socfpga: add method to configure clk-phase The clock-phase settings for the SDMMC controller in the SoCFPGA platforms reside in a register in the System Manager. Add a method to access that register through the syscon interface. Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20221114230217.202634-4-dinguyen@kernel.org Signed-off-by: Ulf Hansson commit ccfa2466a456f70c0bab0cd0b64d6c8996141d2e Author: Dinh Nguyen Date: Mon Nov 14 17:02:12 2022 -0600 dt-bindings: mmc: synopsys-dw-mshc: document "altr,sysmgr-syscon" Document the optional "altr,sysmgr-syscon" binding that is used to access the System Manager register that controls the SDMMC clock phase. Signed-off-by: Dinh Nguyen Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221114230217.202634-1-dinguyen@kernel.org Signed-off-by: Ulf Hansson commit 63abdf7237a7ab9e3ee30782d64d968a087c7e7a Author: Charl Liu Date: Fri Nov 11 04:23:14 2022 -0800 mmc: sdhci: Fix the SD tuning issue that the SDHCI_TRANSFER_MODE is cleared incorrectly When cmd->opcode == MMC_SEND_TUNING_BLOCK, the SDHCI_TRANSFER_MODE should also be kept Signed-off-by: Charl Liu Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221111122314.307-1-charl.liu@bayhubtech.com Signed-off-by: Ulf Hansson commit 43c487c28f9c353a9690f975e7b7dc56be144427 Author: Wolfram Sang Date: Wed Nov 2 13:54:30 2022 +0100 mmc: tmio: remove 'alignment_shift' from platform data There is only one alignment shift for one type of Renesas SDHI. Encode it directly in its DMA driver to reduce complexity and ease further simplifications. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20221102125430.28466-3-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 8840e1c13cb40d2a207f875f3c730f399a21d4d4 Author: Wolfram Sang Date: Wed Nov 2 13:54:29 2022 +0100 mmc: tmio: remove tmio_mmc_k(un)map_atomic helpers After a8402aed8ca5 ("mmc: tmio_mmc_core: Remove local_irq_{save,restore}() around k[un]map_atomic()") and ac91578a6812 ("mmc: tmio_mmc_core: Replace kmap_atomic() with kmap_local_page()"), the helpers contain just a single call. Putting it directly in the code makes it actually more readable. More so, because we now avoid the 'offset' calculation when mapping/unmapping and just use it when we need it in the copy routines. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20221102125430.28466-2-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit c330601c9c93392000c077d973b182cc0164b9ac Author: Wolfram Sang Date: Thu Oct 6 21:04:51 2022 +0200 mmc: renesas_sdhi: take DMA end interrupts into account So far, we have been relying on access_end interrupts only to mark DMA transfers as done implying that DMA end interrupts have occurred by then anyhow. On some SoCs under some conditions, this turned out to be not enough. So, we enable DMA interrupts as well and make sure that both events, DMA irq and access_end irq, have happened before finishing the DMA transfer. Signed-off-by: Wolfram Sang Tested-by: Duy Nguyen Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221006190452.5316-6-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit ec9e80ae1719de541c719116a1ca0a0c70e9240c Author: Wolfram Sang Date: Thu Oct 6 21:04:50 2022 +0200 mmc: renesas_sdhi: add quirk for broken register layout Some early Gen3 SoCs have the DTRANEND1 bit at a different location than all later SoCs. Because we need the bit soon, add a quirk so we know which bit to use. Signed-off-by: Wolfram Sang Tested-by: Duy Nguyen Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221006190452.5316-5-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit af728d7ae20483add9f8d3c81280dc6298a0aa2e Author: Wolfram Sang Date: Thu Oct 6 21:04:49 2022 +0200 mmc: tmio: add callback for dma irq We don't want to rely only on the access_end irq in the future, so implement a callback for dma irqs. Signed-off-by: Wolfram Sang Tested-by: Duy Nguyen Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221006190452.5316-4-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 7f3ea248cd1b2ea9b49f6f3523250bc8e622dd5e Author: Wolfram Sang Date: Thu Oct 6 21:04:48 2022 +0200 mmc: renesas_sdhi: improve naming of DMA struct Commit 058db2868cd8 ("mmc: tmio, renesas_sdhi: move struct tmio_mmc_dma to renesas_sdhi.h") is correct. The DMA struct should be prefixed with 'renesas_sdhi' to avoid confusion about is namespace. Fix some indentation while here. Signed-off-by: Wolfram Sang Tested-by: Duy Nguyen Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221006190452.5316-3-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit a8687078fc5e7606b3e91f32cb6ba2574d83736d Author: Wolfram Sang Date: Thu Oct 6 21:04:47 2022 +0200 mmc: renesas_sdhi: remove accessor function for internal_dmac This accessor function does not help readability but makes it worse. Because I soon need to read from the registers as well and don't want to add another function like this, I chose to remove the existing one and use the accessor directly. I also switch from writeq to writel because no 64 bit register is actually involved. Signed-off-by: Wolfram Sang Tested-by: Duy Nguyen Tested-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20221006190452.5316-2-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit aae9d3a440736691b3c1cb09ae2c32c4f1ee2e67 Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:33 2022 +0900 mmc: f-sdh30: Add quirks for broken timeout clock capability There is a case where the timeout clock is not supplied to the capability. Add a quirk for that. Signed-off-by: Kunihiko Hayashi Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20221111081033.3813-7-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit e2d2dcc82504b1beee9f2542e8b43b8c43829302 Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:32 2022 +0900 mmc: f-sdh30: Add support for non-removable media To use F_SDH30 for non-removable meda like eMMC, need to enable FORCE_CARD_INSERT bit to skip the delay for detection. Signed-off-by: Kunihiko Hayashi Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20221111081033.3813-6-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit 5914a9b16c842056c946665a39aa0ac5923a2d1f Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:31 2022 +0900 mmc: f-sdh30: Add compatible string for Socionext F_SDH30_E51 Add a compatible string for Socionext F_SDH30_E51. Since this IP is transferred to Socionext, so append it to Copyright and MODULE_AUTHOR as vendor name. F_SDH30_E51 is a higher version of F_SDH30 that supports eMMC 5.1, though, currently there are no new features for this IP in this driver, just add the compatible string. Signed-off-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20221111081033.3813-5-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit 72e7f0cf8d99af8808d1b8fb31bef6ce864a146a Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:30 2022 +0900 dt-bindings: sdhci-fujitsu: Add compatible string for F_SDH30_E51 Add a compatible string for F_SDH30_E51 IP to the documentation. Since this IP is transferred to Socionext, so append it as vendor name. Signed-off-by: Kunihiko Hayashi Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221111081033.3813-4-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit bd724b279f554629e5f74d50a43e2435791482e1 Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:29 2022 +0900 mmc: f-sdh30: Add reset control support Add reset control support for F_SDH30 controller. This is optional. Signed-off-by: Kunihiko Hayashi Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20221111081033.3813-3-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit cb7e1e931161962b298364ca3ad9a4dd3143851b Author: Kunihiko Hayashi Date: Fri Nov 11 17:10:28 2022 +0900 dt-bindings: mmc: Convert sdhci-fujitsu to JSON schema Convert the Fujitsu SDHCI controller IP binding to DT schema format, and add resets property as optional to support reset control. Signed-off-by: Kunihiko Hayashi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221111081033.3813-2-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit 4b323f02b6e8df1b04292635ef829e7f723bf50e Author: Yu Zhe Date: Thu Nov 10 15:28:19 2022 +0800 mmc: mtk-sd: fix two spelling mistakes in comment spelling mistake fix : "alreay" -> "already" "checksume" -> "checksum" Signed-off-by: Yu Zhe Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221110072819.11530-1-yuzhe@nfschina.com Signed-off-by: Ulf Hansson commit 974b8219df36f80fdaf7a64ba7b7992320cd5744 Author: Abel Vesa Date: Wed Nov 16 11:15:24 2022 +0100 dt-bindings: mmc: sdhci-msm: Document the SM8550 compatible Document the compatible for SDHCI on SM8550. Signed-off-by: Abel Vesa Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221114-narmstrong-sm8550-upstream-sdhci-v1-0-797864a30e71@linaro.org Signed-off-by: Ulf Hansson commit b78efae3a3fcf970db0c516abaa3d30b377d0440 Author: Konrad Dybcio Date: Wed Nov 16 13:36:09 2022 +0100 dt-bindings: mmc: sdhci-msm: Document SM8350 SDHCI Document the SDHCI on SM8350. Acked-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20221116123612.34302-1-konrad.dybcio@linaro.org Signed-off-by: Ulf Hansson commit ac4a171b448bdd3b33a57c61c23edcc289324d5f Author: Konrad Dybcio Date: Mon Nov 14 11:50:41 2022 +0100 dt-bindings: mmc: sdhci-msm: Document the SM6375 compatible Document the compatible for SDHCI on SM6375. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20221114105043.36698-2-konrad.dybcio@linaro.org Signed-off-by: Ulf Hansson commit b38a20f29a49ae04d23750d104b25400b792b98c Author: Yang Yingliang Date: Wed Nov 9 21:35:39 2022 +0800 mmc: mmci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221109133539.3275664-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit dc5b9b50fc9d1334407e316e6e29a5097ef833bd Author: Yang Yingliang Date: Wed Nov 9 21:32:37 2022 +0800 mmc: wbsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, other resources also need be released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221109133237.3273558-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit e4e46fb61e3bb4628170810d3f2b996b709b90d9 Author: Yang Yingliang Date: Tue Nov 8 21:09:49 2022 +0800 mmc: via-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: f0bf7f61b840 ("mmc: Add new via-sdmmc host controller driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221108130949.1067699-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e Author: Yang Yingliang Date: Tue Nov 8 20:34:17 2022 +0800 mmc: meson-gx: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: 51c5d8447bd7 ("MMC: meson: initial support for GX platforms") Signed-off-by: Yang Yingliang Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20221108123417.479045-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit a525cad241c339ca00bf7ebf03c5180f2a9b767c Author: Yang Yingliang Date: Tue Nov 8 20:13:16 2022 +0800 mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path wihch will call mmc_free_host(). Fixes: a45c6cb81647 ("[ARM] 5369/1: omap mmc: Add new omap hsmmc controller for 2430 and 34xx, v3") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221108121316.340354-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 9e6e8c43726673ca2abcaac87640b9215fd72f4c Author: Yang Yingliang Date: Tue Nov 8 20:28:19 2022 +0800 mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and calling mmc_free_host() in the error path. Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC controllers") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221108122819.429975-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 0b278ea226b103a291aed38e950fe032148f8c9b Author: Jagan Teki Date: Tue Nov 8 09:43:52 2022 +0530 dt-bindings: mmc: rockchip-dw-mshc: Add power-domains property Document power-domains property in rockchip dw controller. RV1126 is using eMMC and SDIO power domains but SDMMC is not. Signed-off-by: Jagan Teki Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221108041400.157052-3-jagan@edgeble.ai Signed-off-by: Ulf Hansson commit 5cb7d23761c87cd490a59dc4bb0d618c92b711c5 Author: Sebastian Reichel Date: Mon Nov 7 18:33:10 2022 +0100 dt-bindings: mmc: sdhci-of-dwcmhsc: Add reset support Properly describe reset related properties in the binding. Signed-off-by: Sebastian Reichel Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221107173310.60503-1-sebastian.reichel@collabora.com Signed-off-by: Ulf Hansson commit 5c1a2b77cd1b59112cf22b3e338f7e416797ad32 Author: Gabriel Somlo Date: Mon Nov 7 10:55:16 2022 -0500 mmc: litex_mmc: ensure `host->irq == 0` if polling Ensure the flag is explicitly set to 0 if we determine that polling is needed during driver probe, to cover all possible cases. Fixes: 92e099104729 ("mmc: Add driver for LiteX's LiteSDCard interface") Signed-off-by: Gabriel Somlo Link: https://lore.kernel.org/r/20221107155516.2535912-1-gsomlo@gmail.com Signed-off-by: Ulf Hansson commit 29276d56f6ed138db0f38cd31aedc0b725c8c76c Author: Yang Yingliang Date: Tue Nov 1 14:30:23 2022 +0800 mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, clk_disable_unprepare() also needs be called. Fixes: 3a96dff0f828 ("mmc: SD/MMC Host Controller for Wondermedia WM8505/WM8650") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-10-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 0613ad2401f88bdeae5594c30afe318e93b14676 Author: Yang Yingliang Date: Tue Nov 1 14:30:22 2022 +0800 mmc: vub300: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, the timer added before mmc_add_host() needs be del. And this patch fixes another missing call mmc_free_host() if usb_control_msg() fails. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-9-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit f670744a316ea983113a65313dcd387b5a992444 Author: Yang Yingliang Date: Tue Nov 1 14:30:21 2022 +0800 mmc: toshsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, free_irq() also needs be called. Fixes: a5eb8bbd66cc ("mmc: add Toshiba PCI SD controller driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-8-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 Author: Yang Yingliang Date: Tue Nov 1 14:30:20 2022 +0800 mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 0c87db77423a282b3b38b8a6daf057b822680516 Author: Yang Yingliang Date: Tue Nov 1 14:30:19 2022 +0800 mmc: rtsx_pci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, beside, runtime PM also needs be disabled. Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-6-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 80e1ef3afb8bfbe768380b70ffe1b6cab87d1a3b Author: Yang Yingliang Date: Tue Nov 1 14:30:18 2022 +0800 mmc: pxamci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, ->exit() need be called to uninit the pdata. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-5-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit cde600af7b413c9fe03e85c58c4279df90e91d13 Author: Yang Yingliang Date: Tue Nov 1 14:30:17 2022 +0800 mmc: mxcmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: d96be879ff46 ("mmc: Add a MX2/MX3 specific SDHC driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-4-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 0ca18d09c744fb030ae9bc5836c3e357e0237dea Author: Yang Yingliang Date: Tue Nov 1 14:30:16 2022 +0800 mmc: moxart: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-3-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit e93d1468f429475a753d6baa79b853b7ee5ef8c0 Author: Yang Yingliang Date: Tue Nov 1 14:30:15 2022 +0800 mmc: alcor: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path. Fixes: c5413ad815a6 ("mmc: add new Alcor Micro Cardreader SD/MMC driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221101063023.1664968-2-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit 7b438d0377fbd520b475a68bdd9de1692393f22d Author: Mengqi Zhang Date: Sun Nov 6 11:39:24 2022 +0800 mmc: mtk-sd: add Inline Crypto Engine clock control Add crypto clock control and ungate it before CQHCI init. Signed-off-by: Mengqi Zhang Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221106033924.9854-2-mengqi.zhang@mediatek.com Signed-off-by: Ulf Hansson commit 5c133688a1bfc110ed67de3ddaafa04facacbd5f Author: Mengqi Zhang Date: Sun Nov 6 11:39:26 2022 +0800 dt-bindings: mmc: mtk-sd: add Inline Crypto Engine clock Add optional crypto clock of the Inline Crypto Engine of Mediatek SoCs. Signed-off-by: Mengqi Zhang Reviewed-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221106033924.9854-3-mengqi.zhang@mediatek.com Signed-off-by: Ulf Hansson commit e97ee6f816c04e6a6fff875f5553c52ffd8b84d4 Author: AngeloGioacchino Del Regno Date: Fri Nov 4 18:21:18 2022 +0100 dt-bindings: mmc: sdhci-msm: Document compatible for MSM8976 Document the compatible for the SDHCI controller(s) found on MSM8976. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221104172122.252761-6-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit ff50df9ac28b5a6a93ab8bed58c74ad8f12c756a Author: Adrian Hunter Date: Wed Nov 2 14:01:05 2022 +0200 mmc: Remove duplicate words in comments Remove duplicate words in comments found using the following commands: pcregrep --color=always -n \ '([^a-zA-Z_])([a-zA-Z_]+)[[:space:]]+\2[^a-zA-Z_]' \ drivers/mmc/host/*.[ch] drivers/mmc/core/*.[ch] \ include/linux/mmc/*.h \ include/uapi/linux/mmc/*.h | \ grep -v 'long long' pcregrep --color=always -n -M \ '([^a-zA-Z_])([a-zA-Z_]+)[ \t]*\n[[:space:]*]+\2[^a-zA-Z_]' \ drivers/mmc/host/*.[ch] \ drivers/mmc/core/*.[ch] \ include/linux/mmc/*.h \ include/uapi/linux/mmc/*.h Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221102120105.5747-1-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 654993b3e1eb7ce22e5d5bf5df95730c3fb7013a Author: Matthias Schiffer Date: Tue Nov 1 11:52:42 2022 +0100 mmc: sdhci_am654: Use dev_err_probe() for mmc_of_parse() return code Checking phandle references like mmc-pwrseq can result in -EPROBE_DEFER. Signed-off-by: Matthias Schiffer Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221101105242.2019036-1-matthias.schiffer@ew.tq-group.com Signed-off-by: Ulf Hansson commit dc4e9e2aa82a697ff1fccf6dbdd9f648afc7d71a Author: Brian Norris Date: Fri Oct 28 15:56:37 2022 -0700 mmc: sdhci-pci: Set PROBE_PREFER_ASYNCHRONOUS This driver often takes on the order of 10ms to start, but in some cases as much as 190ms. It shouldn't have many cross-device dependencies to race with, nor racy access to shared state with other drivers, so this should be a relatively low risk change. We've done similarly with a variety of other MMC host drivers already. This driver was pinpointed as part of a survey of top slowest initcalls (i.e., are built in, and probing synchronously) on a lab of ChromeOS systems. Signed-off-by: Brian Norris Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221028155633.1.I6c4bfb31e88fad934e7360242cb662e01612c1bb@changeid Signed-off-by: Ulf Hansson commit 4fb2786961c517d0a6e4e8bf947d6f7259155d6a Author: Haibo Chen Date: Fri Oct 28 17:04:29 2022 +0800 mmc: sdhci-esdhc-imx: reset the tuning logic before execute tuning For standard tuning method on usdhc, the previous tuning result can impact current tuning result, let current tuning can't set the correct delay cell. And from the logic, this is also reasonable for manual tuning method. So reset the tuning logic before execute tuning. To avoid compile issue, this patch also move the esdhc_reset_tuning() upper. Find this issue when support SDIO WiFi in band wakeup feature. After system resume back, will do re-tuning, but then meet data CRC error. Do not meet this issue on SD/eMMC, because we already call esdhc_reset_tuning() when config the legency ios, and SD/eMMC need to re-init when system resume back, but SDIO device don't do re-init if it has MMC_PM_KEEP_POWER pm_flags. Signed-off-by: Haibo Chen Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1666947869-7904-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 08b863bb034cfda73ac2d37faab9d54185f04231 Author: Brian Norris Date: Wed Oct 26 12:42:09 2022 -0700 mmc: sdhci-*: Convert drivers to new sdhci_and_cqhci_reset() An earlier patch ("mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI") does these operations for us. I keep these as a separate patch, since the earlier patch is a prerequisite to some important bugfixes that need to be backported via linux-stable. Signed-off-by: Brian Norris Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221026124150.v4.7.Ia91f031f5f770af7bd2ff3e28b398f277606d970@changeid Signed-off-by: Ulf Hansson commit 0614b0ae13c23d14907369085554eaecbdba8f7d Author: Sai Krishna Potthuri Date: Wed Oct 19 11:18:57 2022 +0530 mmc: sdhci-of-arasan: Add support for dynamic configuration Add dynamic configuration support for Xilinx ZynqMP which takes care of configuring the SD secure space configuration registers using EEMI APIs, performing SD reset assert and deassert. High level sequence: - Check for the PM dynamic configuration support, if no error proceed with SD dynamic configurations(next steps) otherwise skip the dynamic configuration. - Put the SD Controller in reset. - Configure SD Fixed configurations. - Configure the SD Slot Type. - Configure the BASE_CLOCK. - Configure the 8-bit support. - Bring the SD Controller out of reset. - Wait for 1msec delay. Signed-off-by: Sai Krishna Potthuri Acked-by: Michal Simek Link: https://lore.kernel.org/r/20221019054857.8286-1-sai.krishna.potthuri@amd.com Signed-off-by: Ulf Hansson commit 24e961b93d292d0dd6380213d22a071a99ea787d Author: Sam Shih Date: Tue Oct 25 15:29:53 2022 +0200 mmc: mediatek: add support for MT7986 SoC Adding mt7986 own characteristics and of_device_id to have support of MT7986 SoC. Signed-off-by: Sam Shih Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20221025132953.81286-7-linux@fw-web.de Signed-off-by: Ulf Hansson commit 1b845c5af4728085eeea9582e2fcbe4c8104fa5e Author: Sam Shih Date: Tue Oct 25 15:29:49 2022 +0200 dt-bindings: mmc: Add support for Mediatek MT7986 This commit adds dt-binding documentation of mmc for Mediatek MT7986 SoC Platform. Add SoC specific section for defining clock configuration. Signed-off-by: Sam Shih Signed-off-by: Frank Wunderlich Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221025132953.81286-3-linux@fw-web.de Signed-off-by: Ulf Hansson commit 0b36b7cd3f1f3df707c98de65b764294c02cc8cc Author: Nícolas F. R. A. Prado Date: Tue Oct 25 15:29:48 2022 +0200 dt-bindings: mmc: mtk-sd: Set clocks based on compatible The binding was describing a single clock list for all platforms, but that's not really suitable: Most platforms using at least 2 clocks (source, hclk), some of them a third "source_cg". Mt2712 requires an extra 'bus_clk' on some of its controllers, while mt8192 requires 8 clocks. Move the clock definitions inside if blocks that match on the compatibles. I used Patch from Nícolas F. R. A. Prado and modified it to not using "not" statement. Fixes: 59a23395d8aa ("dt-bindings: mmc: Add support for MT8192 SoC") Signed-off-by: Nícolas F. R. A. Prado Signed-off-by: Frank Wunderlich Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221025132953.81286-2-linux@fw-web.de Signed-off-by: Ulf Hansson commit 1ad0dcb984c51db655f38ed97bb88545fd55f407 Author: wangjianli Date: Sat Oct 22 14:22:37 2022 +0800 mmc: host: Fix repeated words in comments Delete the redundant word 'the'. Signed-off-by: wangjianli Link: https://lore.kernel.org/r/20221022062237.10333-1-wangjianli@cdjrlc.com Link: https://lore.kernel.org/r/20221022062331.11395-1-wangjianli@cdjrlc.com Link: https://lore.kernel.org/r/20221022062505.13155-1-wangjianli@cdjrlc.com Signed-off-by: Ulf Hansson commit d7a1830e3ebe065141b8d4781cd931a4128bc421 Author: Giulio Benetti Date: Tue Oct 18 01:56:00 2022 +0200 mmc: sdhci-esdhc-imx: improve imxrt1050 data i.MXRT1050 usdhc is not affected by ESDHC_FLAG_ERR004536 so let's remove it. It supports ESDHC_FLAG_STD_TUNING and ESDHC_FLAG_HAVE_CAP1 so let's add them. Signed-off-by: Giulio Benetti Reviewed-by: Haibo Chen Link: https://lore.kernel.org/r/20221017235602.86250-3-giulio.benetti@benettiengineering.com Signed-off-by: Ulf Hansson commit 50bfe185c42a2199b65fc759cb1b2e6a0a915427 Author: Brian Norris Date: Mon Oct 24 11:17:59 2022 -0700 mmc: sdhci-brcmstb: Allow building with COMPILE_TEST This driver is pretty simple, and it can be useful to build it (for validation purposes) without BMIPS or ARCH_BRCMSTB. It technically depends on CONFIG_OF to do anything useful at runtime, but it still works out OK for compile-testing using the !OF stubs. Signed-off-by: Brian Norris Acked-by: Florian Fainelli Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20221024181759.2355583-1-briannorris@chromium.org Signed-off-by: Ulf Hansson commit cdb1ad52703b52e95696c38408ee9e3cf514dc4b Author: Adrian Hunter Date: Wed Oct 5 13:19:51 2022 +0300 mmc: wbsd: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-15-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 2fc458f75e1c2e8b9b9a7f6a09698994fe10a7aa Author: Adrian Hunter Date: Wed Oct 5 13:19:50 2022 +0300 mmc: au1xmmc: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-14-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 8e8d695fa567ab4d669cd04b8d655cb736c6ad87 Author: Adrian Hunter Date: Wed Oct 5 13:19:49 2022 +0300 mmc: tmio_mmc_core: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20221005101951.3165-13-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 14c9825f968ccfe34cc606a87e374133feeed7ac Author: Adrian Hunter Date: Wed Oct 5 13:19:48 2022 +0300 mmc: tmio_mmc_core: Remove local_irq_{save,restore}() around k[un]map_atomic() A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). When the second argument to kmap_atomic was removed by commit 482fce997e14 ("mmc: remove the second argument of k[un]map_atomic()"), local_irq_{save,restore}() should have been removed also. Remove it now. Signed-off-by: Adrian Hunter Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20221005101951.3165-12-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 4526cdaf9df8bef093bb9a5b0db09a1978a811f8 Author: Adrian Hunter Date: Wed Oct 5 13:19:47 2022 +0300 mmc: tifm_sd: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-11-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 36bbdc3096e160ffe0ba93053e6e11a98ef14691 Author: Adrian Hunter Date: Wed Oct 5 13:19:46 2022 +0300 mmc: tifm_sd: Remove local_irq_{save,restore}() around tifm_sd_bounce_block() tifm_sd_bounce_block() calls functions that ultimate use kmap_atomic() to map pages. A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). When the second argument to kmap_atomic was removed by commit 482fce997e14 ("mmc: remove the second argument of k[un]map_atomic()"), local_irq_{save,restore}() should have been removed also. Remove it now. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-10-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit b7093c10967e732236bcc5b2e8ba5fc87b5a57a8 Author: Adrian Hunter Date: Wed Oct 5 13:19:45 2022 +0300 mmc: tifm_sd: Remove local_irq_{save,restore}() around tifm_sd_transfer_data() tifm_sd_transfer_data() calls functions that ultimate use kmap_atomic() to map pages. A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). When the second argument to kmap_atomic was removed by commit 482fce997e14 ("mmc: remove the second argument of k[un]map_atomic()"), local_irq_{save,restore}() should have been removed also. Remove it now. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-9-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 1550217a8b448008d9f590ffe46e1fc3caa3160d Author: Adrian Hunter Date: Wed Oct 5 13:19:44 2022 +0300 mmc: mmc_test: Remove local_irq_{save,restore}() around sg_copy_{from,to}_buffer() sg_copy_{from,to}_buffer() call sg_copy_buffer() which uses an sg_mapping_iter with flag SG_MITER_ATOMIC, so then sg_miter_next() uses kmap_atomic() to map pages. A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). Remove local_irq_{save,restore}() around sg_copy_{from,to}_buffer(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-8-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 07e23c14e1d341fa350a6f0659c6ac84544bb7c4 Author: Adrian Hunter Date: Wed Oct 5 13:19:43 2022 +0300 mmc: bcm2835: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-7-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit e9c9722220057d19d80478c0edda3fbf237a73f7 Author: Adrian Hunter Date: Wed Oct 5 13:19:42 2022 +0300 mmc: bcm2835: Remove local_irq_{save,restore}() around sg_miter_{next,stop}() sg_miter_next() using an sg_mapping_iter with flag SG_MITER_ATOMIC uses kmap_atomic() to map pages. A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). Remove local_irq_{save,restore}() around sg_miter_{next,stop}(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-6-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 8ff683f6a293650a7fa5025f41a164987b585f07 Author: Adrian Hunter Date: Wed Oct 5 13:19:41 2022 +0300 mmc: bcm2835: Remove local_irq_{save,restore}() around k[un]map_atomic() A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). Unfortunately, that unnecessary pattern of code has been copied since and persists in bcm2385.c. Remove it. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-5-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 47722e3fd92482c036be43a4ba62698c8b8b63b8 Author: Adrian Hunter Date: Wed Oct 5 13:19:40 2022 +0300 mmc: sdhci: Replace kmap_atomic() with kmap_local_page() kmap_local_page() is equivalent to kmap_atomic() except that it does not disable page faults or preemption. Where possible kmap_local_page() is preferred to kmap_atomic() - refer kernel highmem documentation. In this case, there is no need to disable page faults or preemption, so replace kmap_atomic() with kmap_local_page(), and, correspondingly, kunmap_atomic() with kunmap_local(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-4-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit e467c154f748b9fd1b3cbff685b58091b532c90e Author: Adrian Hunter Date: Wed Oct 5 13:19:39 2022 +0300 mmc: sdhci: Remove local_irq_{save,restore}() around sg_miter_{next,stop}() sg_miter_next() using an sg_mapping_iter with flag SG_MITER_ATOMIC uses kmap_atomic() to map pages. A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). Remove local_irq_{save,restore}() around sg_miter_{next,stop}(). Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-3-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 4438592c920bbfdf3c584aa51779f1a84526eb72 Author: Adrian Hunter Date: Wed Oct 5 13:19:38 2022 +0300 mmc: sdhci: Remove local_irq_{save,restore}() around k[un]map_atomic() A long time ago the kmap_atomic API required a slot to be provided which risked the possibility that other code might use the same slot at the same time. Disabling interrupts prevented the possibility of an interrupt handler doing that. However, that went away with commit 3e4d3af501cc ("mm: stack based kmap_atomic()"). When the second argument to kmap_atomic was removed by commit 482fce997e14 ("mmc: remove the second argument of k[un]map_atomic()"), local_irq_{save,restore}() should have been removed also. Remove it now. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20221005101951.3165-2-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 2ab441f9c2d4266c3a392b2d07832608a5e647e4 Author: Marek Vasut Date: Fri Oct 14 00:12:40 2022 +0200 dt-bindings: mmc: arm,pl18x: Document interrupt-names is ignored Due to inconsistency of existing DTs regarding the content of this IP interrupt-names DT property, document this such that interrupt-names is not used by this IP bindings. Signed-off-by: Marek Vasut Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221013221242.218808-1-marex@denx.de Signed-off-by: Ulf Hansson commit 2505d7a3f364bcb24b57627a5a80552ee03bd590 Author: Matt Ranostay Date: Wed Oct 12 19:40:21 2022 -0700 dt-bindings: mmc: sdhci-am654: add ti,itap-del-sel-ddr50 to schema Add missing ti,itap-del-sel-ddr50 property to schema to clear up the following warnings. mmc@4fb0000: Unevaluated properties are not allowed ('ti,itap-del-sel-ddr50' was unexpected) Signed-off-by: Matt Ranostay Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221013024021.121104-1-mranostay@ti.com Signed-off-by: Ulf Hansson commit c2a2130634922869c2c2cc4c14115d2454ef153f Author: Geert Uytterhoeven Date: Wed Oct 12 09:05:56 2022 +0200 dt-bindings: mmc: renesas,sdhi: Document R-Car V4H support Document support for the SD Card/MMC Interface on the Renesas R-Car V4H (R8A779G0) SoC. Signed-off-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/7ee7fdb6a46fc9f0e50c2b803ede6b4b2fdfa450.1665558324.git.geert+renesas@glider.be Signed-off-by: Ulf Hansson commit e896dbd3239db99f5edf080780f9a0867ca53b28 Author: Peng Fan Date: Mon Oct 10 18:11:38 2022 +0800 dt-bindings: mmc: fsl-imx-esdhc: update i.MX8DXL compatible i.MX8DXL is compatible with i.MX8QXP, so update binding doc. Signed-off-by: Peng Fan Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221010101138.295332-1-peng.fan@oss.nxp.com Signed-off-by: Ulf Hansson commit 98c738c8cee6e5a58d4060862e2f8cf3cdc8a328 Author: Nathan Lynch Date: Fri Nov 18 09:07:47 2022 -0600 powerpc/rtas: mandate RTAS syscall filtering CONFIG_PPC_RTAS_FILTER has been optional but default-enabled since its introduction. It's been enabled in enterprise distro kernels for a while without causing ABI breakage that wasn't easily fixed, and it prevents harmful abuses of the rtas syscall. Let's make it unconditional. Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-10-nathanl@linux.ibm.com commit f975b6559bac510f1b1b39637997bb240f0a9969 Author: Nathan Lynch Date: Fri Nov 18 09:07:46 2022 -0600 powerpc/rtas: define pr_fmt and convert printk call sites Set pr_fmt to "rtas: " and convert the handful of printk() uses in rtas.c, adjusting the messages to remove now-redundant "RTAS" strings. Note that rtas_restart(), rtas_power_off(), and rtas_halt() all currently use printk() without specifying a log level. These have been changed to use pr_emerg(), which matches the behavior of rtas_os_term(). Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-9-nathanl@linux.ibm.com commit 9581f8a00777a073fdd8146659a51ca007cae8d6 Author: Nathan Lynch Date: Fri Nov 18 09:07:45 2022 -0600 powerpc/rtas: clean up includes rtas.c used to host complex code related to pseries-specific guest migration and suspend, which used atomics, completions, hcalls, and CPU hotplug APIs. That's all been deleted or moved, so remove the include directives that have been rendered unnecessary. Sort the remainder (with linux/ before asm/) to impose some order on where future additions go. Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-8-nathanl@linux.ibm.com commit c67a0e411d0ffe0648fe84e25e9f899ce770feb3 Author: Nathan Lynch Date: Fri Nov 18 09:07:44 2022 -0600 powerpc/rtas: clean up rtas_error_log_max initialization The code in rtas_get_error_log_max() doesn't cause problems in practice, but there are no measures to ensure that the lazy initialization of the static rtas_error_log_max variable is atomic, and it's not worth adding them. Initialize the static rtas_error_log_max variable at boot when we're single-threaded instead of lazily on first use. Use the more appropriate of_property_read_u32() API instead of rtas_token() to consult the "rtas-error-log-max" property, which is not the name of an RTAS function. Convert use of printk() to pr_warn() and distinguish the possible error cases. Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-7-nathanl@linux.ibm.com commit 9aafbfa5f57a4b75bafd3bed0191e8429c5fa618 Author: Nathan Lynch Date: Fri Nov 18 09:07:43 2022 -0600 powerpc/pseries/eeh: use correct API for error log size rtas-error-log-max is not the name of an RTAS function, so rtas_token() is not the appropriate API for retrieving its value. We already have rtas_get_error_log_max() which returns a sensible value if the property is absent for any reason, so use that instead. Fixes: 8d633291b4fc ("powerpc/eeh: pseries platform EEH error log retrieval") Signed-off-by: Nathan Lynch [mpe: Drop no-longer possible error handling as noticed by ajd] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-6-nathanl@linux.ibm.com commit a2220b54589b1d2a404f6eb5f6bc3c0ace2b504f Merge: f82389eecdd24 84ad3642115df Author: Paolo Abeni Date: Wed Dec 7 12:28:06 2022 +0100 Merge branch 'cn10kb-mac-block-support' Hariprasad Kelam says: ==================== CN10KB MAC block support OcteonTx2's next gen platform the CN10KB has RPM_USX MAC which has a different serdes when compared to RPM MAC. Though the underlying HW is different, the CSR interface has been designed largely inline with RPM MAC, with few exceptions though. So we are using the same CGX driver for RPM_USX MAC as well and will have a different set of APIs for RPM_USX where ever necessary. The RPM and RPM_USX blocks support a different number of LMACS. RPM_USX support 8 LMACS per MAC block whereas legacy RPM supports only 4 LMACS per MAC. with this RPM_USX support double the number of DMAC filters and fifo size. This patchset adds initial support for CN10KB's RPM_USX MAC i.e registering the driver and defining MAC operations (mac_ops). With these changes PF and VF netdev packet path will work and PF and VF netdev drivers are able to configure MAC features like pause frames,PFC and loopback etc. Also implements FEC stats for CN10K Mac block RPM and CN10KB Mac block RPM_USX and extends ethtool support for PF and VF drivers by defining get_fec_stats API to display FEC stats. ==================== Link: https://lore.kernel.org/r/20221205070521.21860-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 84ad3642115dfc2f17b6bd98e0470f799b8411e3 Author: Hariprasad Kelam Date: Mon Dec 5 12:35:21 2022 +0530 octeontx2-af: Add FEC stats for RPM/RPM_USX block CN10K silicon MAC block RPM and CN10KB silicon MAC block RPM_USX both support BASER and RSFEC modes. Also MAC (CGX) on OcteonTx2 silicon variants and MAC (RPM) on OcteonTx3 CN10K are different and FEC stats need to be read differently. CN10KB MAC block (RPM_USX) fec csr offsets are same as CN10K MAC block (RPM) mac_ops points to same fn(). Upper layer interface between RVU AF and PF netdev is kept same. Based on silicon variant appropriate fn() pointer is called to read FEC stats Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Paolo Abeni commit b441c4ac5ea37251d6acabe679215a828025004b Author: Hariprasad Kelam Date: Mon Dec 5 12:35:20 2022 +0530 octeontx2-pf: ethtool: Implement get_fec_stats This patch registers a callback for get_fec_stats such that FEC stats can be queried from the below command "ethtool -I --show-fec eth0" Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Paolo Abeni commit b9d0fedc6234011d67f6e2ba0ae1a8de6beca010 Author: Hariprasad Kelam Date: Mon Dec 5 12:35:19 2022 +0530 octeontx2-af: cn10kb: Add RPM_USX MAC support OcteonTx2's next gen platform the CN10KB has RPM_USX MAC which has a different serdes when compared to RPM MAC. Though the underlying HW is different, the CSR interface has been designed largely inline with RPM MAC, with few exceptions though. So we are using the same CGX driver for RPM_USX MAC as well and will have a different set of APIs for RPM_USX where ever necessary. The RPM and RPM_USX blocks support a different number of LMACS. RPM_USX support 8 LMACS per MAC block whereas legacy RPM supports only 4 LMACS per MAC. with this RPM_USX support double the number of DMAC filters and fifo size. This patch adds initial support for CN10KB's RPM_USX MAC i.e registering the driver and defining MAC operations (mac_ops). Adds the logic to configure internal loopback and pause frames and assign FIFO length to LMACS. Kernel reads lmac features like lmac type, autoneg, etc from shared firmware data this structure only supports 4 lmacs per MAC, this patch extends this structure to accommodate 8 lmacs. Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Paolo Abeni commit f2e664ad503d4e5ce7c42a0862ab164331a0ef37 Author: Rakesh Babu Saladi Date: Mon Dec 5 12:35:18 2022 +0530 octeontx2-af: Support variable number of lmacs Most of the code in CGX/RPM driver assumes that max lmacs per given MAC as always, 4 and the number of MAC blocks also as 4. With this assumption, the max number of interfaces supported is hardcoded to 16. This creates a problem as next gen CN10KB silicon MAC supports 8 lmacs per MAC block. This patch solves the problem by using "max lmac per MAC block" value from constant csrs and uses cgx_cnt_max value which is populated based number of MAC blocks supported by silicon. Signed-off-by: Rakesh Babu Saladi Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Paolo Abeni commit 6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4 Author: Nathan Lynch Date: Fri Nov 18 09:07:42 2022 -0600 powerpc/rtas: avoid scheduling in rtas_os_term() It's unsafe to use rtas_busy_delay() to handle a busy status from the ibm,os-term RTAS function in rtas_os_term(): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 preempt_count: 2, expected: 0 CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9 Call Trace: [c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable) [c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0 [c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0 [c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4 [c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68 [c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50 [c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0 [c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0 [c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0 [c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420 [c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200 Use rtas_busy_delay_time() instead, which signals without side effects whether to attempt the ibm,os-term RTAS call again. Signed-off-by: Nathan Lynch Reviewed-by: Nicholas Piggin Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-5-nathanl@linux.ibm.com commit ed2213bfb192ab51f09f12e9b49b5d482c6493f3 Author: Nathan Lynch Date: Fri Nov 18 09:07:41 2022 -0600 powerpc/rtas: avoid device tree lookups in rtas_os_term() rtas_os_term() is called during panic. Its behavior depends on a couple of conditions in the /rtas node of the device tree, the traversal of which entails locking and local IRQ state changes. If the kernel panics while devtree_lock is held, rtas_os_term() as currently written could hang. Instead of discovering the relevant characteristics at panic time, cache them in file-static variables at boot. Note the lookup for "ibm,extended-os-term" is converted to of_property_read_bool() since it is a boolean property, not an RTAS function token. Signed-off-by: Nathan Lynch Reviewed-by: Nicholas Piggin Reviewed-by: Andrew Donnellan [mpe: Incorporate suggested change from Nick] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-4-nathanl@linux.ibm.com commit b10af504a2015d12c566b6b0a4c7e3b602949eeb Author: Nathan Lynch Date: Fri Nov 18 09:07:40 2022 -0600 powerpc/rtasd: use correct OF API for event scan rate rtas_token() should be used only for properties that are RTAS function tokens. "rtas-event-scan-rate" does not contain a function token, but it has the same size/format as token properties so reading it with rtas_token() happens to work. Convert to of_property_read_u32(). Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-3-nathanl@linux.ibm.com commit 336e2554ec99eb97616004c791ee89abe96bdab2 Author: Nathan Lynch Date: Fri Nov 18 09:07:39 2022 -0600 powerpc/rtas: document rtas_call() rtas_call() has a complex calling convention, non-standard return values, and many users. Add kernel-doc for it and remove the less structured commentary from rtas.h. Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221118150751.469393-2-nathanl@linux.ibm.com commit f82389eecdd24a50f0d33d58127aeacc48d53511 Merge: e22dcbc9aa329 55a952eef70a5 Author: Paolo Abeni Date: Wed Dec 7 11:58:00 2022 +0100 Merge branch 'net-dsa-microchip-add-mtu-support-for-ksz8-series' Oleksij Rempel says: ==================== net: dsa: microchip: add MTU support for KSZ8 series ==================== Link: https://lore.kernel.org/r/20221205052232.2834166-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 55a952eef70a51340afdf080ecf81dd2b7bbf952 Author: Oleksij Rempel Date: Mon Dec 5 06:22:32 2022 +0100 net: dsa: microchip: ksz8: move all DSA configurations to one location To make the code more comparable to KSZ9477 code, move DSA configurations to the same location. Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 6b30cfa86ee703dc75743d56b078661753a18da3 Author: Oleksij Rempel Date: Mon Dec 5 06:22:31 2022 +0100 net: dsa: microchip: enable MTU normalization for KSZ8795 and KSZ9477 compatible switches KSZ8795 and KSZ9477 compatible series of switches use global max frame size configuration register. So, enable MTU normalization for this reason. Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 29d1e85f45e03c9fd1b8985f983f33c021e130c8 Author: Oleksij Rempel Date: Mon Dec 5 06:22:30 2022 +0100 net: dsa: microchip: ksz8: add MTU configuration support Make MTU configurable on KSZ87xx and KSZ88xx series of switches. Before this patch, pre-configured behavior was different on different switch series, due to opposite meaning of the same bit: - KSZ87xx: Reg 4, Bit 1 - if 1, max frame size is 1532; if 0 - 1514 - KSZ88xx: Reg 4, Bit 1 - if 1, max frame size is 1514; if 0 - 1532 Since the code was telling "... SW_LEGAL_PACKET_DISABLE, true)", I assume, the idea was to set max frame size to 1532. With this patch, by setting MTU size 1500, both switch series will be configured to the 1532 frame limit. This patch was tested on KSZ8873. Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Paolo Abeni commit 6f1b986a43ce9aa67b11a7e54ac75530705d04e7 Author: Oleksij Rempel Date: Mon Dec 5 06:22:29 2022 +0100 net: dsa: microchip: add ksz_rmw8() function Add ksz_rmw8(), it will be used in the next patch. Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: Paolo Abeni commit 1d0a1a6d0d63db5bba73abe862180c947861f4d4 Author: Oleksij Rempel Date: Mon Dec 5 06:22:28 2022 +0100 net: dsa: microchip: do not store max MTU for all ports If we have global MTU configuration, it is enough to configure it on CPU port only. Signed-off-by: Oleksij Rempel Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Paolo Abeni commit 838c19f89454cab177ed6f74ab61ad32db1764c5 Author: Oleksij Rempel Date: Mon Dec 5 06:22:27 2022 +0100 net: dsa: microchip: move max mtu to one location There are no HW specific registers, so we can process all of them in one location. Signed-off-by: Oleksij Rempel Tested-by: Arun Ramadoss (KSZ9893 and LAN937x) Signed-off-by: Paolo Abeni commit e22dcbc9aa329e7902a8c9f8d11aba74f5d7c97d Author: Yuan Can Date: Mon Dec 5 03:43:39 2022 +0000 net: ethernet: mtk_wed: Fix missing of_node_put() in mtk_wed_wo_hardware_init() The np needs to be released through of_node_put() in the error handling path of mtk_wed_wo_hardware_init(). Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support") Signed-off-by: Yuan Can Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20221205034339.112163-1-yuancan@huawei.com Signed-off-by: Paolo Abeni commit f6aa37c51ec0d053ee34c235bfe0e666618a3baf Author: Laurent Dufour Date: Mon Nov 14 17:01:50 2022 +0100 powerpc/pseries: unregister VPA when hot unplugging a CPU The VPA should unregister when offlining a CPU. Otherwise there could be a short window where 2 CPUs could share the same VPA. This happens because the hypervisor is still keeping the VPA attached to the vCPU even if it became offline. Here is a potential situation: 1. remove proc A, 2. add proc B. If proc B gets proc A's place in cpu_present_mask, then it registers proc A's VPAs. 3. If proc B is then re-added to the LP, its threads are sharing VPAs with proc A briefly as they come online. As the hypervisor may check for the VPA's yield_count field oddity, it may detect an unexpected value and kill the LPAR. Suggested-by: Nathan Lynch Signed-off-by: Laurent Dufour Reviewed-by: Nathan Lynch [mpe: s/cpu_present_map/cpu_present_mask/ in change log] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221114160150.13554-1-ldufour@linux.ibm.com commit 9b574cfab7d4e68c67c4ee4fcde912ef54a25b88 Author: Laurent Dufour Date: Fri Nov 25 18:32:04 2022 +0100 powerpc/pseries: reset the RCU watchdogs after a LPM The RCU watchdog timer should be reset when restarting the CPU after a Live Partition Mobility operation. Signed-off-by: Laurent Dufour Acked-by: Nicholas Piggin [mpe: Combine comments into a single comment block] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221125173204.15329-1-ldufour@linux.ibm.com commit 340a4a9f8773e102cc5ef531665970a686dfa245 Author: Laurent Dufour Date: Thu Nov 10 19:06:19 2022 +0100 powerpc: Take in account addition CPU node when building kexec FDT On a system with a large number of CPUs, the creation of the FDT for a kexec kernel may fail because the allocated FDT is not large enough. When this happens, such a message is displayed on the console: Unable to add ibm,processor-vadd-size property: FDT_ERR_NOSPACE The property's name may change depending when the buffer overwrite is detected. Obviously the created FDT is missing information, and it is expected that system dump or kexec kernel failed to run properly. When the FDT is allocated, the size of the FDT the kernel received at boot time is used and an extra size can be applied. Currently, only memory added after boot time is taken in account, not the CPU nodes. The extra size should take in account these additional CPU nodes and compute the required extra space. To achieve that, the size of a CPU node, including its subnode is computed once and multiplied by the number of additional CPU nodes. The assumption is that the size of the CPU node is _same_ for all the node, the only variable part should be the name "PowerPC,POWERxx@##" where "##" may vary a little. Signed-off-by: Laurent Dufour [mpe: Don't shadow function name w/variable, minor coding style changes] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221110180619.15796-3-ldufour@linux.ibm.com commit e13d23a404f2e6dfaf8b1ef7d161a0836fce4fa5 Author: Laurent Dufour Date: Thu Nov 10 19:06:18 2022 +0100 powerpc: export the CPU node count At boot time, the FDT is parsed to compute the number of CPUs. In addition count the number of CPU nodes and export it. This is useful when building the FDT for a kexeced kernel since we need to take in account the CPU node added since the boot time during CPU hotplug operations. Signed-off-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221110180619.15796-2-ldufour@linux.ibm.com commit d074f0aebde5649f7a9f1807551efc019b8e81c4 Author: ye xingchen Date: Wed Dec 7 16:32:18 2022 +0800 RDMA/hfi1: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Link: https://lore.kernel.org/r/202212071632188074249@zte.com.cn Signed-off-by: Leon Romanovsky commit bdbbae241a04f387ba910b8609f95fad5f1470c7 Author: Bartosz Golaszewski Date: Mon Dec 5 13:39:03 2022 +0100 gpiolib: protect the GPIO device against being dropped while in use by user-space While any of the GPIO cdev syscalls is in progress, the kernel can call gpiochip_remove() (for instance, when a USB GPIO expander is disconnected) which will set gdev->chip to NULL after which any subsequent access will cause a crash. To avoid that: use an RW-semaphore in which the syscalls take it for reading (so that we don't needlessly prohibit the user-space from calling syscalls simultaneously) while gpiochip_remove() takes it for writing so that it can only happen once all syscalls return. Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL") Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL") Fixes: 7b8e00d98168 ("gpiolib: cdev: support GPIO_V2_LINE_SET_VALUES_IOCTL") Signed-off-by: Bartosz Golaszewski [Nick: fixed a build failure with CDEV_V1 disabled] Co-authored-by: Nick Hainke Reviewed-by: Kent Gibson Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij commit 533aae7c94dbc2b14301cfd68ae7e0e90f0c8438 Author: Bartosz Golaszewski Date: Mon Dec 5 13:39:02 2022 +0100 gpiolib: cdev: fix NULL-pointer dereferences There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls relevant to the GPIO character device's annonymous file descriptors: ioctl(), read(), poll(). While I observed it with the GPIO simulator, it will also happen for any of the GPIO devices that can be hot-unplugged - for instance any HID GPIO expander (e.g. CP2112). This affects both v1 and v2 uAPI. This fixes it partially by checking if gdev->chip is not NULL but it doesn't entirely remedy the situation as we still have a race condition in which another thread can remove the device after the check. Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL") Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL") Fixes: 7b8e00d98168 ("gpiolib: cdev: support GPIO_V2_LINE_SET_VALUES_IOCTL") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij commit ed883bec679b027b198d57a336715f8298fb88b4 Author: Lorenzo Bianconi Date: Mon Dec 5 12:34:42 2022 +0100 net: ethernet: mtk_wed: add reset to rx_ring_setup callback This patch adds reset parameter to mtk_wed_rx_ring_setup signature in order to align rx_ring_setup callback to tx_ring_setup one introduced in 'commit 23dca7a90017 ("net: ethernet: mtk_wed: add reset to tx_ring_setup callback")' Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Signed-off-by: Lorenzo Bianconi Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/29c6e7a5469e784406cf3e2920351d1207713d05.1670239984.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit e3bd74c3d1907360a37f49a0cdf02daa2983ff53 Author: zhang songyi Date: Mon Dec 5 14:22:15 2022 +0800 net: microchip: vcap: Remove unneeded semicolons Semicolons after "}" are not needed. Signed-off-by: zhang songyi Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/202212051422158113766@zte.com.cn Signed-off-by: Jakub Kicinski commit 1ab586f5177b3b2805a05aa926a5b46d3d7f112c Author: ye xingchen Date: Mon Dec 5 10:21:45 2022 +0800 sfc: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Reviewed-by: Leon Romanovsky Acked-by: Martin Habets Link: https://lore.kernel.org/r/202212051021451139126@zte.com.cn Signed-off-by: Jakub Kicinski commit 7ff5d60f18bba5cbaf17b2926aa9da44d5beca01 Author: Shang XiaoJing Date: Sun Dec 4 16:27:57 2022 +0800 remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() q6v5_wcss_qcs404_power_on() have no fail path for readl_poll_timeout(). Add fail path for readl_poll_timeout(). Fixes: 0af65b9b915e ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404") Signed-off-by: Shang XiaoJing Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204082757.18850-1-shangxiaojing@huawei.com commit 38e7d9c19276832ebb0277f415b9214bf7baeb37 Author: Yuan Can Date: Sat Dec 3 07:06:39 2022 +0000 remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() The pointer node is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. Fixes: b9e718e950c3 ("remoteproc: Introduce Qualcomm ADSP PIL") Signed-off-by: Yuan Can Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221203070639.15128-1-yuancan@huawei.com commit 34d01df00b84127be04c914fc9f8e8be1fcdf851 Author: Luca Weiss Date: Fri Nov 18 10:08:16 2022 +0100 remoteproc: qcom_q6v5_pas: detach power domains on remove We need to detach from the power domains also on remove, not just on probe fail so a subsequent probe works as expected. Otherwise the following error appears on re-probe: [ 29.452005] sysfs: cannot create duplicate filename '/devices/genpd:0:3000000.remoteproc' [ 29.477121] CPU: 1 PID: 483 Comm: sh Tainted: G W 6.1.0-rc4-00075-g71a113770bda #78 [ 29.510319] Hardware name: Fairphone 4 (DT) [ 29.538335] Call trace: [ 29.564470] dump_backtrace.part.0+0xe0/0xf0 [ 29.592602] show_stack+0x18/0x30 [ 29.619616] dump_stack_lvl+0x64/0x80 [ 29.646834] dump_stack+0x18/0x34 [ 29.673541] sysfs_warn_dup+0x60/0x7c [ 29.700592] sysfs_create_dir_ns+0xec/0x110 [ 29.728057] kobject_add_internal+0xb8/0x374 [ 29.755530] kobject_add+0x9c/0x104 [ 29.782072] device_add+0xbc/0x8a0 [ 29.808445] device_register+0x20/0x30 [ 29.835175] genpd_dev_pm_attach_by_id+0xa4/0x190 [ 29.862851] genpd_dev_pm_attach_by_name+0x3c/0xb0 [ 29.890472] dev_pm_domain_attach_by_name+0x20/0x30 [ 29.918212] adsp_probe+0x278/0x580 [ 29.944384] platform_probe+0x68/0xc0 [ 29.970603] really_probe+0xbc/0x2dc [ 29.996662] __driver_probe_device+0x78/0xe0 [ 30.023491] device_driver_attach+0x48/0xac [ 30.050215] bind_store+0xb8/0x114 [ 30.075957] drv_attr_store+0x24/0x3c [ 30.101874] sysfs_kf_write+0x44/0x54 [ 30.127751] kernfs_fop_write_iter+0x120/0x1f0 [ 30.154448] vfs_write+0x1ac/0x380 [ 30.179937] ksys_write+0x70/0x104 [ 30.205274] __arm64_sys_write+0x1c/0x2c [ 30.231060] invoke_syscall+0x48/0x114 [ 30.256594] el0_svc_common.constprop.0+0x44/0xec [ 30.283183] do_el0_svc+0x2c/0xd0 [ 30.308320] el0_svc+0x2c/0x84 [ 30.333059] el0t_64_sync_handler+0xf4/0x120 [ 30.359001] el0t_64_sync+0x18c/0x190 [ 30.384385] kobject_add_internal failed for genpd:0:3000000.remoteproc with -EEXIST, don't try to register things with the same name in the same directory. [ 30.406029] remoteproc remoteproc0: releasing 3000000.remoteproc [ 30.416064] qcom_q6v5_pas: probe of 3000000.remoteproc failed with error -17 Fixes: 17ee2fb4e856 ("remoteproc: qcom: pas: Vote for active/proxy power domains") Reviewed-by: Sibi Sankar Reviewed-by: Mukesh Ojha Signed-off-by: Luca Weiss Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221118090816.100012-2-luca.weiss@fairphone.com commit 9a70551996e699fda262e8d54bbd41739d7aad6d Author: Luca Weiss Date: Fri Nov 18 10:08:15 2022 +0100 remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove Leaving wakeup enabled during probe fail (-EPROBE_DEFER) or remove makes the subsequent probe fail. [ 3.749454] remoteproc remoteproc0: releasing 3000000.remoteproc [ 3.752949] qcom_q6v5_pas: probe of 3000000.remoteproc failed with error -17 [ 3.878935] remoteproc remoteproc0: releasing 4080000.remoteproc [ 3.887602] qcom_q6v5_pas: probe of 4080000.remoteproc failed with error -17 [ 4.319552] remoteproc remoteproc0: releasing 8300000.remoteproc [ 4.332716] qcom_q6v5_pas: probe of 8300000.remoteproc failed with error -17 Fix this by disabling wakeup in both cases so the driver can properly probe on the next try. Fixes: a781e5aa5911 ("remoteproc: core: Prevent system suspend during remoteproc recovery") Fixes: dc86c129b4fb ("remoteproc: qcom: pas: Mark devices as wakeup capable") Reviewed-by: Mukesh Ojha Signed-off-by: Luca Weiss Reviewed-by: Caleb Connolly Reviewed-by: Sibi Sankar Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221118090816.100012-1-luca.weiss@fairphone.com commit f360e2b275efbb745ba0af8b47d9ef44221be586 Author: Shang XiaoJing Date: Fri Nov 25 10:16:41 2022 +0800 remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() q6v5_wcss_init_mmio() will call platform_get_resource_byname() that may fail and return NULL. devm_ioremap() will use res->start as input, which may causes null-ptr-deref. Check the ret value of platform_get_resource_byname() to avoid the null-ptr-deref. Fixes: 0af65b9b915e ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404") Signed-off-by: Shang XiaoJing Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221125021641.29392-1-shangxiaojing@huawei.com commit e01ce676aaef3b13d02343d7e70f9637d93a3367 Author: Gaosheng Cui Date: Tue Nov 29 18:56:50 2022 +0800 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() The kfree() should be called when of_irq_get_byname() fails or devm_request_threaded_irq() fails in qcom_add_sysmon_subdev(), otherwise there will be a memory leak, so add kfree() to fix it. Fixes: 027045a6e2b7 ("remoteproc: qcom: Add shutdown-ack irq") Signed-off-by: Gaosheng Cui Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221129105650.1539187-1-cuigaosheng1@huawei.com commit 7bd156cbbd0add4b869a7d997d057b76c329f4e5 Author: Jeff Johnson Date: Wed Sep 14 16:47:03 2022 -0700 remoteproc: sysmon: Make QMI message rules const Commit ff6d365898d4 ("soc: qcom: qmi: use const for struct qmi_elem_info") allows QMI message encoding/decoding rules to be const, so do that for sysmon. Signed-off-by: Jeff Johnson Reviewed-by: Alex Elder Reviewed-by: Sibi Sankar Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220914234705.28405-3-quic_jjohnson@quicinc.com commit e9b4aeed56699b469206d05e706ddf2db95700a9 Author: Christophe JAILLET Date: Sat Dec 3 17:51:04 2022 +0100 net: xsk: Don't include There is no need to include here. Prefer the less invasive which is needed for 'hlist_head'. Signed-off-by: Christophe JAILLET Acked-by: John Fastabend Link: https://lore.kernel.org/r/88d6a1d88764cca328610854f890a9ca1f4b029e.1670086246.git.christophe.jaillet@wanadoo.fr Signed-off-by: Alexei Starovoitov commit 6ebbdecff6ae00557a52539287b681641f4f0d33 Author: Anup Patel Date: Wed Dec 7 09:17:49 2022 +0530 RISC-V: KVM: Add ONE_REG interface for mvendorid, marchid, and mimpid We add ONE_REG interface for VCPU mvendorid, marchid, and mimpid so that KVM user-space can change this details to support migration across heterogeneous hosts. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit 52ec4b695dbe0552bb994c4149e9122610a76668 Author: Anup Patel Date: Wed Dec 7 09:17:43 2022 +0530 RISC-V: KVM: Save mvendorid, marchid, and mimpid when creating VCPU We should save VCPU mvendorid, marchid, and mimpid at the time of creating VCPU so that we don't have to do host SBI call every time Guest/VM ask for these details. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit a1a44e227ce69459ca43aa9dadaa1b58619b18ee Author: Anup Patel Date: Wed Dec 7 09:17:38 2022 +0530 RISC-V: Export sbi_get_mvendorid() and friends The sbi_get_mvendorid(), sbi_get_marchid(), and sbi_get_mimpid() can be used by KVM module so let us export these functions. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Acked-by: Palmer Dabbelt Signed-off-by: Anup Patel commit 23fe562e45c5959590a24d05c61c963f10ccb934 Author: Anup Patel Date: Wed Dec 7 09:17:27 2022 +0530 RISC-V: KVM: Move sbi related struct and functions to kvm_vcpu_sbi.h Just like asm/kvm_vcpu_timer.h, we should have all sbi related struct and functions in asm/kvm_vcpu_sbi.h. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit e81af89baebf86938cda1a7c2bee51c676c04e21 Author: Anup Patel Date: Wed Dec 7 09:17:19 2022 +0530 RISC-V: KVM: Use switch-case in kvm_riscv_vcpu_set/get_reg() We should use switch-case in kvm_riscv_vcpu_set/get_reg() functions because the else-if ladder is quite big now. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 1343c61a7032cf85680b666a340d9c4c683b2ec8 Author: Anup Patel Date: Wed Dec 7 09:17:12 2022 +0530 RISC-V: KVM: Remove redundant includes of asm/csr.h We should include asm/csr.h only where required so let us remove redundant includes of this header. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit fabd6179d08229cdb0f8ccfc4d9ec3ff379d9f28 Author: Anup Patel Date: Wed Dec 7 09:17:05 2022 +0530 RISC-V: KVM: Remove redundant includes of asm/kvm_vcpu_timer.h The asm/kvm_vcpu_timer.h is redundantly included in vcpu_sbi_base.c so let us remove it. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit e482d9e33d5b0f222cbef7341dcd52cead6b9edc Author: Anup Patel Date: Wed Dec 7 09:16:51 2022 +0530 RISC-V: KVM: Fix reg_val check in kvm_riscv_vcpu_set_reg_config() The reg_val check in kvm_riscv_vcpu_set_reg_config() should only be done for isa config register. Fixes: 9bfd900beeec ("RISC-V: KVM: Improve ISA extension by using a bitmap") Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 3e2d4756e2e5dd854b36aa947d7b6168f21dc4a1 Author: Christophe JAILLET Date: Wed Dec 7 09:16:39 2022 +0530 RISC-V: KVM: Simplify kvm_arch_prepare_memory_region() In kvm_arch_prepare_memory_region(), if no error occurs, a spin_lock()/ spin_unlock() call can be avoided. Switch to kvm_riscv_gstage_iounmap() that is the same as the current code, but with a better semantic. It also embeds the locking logic. So it is avoided if ret == 0. Signed-off-by: Christophe JAILLET Reviewed-by: Anup Patel Signed-off-by: Anup Patel commit af934432e4a169f7252a114a6c5c7289366bd0ab Author: Anup Patel Date: Wed Dec 7 09:16:21 2022 +0530 RISC-V: KVM: Exit run-loop immediately if xfer_to_guest fails If xfer_to_guest_mode_handle_work() fails in the run-loop then exit the run-loop immediately instead of doing it after some more work. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit b3f2575a993497dde19c18db73208325e8efba60 Author: Bo Liu Date: Wed Dec 7 09:16:11 2022 +0530 RISC-V: KVM: use vma_lookup() instead of find_vma_intersection() vma_lookup() finds the vma of a specific address with a cleaner interface and is more readable. Signed-off-by: Bo Liu Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit e78a11174de9e84e2f685618432754b83bd9f4ec Author: XiakaiPan <13212017962@163.com> Date: Wed Dec 7 09:16:02 2022 +0530 RISC-V: KVM: Add exit logic to main.c Several lines of code are inserted to remove KVM module normally using rmmod command just like others. Signed-off-by: XiakaiPan <13212017962@163.com> Reviewed-by: Andrew Jones Tested-by: Andrew Jones Signed-off-by: Anup Patel commit f0c5a2d9f2342733e417ac5d5d19848dbd8ba7aa Merge: d8939cb0a03ce 618945fbed501 Author: Alexei Starovoitov Date: Tue Dec 6 19:14:39 2022 -0800 Merge branch 'Refactor verifier prune and jump point handling' Andrii Nakryiko says: ==================== Disentangle prune and jump points in BPF verifier code. They are conceptually independent but currently coupled together. This small patch set refactors related code and make it possible to have some instruction marked as pruning or jump point independently. Besides just conceptual cleanliness, this allows to remove unnecessary jump points (saving a tiny bit of performance and memory usage, potentially), and even more importantly it allows for clean extension of special pruning points, similarly to how it's done for BPF_FUNC_timer_set_callback. This will be used by future patches implementing open-coded BPF iterators. v1->v2: - clarified path #3 commit message and a comment in the code (John); - added back mark_jmp_point() to right after subprog call to record non-linear implicit jump from BPF_EXIT to right after CALL . ==================== Signed-off-by: Alexei Starovoitov commit 618945fbed501b6e5865042068a51edfb2dda948 Author: Andrii Nakryiko Date: Tue Dec 6 15:33:45 2022 -0800 bpf: remove unnecessary prune and jump points Don't mark some instructions as jump points when there are actually no jumps and instructions are just processed sequentially. Such case is handled naturally by precision backtracking logic without the need to update jump history. See get_prev_insn_idx(). It goes back linearly by one instruction, unless current top of jmp_history is pointing to current instruction. In such case we use `st->jmp_history[cnt - 1].prev_idx` to find instruction from which we jumped to the current instruction non-linearly. Also remove both jump and prune point marking for instruction right after unconditional jumps, as program flow can get to the instruction right after unconditional jump instruction only if there is a jump to that instruction from somewhere else in the program. In such case we'll mark such instruction as prune/jump point because it's a destination of a jump. This change has no changes in terms of number of instructions or states processes across Cilium and selftests programs. Signed-off-by: Andrii Nakryiko Acked-by: John Fastabend Link: https://lore.kernel.org/r/20221206233345.438540-4-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit a095f421057e22853022cb644b1589d0dd0e756e Author: Andrii Nakryiko Date: Tue Dec 6 15:33:44 2022 -0800 bpf: mostly decouple jump history management from is_state_visited() Jump history updating and state equivalence checks are conceptually independent, so move push_jmp_history() out of is_state_visited(). Also make a decision whether to perform state equivalence checks or not one layer higher in do_check(), keeping is_state_visited() unconditionally performing state checks. push_jmp_history() should be performed after state checks. There is just one small non-uniformity. When is_state_visited() finds already validated equivalent state, it propagates precision marks to current state's parent chain. For this to work correctly, jump history has to be updated, so is_state_visited() is doing that internally. But if no equivalent verified state is found, jump history has to be updated in a newly cloned child state, so is_jmp_point() + push_jmp_history() is performed after is_state_visited() exited with zero result, which means "proceed with validation". This change has no functional changes. It's not strictly necessary, but feels right to decouple these two processes. Acked-by: John Fastabend Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20221206233345.438540-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit bffdeaa8a5af7200b0e74c9d5a41167f86626a36 Author: Andrii Nakryiko Date: Tue Dec 6 15:33:43 2022 -0800 bpf: decouple prune and jump points BPF verifier marks some instructions as prune points. Currently these prune points serve two purposes. It's a point where verifier tries to find previously verified state and check current state's equivalence to short circuit verification for current code path. But also currently it's a point where jump history, used for precision backtracking, is updated. This is done so that non-linear flow of execution could be properly backtracked. Such coupling is coincidental and unnecessary. Some prune points are not part of some non-linear jump path, so don't need update of jump history. On the other hand, not all instructions which have to be recorded in jump history necessarily are good prune points. This patch splits prune and jump points into independent flags. Currently all prune points are marked as jump points to minimize amount of changes in this patch, but next patch will perform some optimization of prune vs jmp point placement. No functional changes are intended. Acked-by: John Fastabend Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20221206233345.438540-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit c505feba4c0d76084e56ec498ce819f02a7043ae Author: Gao Xiang Date: Mon Dec 5 23:00:50 2022 +0800 erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length. The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity. Reported-by: syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20221205150050.47784-2-hsiangkao@linux.alibaba.com commit d5d188b8f8b38d3d71dd05993874b4fc9284ce95 Author: Gao Xiang Date: Mon Dec 5 23:00:49 2022 +0800 erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails Otherwise, meta buffers could be leaked. Fixes: cec6e93beadf ("erofs: support parsing big pcluster compress indexes") Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20221205150050.47784-1-hsiangkao@linux.alibaba.com commit c42c0ffe81176940bd5dead474216b7198d77675 Author: Chen Zhongjin Date: Mon Dec 5 11:49:57 2022 +0800 erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [] z_erofs_do_read_page+0x99b/0x1740 [] z_erofs_readahead+0x24e/0x580 [] read_pages+0x86/0x3d0 ... syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be zero although pcl is not a inline pcluster. Then following path adds refcount for grp, but the refcount won't be put because pcl is inline. z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup_get() Since it's illegal for the block address of a non-inlined pcluster to be zero, add check here to avoid registering the pcluster which would be leaked. Fixes: cecf864d3d76 ("erofs: support inline data decompression") Reported-by: syzbot+6f8cd9a0155b366d227f@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin Reviewed-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/Y42Kz6sVkf+XqJRB@debian Signed-off-by: Gao Xiang commit 927e5010ff5bd7446a22c511ab8643b9385ddf4d Author: Gao Xiang Date: Tue Oct 18 18:53:13 2022 +0800 erofs: use kmap_local_page() only for erofs_bread() Convert all mapped erofs_bread() users to use kmap_local_page() instead of kmap() or kmap_atomic(). Signed-off-by: Gao Xiang Reviewed-and-tested-by: Jingbo Xu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20221018105313.4940-1-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit e6687b89225ee9c817e6dcbadc873f6a4691e5c2 Author: Jingbo Xu Date: Thu Dec 1 15:42:56 2022 +0800 erofs: enable large folios for fscache mode Enable large folios for fscache mode. Enable this feature for non-compressed format for now, until the compression part supports large folios later. One thing worth noting is that, the feature is not enabled for the meta data routine since meta inodes don't need large folios for now, nor do they support readahead yet. Also document this new feature. Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20221201074256.16639-3-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit be62c5198861156d77b60babb89e70e21c73eb7b Author: Jingbo Xu Date: Thu Dec 1 15:42:55 2022 +0800 erofs: support large folios for fscache mode When large folios supported, one folio can be split into several slices, each of which may be mapped to META/UNMAPPED/MAPPED, and the folio can be unlocked as a whole only when all slices have completed. Thus always allocate erofs_fscache_request for each .read_folio() or .readahead(), in which case the allocated request is responsible for unlocking folios when all slices have completed. As described above, each folio or folio range can be mapped into several slices, while these slices may be mapped to different cookies, and thus each slice needs its own netfs_cache_resources. Here we introduce chained requests to support this, where each .read_folio() or .readahead() calling can correspond to multiple requests. Each request has its own netfs_cache_resources and thus is used to access one cookie. Among these requests, there's a primary request, with the others pointing to the primary request. Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20221201074256.16639-2-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 709fe09e281776b5e024fb5934c0485a866b7468 Author: Jingbo Xu Date: Thu Nov 24 11:42:12 2022 +0800 erofs: switch to prepare_ondemand_read() in fscache mode Switch to prepare_ondemand_read() interface and a self-contained request completion to get rid of netfs_io_[request|subrequest]. The whole request will still be split into slices (subrequest) according to the cache state of the backing file. As long as one of the subrequests fails, the whole request will be marked as failed. Reviewed-by: Gao Xiang Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20221124034212.81892-3-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 8669247524c73e16e4d3384c4ff882e5c5d06194 Author: Jingbo Xu Date: Thu Nov 24 11:42:11 2022 +0800 fscache,cachefiles: add prepare_ondemand_read() callback Add prepare_ondemand_read() callback dedicated for the on-demand read scenario, so that callers from this scenario can be decoupled from netfs_io_subrequest. The original cachefiles_prepare_read() is now refactored to a generic routine accepting a parameter list instead of netfs_io_subrequest. There's no logic change, except that the debug id of subrequest and request is removed from trace_cachefiles_prep_read(). Reviewed-by: Jeff Layton Signed-off-by: Jingbo Xu Acked-by: David Howells Link: https://lore.kernel.org/r/20221124034212.81892-2-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 1282dea37b09087b8aec59f0774572c16b52276a Author: Gao Xiang Date: Tue Dec 6 14:03:52 2022 +0800 erofs: clean up cached I/O strategies After commit 4c7e42552b3a ("erofs: remove useless cache strategy of DELAYEDALLOC"), only one cached I/O allocation strategy is supported: When cached I/O is preferred, page allocation is applied without direct reclaim. If allocation fails, fall back to inplace I/O. Let's get rid of z_erofs_cache_alloctype. No logical changes. Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Yue Hu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20221206060352.152830-1-xiang@kernel.org commit 2109901d49c5876cb424c55a520c750982d68593 Author: Gao Xiang Date: Wed Nov 30 17:56:05 2022 +0800 erofs: update documentation - Refine highlights for main features; - Add multi-reference pclusters and fragment description. Signed-off-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20221130095605.4656-1-hsiangkao@linux.alibaba.com commit 15309fb26b87767b4c8b017a628424e3c3b2f69e Author: Russell King (Oracle) Date: Sat Dec 3 17:25:15 2022 +0000 net: sfp: clean up i2c-bus property parsing We currently have some complicated code in sfp_probe() which gets the I2C bus depending on whether the sfp node is DT or ACPI, and we use completely separate lookup functions. This could do with being in a separate function to make the code more readable, so move it to a new function, sfp_i2c_get(). We can also use fwnode_find_reference() to lookup the I2C bus fwnode before then decending into fwnode-type specific parsing. A future cleanup would be to move the fwnode-type specific parsing into the i2c layer, which is where it really should be. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1p1WGJ-0098wS-4w@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 27f2a2dcc6261406b509b5022a1e5c23bf622830 Author: Hou Tao Date: Fri Nov 25 19:08:22 2022 +0800 erofs: check the uniqueness of fsid in shared domain in advance When shared domain is enabled, doing mount twice with the same fsid and domain_id will trigger sysfs warning as shown below: sysfs: cannot create duplicate filename '/fs/erofs/d0,meta.bin' CPU: 15 PID: 1051 Comm: mount Not tainted 6.1.0-rc6+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x38/0x49 dump_stack+0x10/0x12 sysfs_warn_dup.cold+0x17/0x27 sysfs_create_dir_ns+0xb8/0xd0 kobject_add_internal+0xb1/0x240 kobject_init_and_add+0x71/0xa0 erofs_register_sysfs+0x89/0x110 erofs_fc_fill_super+0x98c/0xaf0 vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20 erofs_fc_get_tree+0x20/0x30 vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0 __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The reason is erofs_fscache_register_cookie() doesn't guarantee the primary data blob (aka fsid) is unique in the shared domain and erofs_register_sysfs() invoked by the second mount will fail due to the duplicated fsid in the shared domain and report warning. It would be better to check the uniqueness of fsid before doing erofs_register_sysfs(), so adding a new flags parameter for erofs_fscache_register_cookie() and doing the uniqueness check if EROFS_REG_COOKIE_NEED_NOEXIST is enabled. After the patch, the error in dmesg for the duplicated mount would be: erofs: ...: erofs_domain_register_cookie: XX already exists in domain YY Reviewed-by: Jia Zhu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20221125110822.3812942-1-houtao@huaweicloud.com Fixes: 7d41963759fe ("erofs: Support sharing cookies in the same domain") Signed-off-by: Gao Xiang commit ce529cc25b184e93397b94a8a322128fc0095cbb Author: Jingbo Xu Date: Wed Nov 30 14:04:55 2022 +0800 erofs: enable large folios for iomap mode Enable large folios for iomap mode. Then the readahead routine will pass down large folios containing multiple pages. Let's enable this for non-compressed format for now, until the compression part supports large folios later. When large folios supported, the iomap routine will allocate iomap_page for each large folio and thus we need iomap_release_folio() and iomap_invalidate_folio() to free iomap_page when these folios get reclaimed or invalidated. Signed-off-by: Jingbo Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20221130060455.44532-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit d8939cb0a03ce7e4e69f65bbd31b79fe42f7d5e6 Author: Dave Marchevsky Date: Tue Dec 6 15:09:48 2022 -0800 bpf: Loosen alloc obj test in verifier's reg_btf_record btf->struct_meta_tab is populated by btf_parse_struct_metas in btf.c. There, a BTF record is created for any type containing a spin_lock or any next-gen datastructure node/head. Currently, for non-MAP_VALUE types, reg_btf_record will only search for a record using struct_meta_tab if the reg->type exactly matches (PTR_TO_BTF_ID | MEM_ALLOC). This exact match is too strict: an "allocated obj" type - returned from bpf_obj_new - might pick up other flags while working its way through the program. Loosen the check to be exact for base_type and just use MEM_ALLOC mask for type_flag. This patch is marked Fixes as the original intent of reg_btf_record was unlikely to have been to fail finding btf_record for valid alloc obj types with additional flags, some of which (e.g. PTR_UNTRUSTED) are valid register type states for alloc obj independent of this series. However, I didn't find a specific broken repro case outside of this series' added functionality, so it's possible that nothing was triggering this logic error before. Signed-off-by: Dave Marchevsky cc: Kumar Kartikeya Dwivedi Fixes: 4e814da0d599 ("bpf: Allow locking bpf_spin_lock in allocated objects") Link: https://lore.kernel.org/r/20221206231000.3180914-2-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit b93884eea26f97a3dc4c1df8c64389cbb0673001 Author: Kees Cook Date: Fri Dec 2 13:24:22 2022 -0800 net/ncsi: Silence runtime memcpy() false positive warning The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a flexible array structure that overlapping with non-flex-array members (mfr_id) intentionally. Since the mem_to_flex() API is not finished, temporarily silence this warning, since it is a false positive, using unsafe_memcpy(). Reported-by: Joel Stanley Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/ Cc: Samuel Mendoza-Jonas Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221202212418.never.837-kees@kernel.org Signed-off-by: Jakub Kicinski commit 9ecb7a4b8ac67c1a73fefd17bc00e943d7f74378 Author: Janne Grunau Date: Tue Dec 6 23:38:46 2022 +0100 arm64: dts: apple: Add t8103 L1/L2 cache properties and nodes The t8103 CPU nodes are missing the cache hierarchy information. The cache hierarchy on Arm can not be detected and needs to be described in DT. The OS scheduler can make use of this information for scheduling decisions. The cache size information is based on various articles about the processors. There's also an L3 system level cache (SLC). It's not described here because SLCs typically have some MMIO interface which would need to be described. Based on Rob Herring's patch adding cache properties and nodes for t600x. Link: https://lore.kernel.org/asahi/20221122220619.659174-1-robh@kernel.org/ Signed-off-by: Janne Grunau Signed-off-by: Hector Martin commit 63bf0b66ddfa6761dd47350b8d1f7161a06e9954 Author: Hector Martin Date: Mon Dec 5 19:02:11 2022 +0900 arm64: dts: apple: Rename dart-sio* to sio-dart* All the other DARTs are named foo-dart, so let's keep things consistent. Fixes: 51979fbb7fb8 ("arm64: dts: apple: t600x: Add MCA and its support") Fixes: 8a3df85ad87d ("arm64: dts: apple: t8103: Add MCA and its support") Reviewed-by: Sven Peter Reviewed-by: Mark Kettenis Signed-off-by: Hector Martin commit 9742350931df69f8aad7a764ff6286ac069305f5 Author: Janne Grunau Date: Tue Dec 6 23:57:37 2022 +0100 arch: arm64: apple: t600x: Use standard "iommu" node name The PCIe iommu nodes use "dart" as node names. Replace it with the the standard "iommu" node name as all other iommu nodes. Fixes: 7b0b0191a2c7 ("arm64: dts: apple: Add initial t6000/t6001/t6002 DTs") Signed-off-by: Janne Grunau Reviewed-by: Mark Kettenis Signed-off-by: Hector Martin commit 56d32c51dffac8a431b472a4c31efb8563b048d1 Author: Janne Grunau Date: Tue Dec 6 23:57:36 2022 +0100 arch: arm64: apple: t8103: Use standard "iommu" node name The PCIe iommu nodes use "dart" as node names. Replace it with the the standard "iommu" node name as all other iommu nodes. Fixes: 3c866bb79577 ("arm64: dts: apple: t8103: Add PCIe DARTs") Signed-off-by: Janne Grunau Reviewed-by: Mark Kettenis Signed-off-by: Hector Martin commit 156ed20d22ee68d470232d26ae6df2cefacac4a0 Author: David Vernet Date: Tue Dec 6 15:05:38 2022 -0600 bpf: Don't use rcu_users to refcount in task kfuncs A series of prior patches added some kfuncs that allow struct task_struct * objects to be used as kptrs. These kfuncs leveraged the 'refcount_t rcu_users' field of the task for performing refcounting. This field was used instead of 'refcount_t usage', as we wanted to leverage the safety provided by RCU for ensuring a task's lifetime. A struct task_struct is refcounted by two different refcount_t fields: 1. p->usage: The "true" refcount field which task lifetime. The task is freed as soon as this refcount drops to 0. 2. p->rcu_users: An "RCU users" refcount field which is statically initialized to 2, and is co-located in a union with a struct rcu_head field (p->rcu). p->rcu_users essentially encapsulates a single p->usage refcount, and when p->rcu_users goes to 0, an RCU callback is scheduled on the struct rcu_head which decrements the p->usage refcount. Our logic was that by using p->rcu_users, we would be able to use RCU to safely issue refcount_inc_not_zero() a task's rcu_users field to determine if a task could still be acquired, or was exiting. Unfortunately, this does not work due to p->rcu_users and p->rcu sharing a union. When p->rcu_users goes to 0, an RCU callback is scheduled to drop a single p->usage refcount, and because the fields share a union, the refcount immediately becomes nonzero again after the callback is scheduled. If we were to split the fields out of the union, this wouldn't be a problem. Doing so should also be rather non-controversial, as there are a number of places in struct task_struct that have padding which we could use to avoid growing the structure by splitting up the fields. For now, so as to fix the kfuncs to be correct, this patch instead updates bpf_task_acquire() and bpf_task_release() to use the p->usage field for refcounting via the get_task_struct() and put_task_struct() functions. Because we can no longer rely on RCU, the change also guts the bpf_task_acquire_not_zero() and bpf_task_kptr_get() functions pending a resolution on the above problem. In addition, the task fixes the kfunc and rcu_read_lock selftests to expect this new behavior. Fixes: 90660309b0c7 ("bpf: Add kfuncs for storing struct task_struct * as a kptr") Fixes: fca1aa75518c ("bpf: Handle MEM_RCU type properly") Reported-by: Matus Jokay Signed-off-by: David Vernet Link: https://lore.kernel.org/r/20221206210538.597606-1-void@manifault.com Signed-off-by: Alexei Starovoitov commit 235d2ef22cabb0ae68e2a1eca011acad32846bb9 Merge: c21dc529baba1 d0c0b48c87274 Author: Andrii Nakryiko Date: Tue Dec 6 16:31:26 2022 -0800 Merge branch 'BPF selftests fixes' Daan De Meyer says: ==================== This patch series fixes a few issues I've found while integrating the bpf selftests into systemd's mkosi development environment. ==================== Signed-off-by: Andrii Nakryiko commit d0c0b48c87274b7735f8c930a7c0d783fb46cfe9 Author: Daan De Meyer Date: Mon Dec 5 14:16:18 2022 +0100 selftests/bpf: Use CONFIG_TEST_BPF=m instead of CONFIG_TEST_BPF=y CONFIG_TEST_BPF can only be a module, so let's indicate it as such in the selftests config. Signed-off-by: Daan De Meyer Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221205131618.1524337-4-daan.j.demeyer@gmail.com commit efe7fadbd59ec4513272c722403226e47321311b Author: Daan De Meyer Date: Mon Dec 5 14:16:17 2022 +0100 selftests/bpf: Use "is not set" instead of "=n" "=n" is not valid kconfig syntax. Use "is not set" instead to indicate the option should be disabled. Signed-off-by: Daan De Meyer Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221205131618.1524337-3-daan.j.demeyer@gmail.com commit d68ae4982cb773f3d738b5dc25f77f5c7550548a Author: Daan De Meyer Date: Mon Dec 5 14:16:16 2022 +0100 selftests/bpf: Install all required files to run selftests When installing the selftests using "make -C tools/testing/selftests install", we need to make sure all the required files to run the selftests are installed. Let's make sure this is the case. Signed-off-by: Daan De Meyer Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221205131618.1524337-2-daan.j.demeyer@gmail.com commit 8939c58d68f97ce530f02d46c9f2b56c3ec88399 Author: Max Filippov Date: Mon Dec 5 13:19:21 2022 -0800 xtensa: add __umulsidi3 helper xtensa gcc-13 has changed multiplication handling and may now use __umulsidi3 helper where it used to use __muldi3. As a result building the kernel with the new gcc may fail with the following error: linux/init/main.c:1287: undefined reference to `__umulsidi3' Fix the build by providing __umulsidi3 implementation for xtensa. Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Max Filippov commit 8eb687bc806932fc65de4cf60c4ecf913182231d Author: Roberto Sassu Date: Mon Nov 28 15:42:40 2022 +0100 lsm: Add/fix return values in lsm_hooks.h and fix formatting Ensure that for non-void LSM hooks there is a description of the return values. Also, replace spaces with tab for indentation, remove empty lines between the hook description and the list of parameters, adjust semicolons and add the period at the end of the parameter description. Finally, move the description of gfp parameter of the xfrm_policy_alloc_security hook together with the others. Signed-off-by: Roberto Sassu [PM: /replaces./replaced./] Signed-off-by: Paul Moore commit c21dc529baba16d6698a396eb997fee318300ee1 Author: Timo Hunziker Date: Sat Dec 3 12:37:46 2022 +0000 libbpf: Parse usdt args without offset on x86 (e.g. 8@(%rsp)) Parse USDT arguments like "8@(%rsp)" on x86. These are emmited by SystemTap. The argument syntax is similar to the existing "memory dereference case" but the offset left out as it's zero (i.e. read the value from the address in the register). We treat it the same as the the "memory dereference case", but set the offset to 0. I've tested that this fixes the "unrecognized arg #N spec: 8@(%rsp).." error I've run into when attaching to a probe with such an argument. Attaching and reading the correct argument values works. Something similar might be needed for the other supported architectures. [0] Closes: https://github.com/libbpf/libbpf/issues/559 Signed-off-by: Timo Hunziker Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221203123746.2160-1-timo.hunziker@eclipso.ch commit 364ffd2537c44cb6914ff5669153f4a86fffad29 Author: Xingjiang Qiao Date: Tue Dec 6 13:53:31 2022 +0800 hwmon: (emc2305) fix pwm never being able to set lower There are fields 'last_hwmon_state' and 'last_thermal_state' in the structure 'emc2305_cdev_data', which respectively store the cooling state set by the 'hwmon' and 'thermal' subsystem, and the driver author hopes that if the state set by 'hwmon' is lower than the value set by 'thermal', the driver will just save it without actually setting the pwm. Currently, the 'last_thermal_state' also be updated by 'hwmon', which will cause the cooling state to never be set to a lower value. This patch fixes that. Signed-off-by: Xingjiang Qiao Link: https://lore.kernel.org/r/20221206055331.170459-2-nanpuyue@gmail.com Fixes: 0d8400c5a2ce1 ("hwmon: (emc2305) add support for EMC2301/2/3/5 RPM-based PWM Fan Speed Controller.") [groeck: renamed emc2305_set_cur_state_shim -> __emc2305_set_cur_state] Signed-off-by: Guenter Roeck commit 9b5f77efb0dc71d95403b528756e39b6cae0b948 Author: Dan Williams Date: Mon Dec 5 20:28:40 2022 -0800 cxl/pci: Remove endian confusion readl() already handles endian conversion. That's the main difference between readl() and __raw_readl(). This is benign on little-endian systems, but big endian systems will end up byte-swabbing twice. Fixes: 2905cb5236cb ("cxl/pci: Add (hopeful) error handling support") Cc: Jonathan Cameron Cc: Dave Jiang Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030092025.4045167.10651070153523351093.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 372ab3bc3711db46ae1205401c2aac2ed16fc348 Author: Dan Williams Date: Mon Dec 5 20:28:34 2022 -0800 cxl/pci: Add some type-safety to the AER trace points The first argument to the CXL AER trace points is the source device. Pass a 'const struct device *' rather than a 'const char *' for more type precision / safety. Cc: Jonathan Cameron Cc: Dave Jiang Cc: Steven Rostedt Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030091477.4045167.15174636482098463885.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 4d50591ebf60ccf79380fff3a4c23659c61c482f Author: Xingjiang Qiao Date: Tue Dec 6 13:53:30 2022 +0800 hwmon: (emc2305) fix unable to probe emc2301/2/3 The definitions of 'EMC2305_REG_PRODUCT_ID' and 'EMC2305_REG_DEVICE' are both '0xfd', they actually return the same value, but the values returned by emc2301/2/3/5 are different, so probe emc2301/2/3 will fail, This patch fixes that. Signed-off-by: Xingjiang Qiao Link: https://lore.kernel.org/r/20221206055331.170459-1-nanpuyue@gmail.com Fixes: 0d8400c5a2ce1 ("hwmon: (emc2305) add support for EMC2301/2/3/5 RPM-based PWM Fan Speed Controller.") Signed-off-by: Guenter Roeck commit 7fe898041fb0c8e630504ecc2cb8805651ac85c1 Author: Dan Williams Date: Mon Dec 5 20:22:44 2022 -0800 cxl/security: Drop security command ioctl uapi CXL PMEM security operations are routed through the NVDIMM sysfs interface. For this reason the corresponding commands are marked "exclusive" to preclude collisions between the ioctl ABI and the sysfs ABI. However, a better way to preclude that collision is to simply remove the ioctl ABI (command-id definitions) for those operations. Now that cxl_internal_send_cmd() (formerly cxl_mbox_send_cmd()) no longer needs to talk the cxl_mem_commands array, all of the uapi definitions for the security commands can be dropped. These never appeared in a released kernel, so no regression risk. Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030056464.4044561.11486507095384253833.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 2aeaf663b85e436dc6287692b7561ffbf0aa4381 Author: Dan Williams Date: Mon Dec 5 20:22:39 2022 -0800 cxl/mbox: Add variable output size validation for internal commands cxl_internal_send_cmd() skips output size validation for variable output commands which is not ideal. Most of the time internal usages want to fail if the output size does not match what was requested. For other commands where the caller cannot predict the size there is usually a a header that conveys how much vaild data is in the payload. For those cases add @min_out as a parameter to specify what the minimum response payload needs to be for the caller to parse the rest of the payload. In this patch only Get Supported Logs has that behavior, but going forward records retrieval commands like Get Poison List and Get Event Records can use @min_out to retrieve a variable amount of records. Critically, this validation scheme skips the needs to interrogate the cxl_mem_commands array which in turn frees up the implementation to support internal command enabling without also enabling external / user commands. Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030055918.4044561.10339573829837910505.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 5331cdf44dc389ac56f7ba5c24ca52d13eaad8d7 Author: Dan Williams Date: Mon Dec 5 20:22:33 2022 -0800 cxl/mbox: Enable cxl_mbox_send_cmd() users to validate output size Internally cxl_mbox_send_cmd() converts all passed-in parameters to a 'struct cxl_mbox_cmd' instance and sends that to cxlds->mbox_send(). It then teases the possibilty that the caller can validate the output size. However, they cannot since the resulting output size is not conveyed to the called. Fix that by making the caller pass in a constructed 'struct cxl_mbox_cmd'. This prepares for a future patch to add output size validation on a per-command basis. Given the change in signature, also change the name to differentiate it from the user command submission path that performs more validation before generating the 'struct cxl_mbox_cmd' instance to execute. Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030055370.4044561.17788093375112783036.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit f5ee4cc19c3eff4459931b6fe8f29d1e0cc204a5 Author: Dan Williams Date: Mon Dec 5 20:22:28 2022 -0800 cxl/security: Fix Get Security State output payload endian handling Multi-byte integer values in CXL mailbox payloads are little endian. Add a definition of the Get Security State output payload and convert the value before testing flags. Fixes: 328281155539 ("cxl/pmem: Introduce nvdimm_security_ops with ->get_flags() operation") Cc: Jonathan Cameron Cc: Dave Jiang Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/167030054822.4044561.4917796262037689553.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 361dd63ed5f1103ff21e22408a142a7d40804527 Author: Roberto Sassu Date: Mon Nov 28 15:42:39 2022 +0100 lsm: Clarify documentation of vm_enough_memory hook include/linux/lsm_hooks.h reports the result of the LSM infrastructure to the callers, not what LSMs should return to the LSM infrastructure. Clarify that and add that if all LSMs return a positive value __vm_enough_memory() will be called with cap_sys_admin set. If at least one LSM returns 0 or negative, it will be called with cap_sys_admin cleared. Signed-off-by: Roberto Sassu Signed-off-by: Paul Moore commit 88615cfb3184085a8a903bf94818985e8f3bf325 Author: Geert Uytterhoeven Date: Fri Dec 2 17:49:20 2022 +0100 ARM: dts: socfpga: Fix pca9548 i2c-mux node name "make dtbs_check": arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dtb: i2cswitch@70: $nodename:0: 'i2cswitch@70' does not match '^(i2c-?)?mux' From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dtb: i2cswitch@70: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@0', 'i2c@1', 'i2c@2', 'i2c@3', 'i2c@4', 'i2c@5', 'i2c@6', 'i2c@7' were unexpected) From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml Fix this by renaming the PCA9548 node to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification. Signed-off-by: Geert Uytterhoeven Signed-off-by: Dinh Nguyen commit f5642c7f2bbe6b152e686e0973eaf534e054eb66 Author: Krzysztof Kozlowski Date: Mon Dec 5 17:42:54 2022 +0100 dt-bindings: Drop Jee Heng Sia Emails to Jee Heng Sia bounce ("550 #5.1.0 Address rejected."). Add Keembay platform maintainers as Keembay I2S maintainers. Signed-off-by: Krzysztof Kozlowski Acked-by: Mark Brown Link: https://lore.kernel.org/r/20221205164254.36418-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 8119aaba20fdfa0eaefaa7bb13d869693052ec57 Author: Rob Herring Date: Fri Nov 4 11:24:50 2022 -0500 dt-bindings: thermal: cooling-devices: Add missing cache related properties The examples' cache nodes are incomplete as 'cache-unified' and 'cache-level' are required cache properties. Acked-by: Amit Kucheria Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221104162450.1982114-1-robh@kernel.org Signed-off-by: Rob Herring commit b27915453db3f36f04148fced5e282eb27f00bcf Author: Krzysztof Kozlowski Date: Sun Dec 4 11:43:23 2022 +0100 dt-bindings: leds: irled: ir-spi-led: convert to DT schema Convert the SPI IR LED bindings to DT schema. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221204104323.117974-3-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 0212be85e7512b639116b215519bc9aabedf1a5c Author: Krzysztof Kozlowski Date: Sun Dec 4 11:43:22 2022 +0100 dt-bindings: leds: irled: pwm-ir-tx: convert to DT schema Convert the PWM IR LED bindings to DT schema. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221204104323.117974-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 0542aac494a75f6d467109349e0266d7116e2b77 Author: Krzysztof Kozlowski Date: Sun Dec 4 11:43:21 2022 +0100 dt-bindings: leds: irled: gpio-ir-tx: convert to DT schema Convert the GPIO IR LED bindings to DT schema. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221204104323.117974-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 960c2de7a15477863d3c6a5c0f774dc8da318ea3 Author: Krzysztof Kozlowski Date: Sun Nov 27 21:40:57 2022 +0100 dt-bindings: leds: mt6360: rework to match multi-led The binding allows two type of LEDs - single and multi-color. They differ with properties, so fix the bindings to accept both cases. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221127204058.57111-6-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit b82fa8538497dc214b1be514b3d10c598ccccd59 Author: Krzysztof Kozlowski Date: Sun Nov 27 21:40:56 2022 +0100 dt-bindings: leds: lp55xx: rework to match multi-led The binding allows two type of LEDs - single and multi-color. They differ with properties, so fix the bindings to accept both cases. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221127204058.57111-5-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 49b939b711217f33c7b95c3cf0e08a6f91f96adf Author: Krzysztof Kozlowski Date: Sun Nov 27 21:40:55 2022 +0100 dt-bindings: leds: lp55xx: switch to preferred 'gpios' suffix The preferred name suffix for properties with single and multiple GPIOs is "gpios". Linux GPIO core code supports both. The DTS has mixed usage, so switch to preferred naming: omap3-n900.dtb: lp5523@32: 'enable-gpios' does not match any of the regexes: '^led@[0-8]$', '^multi-led@[0-8]$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221127204058.57111-4-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit d1188adb2dabcd1f4535b911d5b549ac66e21041 Author: Krzysztof Kozlowski Date: Sun Nov 27 21:40:54 2022 +0100 dt-bindings: leds: lp55xx: allow label The Linux driver and at least one upstream board use 'label' property: qcom/msm8996-xiaomi-gemini.dtb: lp5562@30: 'label' does not match any of the regexes: '^led@[0-8]$', '^multi-led@[0-8]$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221127204058.57111-3-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit fe469e83eb5b383c8abbf1d1cab7a038e3d6778b Author: Krzysztof Kozlowski Date: Sun Nov 27 21:40:53 2022 +0100 dt-bindings: leds: use unevaluatedProperties for common.yaml The common.yaml schema allows further properties, so the bindings using it should restrict it with unevaluatedProperties:false. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221127204058.57111-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 47612a9fc4b822027200596da16669f596a7c9ff Author: Adam Skladowski Date: Wed Nov 30 21:09:40 2022 +0100 dt-bindings: thermal: tsens: Add SM6115 compatible Document compatible for tsens on Qualcomm SM6115 platform according to downstream dts it ship v2.4 of IP Signed-off-by: Adam Skladowski Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221130200950.144618-3-a39.skl@gmail.com Signed-off-by: Rob Herring commit e553ad8d7957697385e81034bf76db3b2cb2cf27 Author: Rob Herring Date: Mon Nov 28 14:24:39 2022 -0600 of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values "linux,initrd-start" and "linux,initrd-end" can be 32-bit values even on a 64-bit platform. Ideally, the size should be based on '#address-cells', but that has never been enforced in the kernel's FDT boot parsing code (early_init_dt_check_for_initrd()). Bootloader behavior is known to vary. For example, kexec always writes these as 64-bit. The result of incorrectly reading 32-bit values is most likely the reserved memory for the original initrd will still be reserved for the new kernel. The original arm64 equivalent of this code failed to release the initrd reserved memory in *all* cases. Use of_read_number() to mirror the early_init_dt_check_for_initrd() code. Fixes: b30be4dc733e ("of: Add a common kexec FDT setup function") Cc: stable@vger.kernel.org Reported-by: Peter Maydell Link: https://lore.kernel.org/r/20221128202440.1411895-1-robh@kernel.org Signed-off-by: Rob Herring commit 93266da2409b1709474be00f1becbbdaddb2b706 Author: Uwe Kleine-König Date: Tue Nov 29 19:04:14 2022 +0100 dt-bindings: display: Convert fsl,imx-fb.txt to dt-schema Compared to the txt description this adds clocks and clock-names to match reality. Note that fsl,imx-lcdc was picked as the new name as this is the actual hardware's name. There will be a new binding implementing the saner drm concept that is supposed to supersede this legacy fb binding Signed-off-by: Uwe Kleine-König Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221129180414.2729091-1-u.kleine-koenig@pengutronix.de Signed-off-by: Rob Herring commit 7621aabdae410cfc0c28358baab7ae13c551aa7c Author: Rob Herring Date: Fri Nov 18 16:37:27 2022 -0600 dt-bindings: Add missing start and/or end of line regex anchors json-schema patterns by default will match anywhere in a string, so typically we want at least the start or end anchored. Fix the obvious cases where the anchors were forgotten. Acked-by: Matti Vaittinen Acked-by: Viresh Kumar Acked-by: Yoshihiro Shimoda Reviewed-by: Geert Uytterhoeven Acked-by: Mark Brown Acked-by: Sergio Paracuellos Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20221118223728.1721589-1-robh@kernel.org Signed-off-by: Rob Herring commit f980520b0747e5621930e0420cd0be54cbdddeb3 Author: Luca Weiss Date: Thu Oct 13 11:12:08 2022 +0200 dt-bindings: qcom,pdc: Add missing compatibles Document the compatibles that are already in use in the upstream Linux kernel to resolve dtbs_check warnings. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221013091208.356739-1-luca.weiss@fairphone.com Signed-off-by: Rob Herring commit 642bb6a736fc5a7fec9ef9f5487f0abd71a1dc31 Author: André Apitzsch Date: Thu May 5 20:53:44 2022 +0200 dt-bindings: leds: sgm3140: Document ocp8110 compatible Add devicetree binding for Orient Chip OCP8110 charge pump used for camera flash LEDs. Signed-off-by: André Apitzsch Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220505185344.10067-1-git@apitzsch.eu Signed-off-by: Rob Herring commit 43e6f4577d4dafa932a61bdef3971b711eca425a Author: Rob Herring Date: Fri Nov 18 16:37:07 2022 -0600 dt-bindings: Move fixed string node names under 'properties' Fixed string node names should be under 'properties' rather than 'patternProperties'. Additionally, without beginning and end of line anchors, any prefix or suffix is allowed on the specified node name. These cases don't appear to want a prefix or suffix, so move them under 'properties'. In some cases, the diff turns out to look like we're moving some patterns rather than the fixed string properties. Reviewed-by: Krzysztof Kozlowski Acked-by: Mark Brown Link: https://lore.kernel.org/r/20221118223708.1721134-1-robh@kernel.org Signed-off-by: Rob Herring commit 11b932815484fae85f5fe5a45d9fb856c102c2bc Author: Uwe Kleine-König Date: Fri Nov 18 23:44:03 2022 +0100 of: unittest: Convert to i2c's .probe_new() In struct i2c_driver, field new_probe replaces the soon to be deprecated field probe. Update unittest for this change. The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Frank Rowand Link: https://lore.kernel.org/r/20221118224540.619276-510-uwe@kleine-koenig.org [robh: Add Frank's commit msg addition] Signed-off-by: Rob Herring commit 3c75ce7cc3a31cabe97ff3e5a0d7e97eda5a7a2d Author: Rob Herring Date: Fri Nov 11 15:28:56 2022 -0600 dt-bindings: Drop type from 'cpus' property 'cpus' is a common property, and it is now defined in dtschema schemas, so drop the type references in the tree. Acked-by: Suzuki K Poulose Acked-by: Bjorn Andersson Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20221111212857.4104308-1-robh@kernel.org Signed-off-by: Rob Herring commit 0e513d84c04160227c892db022c71b961c9834cd Author: Rob Herring Date: Fri Nov 11 10:27:29 2022 -0600 dt-bindings: thermal: thermal-idle: Fix example paths The reference by path (&{/cpus/cpu@101/thermal-idle}) in the example causes an error with new version of dtc: FATAL ERROR: Can't generate fixup for reference to path &{/cpus/cpu@100/thermal-idle} This is because the examples are built as an overlay and absolute paths are not valid as references must be by label. The path was also not resolvable because, by default, examples are placed under 'example-N' nodes. As the example contains top-level nodes, the root node must be explicit for the example to be extracted as-is. This changes the indentation for the whole example, but the existing indentation is a mess of of random amounts. Clean this up to be 4 spaces everywhere. Link: https://lore.kernel.org/r/20221111162729.3381835-1-robh@kernel.org Signed-off-by: Rob Herring commit aa67961f3243dfff26c47769f87b4d94b07ec71f Author: Martin KaFai Lau Date: Tue Dec 6 11:35:54 2022 -0800 selftests/bpf: Allow building bpf tests with CONFIG_XFRM_INTERFACE=[m|n] It is useful to use vmlinux.h in the xfrm_info test like other kfunc tests do. In particular, it is common for kfunc bpf prog that requires to use other core kernel structures in vmlinux.h Although vmlinux.h is preferred, it needs a ___local flavor of struct bpf_xfrm_info in order to build the bpf selftests when CONFIG_XFRM_INTERFACE=[m|n]. Cc: Eyal Birger Fixes: 90a3a05eb33f ("selftests/bpf: add xfrm_info tests") Signed-off-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20221206193554.1059757-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov commit fa55ef14ef4fe06198c0ce811b603aec24134bc2 Author: Miaoqian Lin Date: Tue Dec 6 11:19:06 2022 +0400 bpftool: Fix memory leak in do_build_table_cb strdup() allocates memory for path. We need to release the memory in the following error path. Add free() to avoid memory leak. Fixes: 8f184732b60b ("bpftool: Switch to libbpf's hashmap for pinned paths of BPF objects") Signed-off-by: Miaoqian Lin Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20221206071906.806384-1-linmq006@gmail.com commit b54b6003612a376e7be32cbc5c1af3754bbbbb3d Author: Pu Lehui Date: Tue Dec 6 17:14:10 2022 +0800 riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC For BPF_PSEUDO_FUNC instruction, verifier will refill imm with correct addresses of bpf_calls and then run last pass of JIT. Since the emit_imm of RV64 is variable-length, which will emit appropriate length instructions accorroding to the imm, it may broke ctx->offset, and lead to unpredictable problem, such as inaccurate jump. So let's fix it with fixed-length instructions. Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") Suggested-by: Björn Töpel Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20221206091410.1584784-1-pulehui@huaweicloud.com commit f2240b4441cc5bd87820371ee79ad7c9125e76b6 Author: Shameer Kolothum Date: Wed Nov 23 11:32:36 2022 +0000 hisi_acc_vfio_pci: Enable PRE_COPY flag Now that we have everything to support the PRE_COPY state, enable it. Signed-off-by: Shameer Kolothum Link: https://lore.kernel.org/r/20221123113236.896-5-shameerali.kolothum.thodi@huawei.com Signed-off-by: Alex Williamson commit 190125adcad4c5850fd74ecd697e20a446b74ed8 Author: Shameer Kolothum Date: Wed Nov 23 11:32:35 2022 +0000 hisi_acc_vfio_pci: Move the dev compatibility tests for early check Instead of waiting till data transfer is complete to perform dev compatibility, do it as soon as we have enough data to perform the check. This will be useful when we enable the support for PRE_COPY. Signed-off-by: Shameer Kolothum Link: https://lore.kernel.org/r/20221123113236.896-4-shameerali.kolothum.thodi@huawei.com Signed-off-by: Alex Williamson commit d9a871e4a143047d1d84a606772af319f11516f9 Author: Shameer Kolothum Date: Wed Nov 23 11:32:34 2022 +0000 hisi_acc_vfio_pci: Introduce support for PRE_COPY state transitions The saving_migf is open in PRE_COPY state if it is supported and reads initial device match data. hisi_acc_vf_stop_copy() is refactored to make use of common code. Signed-off-by: Shameer Kolothum Link: https://lore.kernel.org/r/20221123113236.896-3-shameerali.kolothum.thodi@huawei.com Signed-off-by: Alex Williamson commit 64ffbbb1e948876dd9044c32a3ab8a790662b9bb Author: Shameer Kolothum Date: Wed Nov 23 11:32:33 2022 +0000 hisi_acc_vfio_pci: Add support for precopy IOCTL PRECOPY IOCTL in the case of HiSiIicon ACC driver can be used to perform the device compatibility check earlier during migration. Signed-off-by: Shameer Kolothum Link: https://lore.kernel.org/r/20221123113236.896-2-shameerali.kolothum.thodi@huawei.com Signed-off-by: Alex Williamson commit ccc2a52e464d1c983efede1a6d44728c151cb2ed Author: Shay Drory Date: Tue Dec 6 10:34:38 2022 +0200 vfio/mlx5: Enable MIGRATION_PRE_COPY flag Now that everything has been set up for MIGRATION_PRE_COPY, enable it. Signed-off-by: Shay Drory Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-15-yishaih@nvidia.com Signed-off-by: Alex Williamson commit d6e18a4bec431c181a60d32876c6c89955b2a4f8 Author: Shay Drory Date: Tue Dec 6 10:34:37 2022 +0200 vfio/mlx5: Fallback to STOP_COPY upon specific PRE_COPY error Before a SAVE command is issued, a QUERY command is issued in order to know the device data size. In case PRE_COPY is used, the above commands are issued while the device is running. Thus, it is possible that between the QUERY and the SAVE commands the state of the device will be changed significantly and thus the SAVE will fail. Currently, if a SAVE command is failing, the driver will fail the migration. In the above case, don't fail the migration, but don't allow for new SAVEs to be executed while the device is in a RUNNING state. Once the device will be moved to STOP_COPY, SAVE can be executed again and the full device state will be read. Signed-off-by: Shay Drory Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-14-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 34e2f27143d1b373f088e805f7e11cdf778f791d Author: Yishai Hadas Date: Tue Dec 6 10:34:36 2022 +0200 vfio/mlx5: Introduce multiple loads In order to support PRE_COPY, mlx5 driver transfers multiple states (images) of the device. e.g.: the source VF can save and transfer multiple states, and the target VF will load them by that order. This patch implements the changes for the target VF to decompose the header for each state and to write and load multiple states. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-13-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 81156c27271c4a6c594e492c8d119fbacfc99f36 Author: Yishai Hadas Date: Tue Dec 6 10:34:35 2022 +0200 vfio/mlx5: Consider temporary end of stream as part of PRE_COPY During PRE_COPY the migration data FD may have a temporary "end of stream" that is reached when the initial_bytes were read and no other dirty data exists yet. For instance, this may indicate that the device is idle and not currently dirtying any internal state. When read() is done on this temporary end of stream the kernel driver should return ENOMSG from read(). Userspace can wait for more data or consider moving to STOP_COPY. To not block the user upon read() and let it get ENOMSG we add a new state named MLX5_MIGF_STATE_PRE_COPY on the migration file. In addition, we add the MLX5_MIGF_STATE_SAVE_LAST state to block the read() once we call the last SAVE upon moving to STOP_COPY. Any further error will be marked with MLX5_MIGF_STATE_ERROR and the user won't be blocked. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-12-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 0dce165b1adf8d7f67030bb257e00107db8022de Author: Yishai Hadas Date: Tue Dec 6 10:34:34 2022 +0200 vfio/mlx5: Introduce vfio precopy ioctl implementation vfio precopy ioctl returns an estimation of data available for transferring from the device. Whenever a user is using VFIO_MIG_GET_PRECOPY_INFO, track the current state of the device, and if needed, append the dirty data to the transfer FD data. This is done by saving a middle state. As mlx5 runs the SAVE command asynchronously, make sure to query for incremental data only once there is no active save command. Running both in parallel, might end-up with a failure in the incremental query command on un-tracked vhca. Also, a middle state will be saved only after the previous state has finished its SAVE command and has been fully transferred, this prevents endless use resources. Co-developed-by: Shay Drory Signed-off-by: Shay Drory Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-11-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 0c9a38fee8b210a8dfd3f177526daac567ec9265 Author: Yishai Hadas Date: Tue Dec 6 10:34:33 2022 +0200 vfio/mlx5: Introduce SW headers for migration states As mentioned in the previous patches, mlx5 is transferring multiple states when the PRE_COPY protocol is used. This states mechanism requires the target VM to know the states' size in order to execute multiple loads. Therefore, add SW header, with the needed information, for each saved state the source VM is transferring to the target VM. This patch implements the source VM handling of the headers, following patch will implement the target VM handling of the headers. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-10-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 3319d287f4c04b9deece8ea00e27a70bbe32941b Author: Yishai Hadas Date: Tue Dec 6 10:34:32 2022 +0200 vfio/mlx5: Introduce device transitions of PRE_COPY In order to support PRE_COPY, mlx5 driver is transferring multiple states (images) of the device. e.g.: the source VF can save and transfer multiple states, and the target VF will load them by that order. The device is saving three kinds of states: 1) Initial state - when the device moves to PRE_COPY state. 2) Middle state - during PRE_COPY phase via VFIO_MIG_GET_PRECOPY_INFO. There can be multiple states of this type. 3) Final state - when the device moves to STOP_COPY state. After moving to PRE_COPY state, user is holding the saving migf FD and can use it. For example: user can start transferring data via read() callback. Also, user can switch from PRE_COPY to STOP_COPY whenever he sees it fits. This will invoke saving of final state. This means that mlx5 VFIO device can be switched to STOP_COPY without transferring any data in PRE_COPY state. Therefore, when the device moves to STOP_COPY, mlx5 will store the final state on a dedicated queue entry on the list. Co-developed-by: Shay Drory Signed-off-by: Shay Drory Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-9-yishaih@nvidia.com Signed-off-by: Alex Williamson commit c668878381b5702f867ec7f43ee3b74259c6ea03 Author: Yishai Hadas Date: Tue Dec 6 10:34:31 2022 +0200 vfio/mlx5: Refactor to use queue based data chunks Refactor to use queue based data chunks on the migration file. The SAVE command adds a chunk to the tail of the queue while the read() API finds the required chunk and returns its data. In case the queue is empty but the state of the migration file is MLX5_MIGF_STATE_COMPLETE, read() may not be blocked but will return 0 to indicate end of file. This is a step towards maintaining multiple images and their meta data (i.e. headers) on the migration file as part of next patches from the series. Note: At that point, we still use a single chunk on the migration file but becomes ready to support multiple. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-8-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 8b599d143419669e57da3881d8293f17809688d7 Author: Yishai Hadas Date: Tue Dec 6 10:34:30 2022 +0200 vfio/mlx5: Refactor migration file state Refactor migration file state to be an emum which is mutual exclusive. As of that dropped the 'disabled' state as 'error' is the same from functional point of view. Next patches from the series will extend this enum for other relevant states. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-7-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 91454f8b9bf4ce6be1d9a0b4de401bc3c6313a95 Author: Yishai Hadas Date: Tue Dec 6 10:34:29 2022 +0200 vfio/mlx5: Refactor MKEY usage This patch refactors MKEY usage such as its life cycle will be as of the migration file instead of allocating/destroying it upon each SAVE/LOAD command. This is a preparation step towards the PRE_COPY series where multiple images will be SAVED/LOADED. We achieve it by having a new struct named mlx5_vhca_data_buffer which holds the mkey and its related stuff as of sg_append_table, allocated_length, etc. The above fields were taken out from the migration file main struct, into mlx5_vhca_data_buffer dedicated struct with the proper helpers in place. For now we have a single mlx5_vhca_data_buffer per migration file. However, in coming patches we'll have multiple of them to support multiple images. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-6-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 9945a67ea4b30657dd998c7fbbea1b3950747168 Author: Yishai Hadas Date: Tue Dec 6 10:34:28 2022 +0200 vfio/mlx5: Refactor PD usage This patch refactors PD usage such as its life cycle will be as of the migration file instead of allocating/destroying it upon each SAVE/LOAD command. This is a preparation step towards the PRE_COPY series where multiple images will be SAVED/LOADED and a single PD can be simply reused. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-5-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 0e7caa65d707b93fbb4322c6313f739fa9103dfa Author: Yishai Hadas Date: Tue Dec 6 10:34:27 2022 +0200 vfio/mlx5: Enforce a single SAVE command at a time Enforce a single SAVE command at a time. As the SAVE command is an asynchronous one, we must enforce running only a single command at a time. This will preserve ordering between multiple calls and protect from races on the migration file data structure. This is a must for the next patches from the series where as part of PRE_COPY we may have multiple images to be saved and multiple SAVE commands may be issued from different flows. Reviewed-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-4-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 4db52602a6074e9cc523500b8304600ff63e7b85 Author: Jason Gunthorpe Date: Tue Dec 6 10:34:26 2022 +0200 vfio: Extend the device migration protocol with PRE_COPY The optional PRE_COPY states open the saving data transfer FD before reaching STOP_COPY and allows the device to dirty track internal state changes with the general idea to reduce the volume of data transferred in the STOP_COPY stage. While in PRE_COPY the device remains RUNNING, but the saving FD is open. Only if the device also supports RUNNING_P2P can it support PRE_COPY_P2P, which halts P2P transfers while continuing the saving FD. PRE_COPY, with P2P support, requires the driver to implement 7 new arcs and exists as an optional FSM branch between RUNNING and STOP_COPY: RUNNING -> PRE_COPY -> PRE_COPY_P2P -> STOP_COPY A new ioctl VFIO_MIG_GET_PRECOPY_INFO is provided to allow userspace to query the progress of the precopy operation in the driver with the idea it will judge to move to STOP_COPY at least once the initial data set is transferred, and possibly after the dirty size has shrunk appropriately. This ioctl is valid only in PRE_COPY states and kernel driver should return -EINVAL from any other migration state. Compared to the v1 clarification, STOP_COPY -> PRE_COPY is blocked and to be defined in future. We also split the pending_bytes report into the initial and sustaining values, e.g.: initial_bytes and dirty_bytes. initial_bytes: Amount of initial precopy data. dirty_bytes: Device state changes relative to data previously retrieved. These fields are not required to have any bearing to STOP_COPY phase. It is recommended to leave PRE_COPY for STOP_COPY only after the initial_bytes field reaches zero. Leaving PRE_COPY earlier might make things slower. Signed-off-by: Jason Gunthorpe Signed-off-by: Shay Drory Reviewed-by: Kevin Tian Reviewed-by: Shameer Kolothum Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-3-yishaih@nvidia.com Signed-off-by: Alex Williamson commit c943a9374d12bebca2d0de7e273b1c723b58c122 Author: Shay Drory Date: Tue Dec 6 10:34:25 2022 +0200 net/mlx5: Introduce ifc bits for pre_copy Introduce ifc related stuff to enable PRE_COPY of VF during migration. Signed-off-by: Shay Drory Acked-by: Leon Romanovsky Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20221206083438.37807-2-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 2931aa6758da9f871b4bd7ee52a4be2f9d24e6ce Author: Luca Weiss Date: Fri Dec 2 16:12:40 2022 -0600 clk: qcom: rpmh: add support for SM6350 rpmh IPA clock The IPA core clock is required for SM6350. Define it. Signed-off-by: Luca Weiss [elder@linaro.org: rebased with Dmitry's changes] Signed-off-by: Alex Elder Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221202221240.225720-1-elder@linaro.org commit a174d29a59ec9462d3e72fd00a9fd05054c4ab20 Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:05 2022 +0200 clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names Convert the clock driver to specify parent data rather than parent names, to actually bind using 'clock-names' specified in the DTS rather than global clock names. Use parent_hws where possible to refer parent clocks directly, skipping the lookup. Note, the system names for xo clocks were changed from "xo" to "xo_board" to follow the example of other platforms. This switches the clocks to use DT-provided "xo_board" clock instead of manually registered "xo" clock and allows us to drop qcom_cc_register_board_clk() call from the driver at some point. Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-9-dmitry.baryshkov@linaro.org commit 28c6c02527757a4b3c63b30d77f7e7d5c112c085 Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:04 2022 +0200 clk: qcom: mmcc-msm8974: move clock parent tables down Move clock parent tables down, after the PLL declarataions, so that we can use pll hw clock fields in the next commit. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-8-dmitry.baryshkov@linaro.org commit 4e74e921ea0c576682ffd7981af1d4a73ceaca11 Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:03 2022 +0200 clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying num_parents Use ARRAY_SIZE() instead of manually specifying num_parents. This makes adding/removing entries to/from parent_data easy and errorproof. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-7-dmitry.baryshkov@linaro.org commit ff81be97120b6bb79f1239a184bb0c851d7ed9a7 Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:02 2022 +0200 clk: qcom: gcc-msm8974: use parent_hws/_data instead of parent_names Convert the clock driver to specify parent data rather than parent names, to actually bind using 'clock-names' specified in the DTS rather than global clock names. Use parent_hws where possible to refer parent clocks directly, skipping the lookup. Note, the system names for xo clocks were changed from "xo" to "xo_board" to follow the example of other platforms. This switches the clocks to use DT-provided "xo_board" clock instead of manually registered "xo" clock and allows us to drop qcom_cc_register_board_clk() call from the driver at some point. Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-6-dmitry.baryshkov@linaro.org commit f2b4f1490e82dec9881565b2f92467c5b6f4636d Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:01 2022 +0200 clk: qcom: gcc-msm8974: move clock parent tables down Rearrage clock parent tables and PLL declarations (pull parents down and gpll4 up), so that we can use pll hw clock fields in the next commit. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-5-dmitry.baryshkov@linaro.org commit fce760071df1f32163655c37555eec8c1577581d Author: Dmitry Baryshkov Date: Sun Dec 4 14:45:00 2022 +0200 clk: qcom: gcc-msm8974: use ARRAY_SIZE instead of specifying num_parents Use ARRAY_SIZE() instead of manually specifying num_parents. This makes adding/removing entries to/from parent_data easy and errorproof. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-4-dmitry.baryshkov@linaro.org commit e80313c70a23c1c92f1ea1749799a90a1b490be4 Author: Dmitry Baryshkov Date: Sun Dec 4 14:44:59 2022 +0200 dt-bindings: clocks: qcom,mmcc: define clocks/clock-names for MSM8974 Define clock/clock-names properties of the MMCC device node to be used on MSM8974 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-3-dmitry.baryshkov@linaro.org commit 7c9c38fc6bda7214c1af3d3e741bc99df979897d Author: Dmitry Baryshkov Date: Sun Dec 4 14:44:58 2022 +0200 dt-bindings: clock: split qcom,gcc-msm8974,-msm8226 to the separate file Move schema for the GCC on MSM8974 and MSM8226 platforms to a separate file to be able to define device-specific clock properties. Reviewed-by: Rob Herring Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204124508.1415713-2-dmitry.baryshkov@linaro.org commit b4e4f66901658fae0614dea5bf91062a5387eda7 Author: Trond Myklebust Date: Tue Dec 6 12:42:59 2022 -0500 NFSv4.x: Fail client initialisation if state manager thread can't run If the state manager thread fails to start, then we should just mark the client initialisation as failed so that other processes or threads don't get stuck in nfs_wait_client_init_complete(). Reported-by: ChenXiaoSong Fixes: 4697bd5e9419 ("NFSv4: Fix a race in the net namespace mount notification") Signed-off-by: Trond Myklebust commit 19cdc8fa5b9b768f5753eefe3da32fcbafcb0d18 Author: ye xingchen Date: Mon Dec 5 17:19:16 2022 +0800 fs: nfs: sysfs: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Signed-off-by: Trond Myklebust commit 700fa9b1b361760ca6c28e2e7d6cccbdc9fb6716 Author: ye xingchen Date: Mon Dec 5 17:13:45 2022 +0800 NFS: use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Signed-off-by: Trond Myklebust commit a60214c2465493aac0b014d87ee19327b6204c42 Author: Anna Schumaker Date: Wed Nov 30 15:30:47 2022 -0500 NFS: Allow very small rsize & wsize again 940261a19508 introduced nfs_io_size() to clamp the iosize to a multiple of PAGE_SIZE. This had the unintended side effect of no longer allowing iosizes less than a page, which could be useful in some situations. UDP already has an exception that causes it to fall back on the power-of-two style sizes instead. This patch adds an additional exception for very small iosizes. Reported-by: Jeff Layton Fixes: 940261a19508 ("NFS: Allow setting rsize / wsize to a multiple of PAGE_SIZE") Signed-off-by: Anna Schumaker Reviewed-by: Jeff Layton Signed-off-by: Trond Myklebust commit f8527028a7e52da884055c401abc04e0b0c84285 Author: Anna Schumaker Date: Wed Nov 30 13:15:26 2022 -0500 NFSv4.2: Fix up READ_PLUS alignment Assume that the first segment will be a DATA segment, and place the data directly into the xdr pages so it doesn't need to be shifted. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 36357fe74ef736524a29fbd3952948768510a8b9 Author: Anna Schumaker Date: Wed Nov 30 13:15:25 2022 -0500 NFSv4.2: Set the correct size scratch buffer for decoding READ_PLUS The scratch_buf array is 16 bytes, but I was passing 32 to the xdr_set_scratch_buffer() function. Fix this by using sizeof(), which is what I probably should have been doing this whole time. Fixes: d3b00a802c84 ("NFS: Replace the READ_PLUS decoding code") Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 50fa355bc0d75911fe9d5072a5ba52cdb803aff7 Author: Wang ShaoBo Date: Thu Nov 24 17:23:42 2022 +0800 SUNRPC: Fix missing release socket in rpc_sockname() socket dynamically created is not released when getting an unintended address family type in rpc_sockname(), direct to out_release for calling sock_release(). Fixes: 2e738fdce22f ("SUNRPC: Add API to acquire source address") Signed-off-by: Wang ShaoBo Signed-off-by: Trond Myklebust commit 9181f40fb2952fd59ecb75e7158620c9c669eee3 Author: Zhang Xiaoxu Date: Sun Nov 20 15:34:29 2022 +0800 xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() If rdma receive buffer allocate failed, should call rpcrdma_regbuf_free() to free the send buffer, otherwise, the buffer data will be leaked. Fixes: bb93a1ae2bf4 ("xprtrdma: Allocate req's regbufs at xprt create time") Signed-off-by: Zhang Xiaoxu Signed-off-by: Trond Myklebust commit db1c7d77976775483a8ef240b4c705f113e13ea1 Author: Christoph Hellwig Date: Tue Dec 6 15:44:07 2022 +0100 block: bio_copy_data_iter With the pktcdvdv removal, bio_copy_data_iter is unused now. Fold the logic into bio_copy_data and remove the separate lower level function. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20221206144407.722049-1-hch@lst.de Signed-off-by: Jens Axboe commit 51f7be212ae6c9c09e77d17468fe26485f79836d Author: Krzysztof Kozlowski Date: Thu Nov 17 13:13:07 2022 +0100 dt-bindings: iio: adc: qcom,spmi-vadc: fix PM8350 define The defines from include/dt-bindings/iio/qcom,spmi-adc7-pm8350.h were changed to take sid argument: Error: Documentation/devicetree/bindings/iio/adc/qcom,spmi-vadc.example.dts:99.28-29 syntax error Signed-off-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Acked-by: Jonathan Cameron Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221117121307.264550-1-krzysztof.kozlowski@linaro.org commit 74e903461b178faa5d0873254b77ee18fca5d059 Author: Krzysztof Kozlowski Date: Thu Oct 27 10:34:11 2022 -0400 dt-bindings: iio: adc: qcom,spmi-vadc: extend example Cleanup existing example (generic node name for spmi, use 4-space indentation) and add example for ADCv7 copied from Documentation/devicetree/bindings/thermal/qcom-spmi-adc-tm5.yaml. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221027143411.277980-2-krzysztof.kozlowski@linaro.org commit 0953777640354dc459a22369eea488603d225dd9 Author: Johan Hovold Date: Mon Dec 5 11:08:37 2022 +0100 arm64: dts: qcom: sc8280xp: fix UFS DMA coherency The SC8280XP UFS controllers are cache coherent and must be marked as such in the devicetree to avoid potential data corruption. Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Cc: stable@vger.kernel.org # 6.0 Signed-off-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221205100837.29212-3-johan+linaro@kernel.org commit 300848e05da03aa6c0ee2c353bba4b8623991cce Author: Owen Yang Date: Mon Dec 5 13:36:15 2022 +0800 arm64: dts: qcom: sc7280: Add DT for sc7280-herobrine-zombie Add DT for sc7280-herobrine-zombie Reviewed-by: Matthias Kaehlcke Reviewed-by: Douglas Anderson Signed-off-by: Owen Yang Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221205133603.v15.2.I80aa32497bfd67bc8a372c1418ccc443ccf193e4@changeid commit afa8e18bf674f00c8c3a73e295ff2f6aacdad82a Author: Krzysztof Kozlowski Date: Sun Dec 4 10:44:38 2022 +0100 arm64: dts: qcom: sm8250-sony-xperia-edo: fix no-mmc property for SDHCI There is no "no-emmc" property, so intention for SD/SDIO only nodes was to use "no-mmc": qcom/sm8250-sony-xperia-edo-pdx206.dtb: mmc@8804000: Unevaluated properties are not allowed ('no-emmc' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204094438.73288-6-krzysztof.kozlowski@linaro.org commit 796d8eaa165a8573dcc0a966c7845c67f7918e27 Author: Krzysztof Kozlowski Date: Sun Dec 4 10:44:37 2022 +0100 arm64: dts: qcom: sdm845-sony-xperia-tama: fix no-mmc property for SDHCI There is no "no-emmc" property, so intention for SD/SDIO only nodes was to use "no-mmc": qcom/sdm845-sony-xperia-tama-akatsuki.dtb: mmc@8804000: Unevaluated properties are not allowed ('no-emmc' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20221204094438.73288-5-krzysztof.kozlowski@linaro.org commit 6e36e6c6b3d15442b0fed406f2449f00e0a01c1a Author: Krzysztof Kozlowski Date: Sun Dec 4 10:44:36 2022 +0100 arm64: dts: qcom: sda660-inforce-ifc6560: fix no-mmc property for SDHCI There is no "no-emmc" property, so intention for SD/SDIO only nodes was to use "no-mmc": qcom/sda660-inforce-ifc6560.dtb: mmc@c084000: Unevaluated properties are not allowed ('no-emmc' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio